Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 14:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe
- Size 1.0MB
- Sample260629-rxrlhsfx7y
- SHA256 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5
- MD5 3e19dde26e787c4e94c5be1ecc9f613f
- SHA1 a07bf01d862f5ac56e138e6f84751ed89bd63037
- SHA512 5dc75048f1c3b83b6db31eb24004cd14a23b6bd0f121d83915b40fe4fe8b03772105ca07a7e0ad5b393d285dc4f32744428ea7f657081f211e56b9c3bdf1a838
- SSDEEP 24576:LN9+kioQTmkpDRfdLMUvGAu0IoIn2DEV0X1z+At4Yw6ZbWW:LN9+kidRlMUvDu0U2g+X1z+K4by
- TLSH T1443512133A54C527D38507394C1AE3791A47BE65AC01C9AE77A0FEAF39F2351590E2EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
description ioc Process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe - Loads dropped DLL 13 IoCs
pid Process 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe 5804 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4216 set thread context of 5804 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe 88 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe Token: SeDebugPrivilege 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4216 wrote to memory of 5804 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe 88 PID 4216 wrote to memory of 5804 4216 dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe"C:\Users\Admin\AppData\Local\Temp\dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe"1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe"C:\Users\Admin\AppData\Local\Temp\dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5_JC.exe"2⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:5804
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nspB64C.tmp\System.dll
- Size 11KB
- SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
- MD5 17ed1c86bd67e78ade4712be48a7d2bd
- SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
- SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
- SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
- TLSH T1E3325C12135081F3E4918138C86B3A276B6A15029BF98E57DFD39546BE31BE3BD7D603
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nspB64C.tmp\nsExec.dll
- Size 6KB
- SHA256 c4c6fe032f3cd8b31528d7b99661f85ee22cb78746aee98ec568431d4f5043f7
- MD5 b55f7f1b17c39018910c23108f929082
- SHA1 1601f1cc0d0d6bcf35799b7cd15550cd01556172
- SHA512 d652f2b09396ef7b9181996c4700b25840ceaa6c1c10080a55ce3db4c25d8d85f00a21e747f9d14a3374be4cdd4ea829a18d7de9b27b13b5e304447f3e9268fa
- SSDEEP 96:L7fhfKaGgchPzxK6bq+pKX6D8ZLidGgmkN538:RbGgGPzxeX6D8ZyGgmkN
- TLSH T102D1F7B832C20DF3D44D86743F22381717BDD47617B542A1CB932AD61EA2AE2FE21B41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Videos\hemadrometry.ini
- Size 36B
- SHA256 d0178ffd8d08e0d9ecabe9b0f5cea94a5660d6a71489049019f1bedf031cc8af
- MD5 252f9d082d140cfe65428ddae7b3803a
- SHA1 916d4d2a4079cb41e5e0773c3ed8533bc89875b6
- SHA512 2a32e7da5a2c60c14773876fb4a48c98ebb09e635aed706dd73062c3f3fe9eb772532b6e135dbf237546d6086aa0ad8c81902776b5255627689bc3042de1c538
- MD5 SHA1 SHA512