Overview

overview

9

Static

static

5

DeviceHost.exe

windows10-2004-x64

9

DeviceHost.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    900s
  • max time network
    496s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 04:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    DeviceHost.exe
  • Size 780KB
  • Sample260629-fa2mesds7t
  • SHA256 74dd8cdc532329315bf12d2ad2376d5ad0eab28f25a931911bdb23264ad9e3e2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasionupx

Malware Config

Signatures

  • Enumerates VirtualBox registry keys 2 TTPs 4 IoCs
    defense_evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    defense_evasion
  • Drops file in Drivers directory 64 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VMWare services registry key. 1 TTPs 2 IoCs
    defense_evasion
  • Manipulates Digital Signatures 2 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Loads dropped DLL 1 IoCs
  • Drops desktop.ini file(s) 33 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Modifies termsrv.dll 1 TTPs 1 IoCs

    Commonly used to allow simultaneous RDP sessions.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DeviceHost.exe
    "C:\Users\Admin\AppData\Local\Temp\DeviceHost.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Looks for VMWare services registry key.
    • Maps connected drives based on registry
    • Checks system information in the registry
    • Suspicious use of WriteProcessMemory
    PID:5320
    • C:\Windows\System32\Wbem\wmic.exe
      wmic.exe path win32_VideoController get name /value
      2⤵
      • Detects videocard installed
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2044
    • C:\Windows\System32\Wbem\wmic.exe
      wmic.exe computersystem get manufacturer /value
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1988
    • C:\Windows\System32\Wbem\wmic.exe
      wmic.exe computersystem get model /value
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2692
    • C:\Windows\System32\Wbem\wmic.exe
      wmic.exe bios get manufacturer /value
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4404
    • C:\Windows\System32\Wbem\wmic.exe
      wmic.exe bios get serialnumber /value
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4720
    • C:\Windows\System32\Wbem\wmic.exe
      wmic.exe bios get version /value
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4988
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\kill_yourself.cmd"
      2⤵
      • Drops file in Drivers directory
      • Manipulates Digital Signatures
      • Drops desktop.ini file(s)
      • Drops file in System32 directory
      • Modifies termsrv.dll
      • Drops file in Windows directory
      PID:4616
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:3852
    • C:\Windows\System32\SecurityHealthHost.exe
      \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
      1⤵
        PID:2116

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            kill_yourself.cmd
            • Path C:\Users\Admin\AppData\Local\Temp\kill_yourself.cmd
            • Size 80B
            • SHA256 fe94e1a862ff2deb2f466b6986ea571810cf2958325d9e6d90758243c06fe362
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            r5fuvcl0odps6q.dll
            • Path C:\Windows\System32\r5fuvcl0odps6q.dll
            • Size 2.9MB
            • SHA256 c2ff3130b6016cd3a697adff5826520d855d2fb6d08dfe3c990f5ffee1730230
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/5320-0-0x00007FF754D30000-0x00007FF754F78000-memory.dmp
            Download

            memory/5320-4-0x00007FF754D30000-0x00007FF754F78000-memory.dmp
            Download