Resubmissions
02/08/2026, 19:54
260802-ymyemswzcx1023/07/2026, 07:16
260723-h3xkaatckh1016/07/2026, 01:57
260716-cdafkaes5s1016/07/2026, 01:56
260716-ccxvgaaz2l1015/07/2026, 07:32
260715-jc74rsev7l10Analysis
- max time kernel
133s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
16/07/2026, 01:57
Errors
General
- Target 4363463463464363463463463.exe
- Size 10KB
- Sample260716-cdafkaes5s
- SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- UAC bypass 3 TTPs 1 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Disables RegEdit via registry modification 1 IoCs
- Downloads MZ/PE file 7 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 3 IoCs
- Themida packer 5 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 2 IoCs
- Modifies WinLogon 2 TTPs 3 IoCs
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- NSIS installer 2 IoCs
- Modifies Control Panel 4 IoCs
- Modifies data under HKEY_USERS 15 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
- System policy modification 1 TTPs 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"1⤵
- Downloads MZ/PE file
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\pe2shc.exe"C:\Users\Admin\AppData\Local\Temp\Files\pe2shc.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c pause3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\1.exe"C:\Users\Admin\AppData\Local\Temp\Files\1.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\teleport-assist-windows.exe"C:\Users\Admin\AppData\Local\Temp\Files\teleport-assist-windows.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\NoEscape.exe"C:\Users\Admin\AppData\Local\Temp\Files\NoEscape.exe"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Modifies WinLogon
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- System policy modification
-
-
C:\Users\Admin\AppData\Local\Temp\Files\UrbanVPN.exe"C:\Users\Admin\AppData\Local\Temp\Files\UrbanVPN.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\hbvTmbP46IIEeHP1.exe"C:\Users\Admin\AppData\Local\Temp\Files\hbvTmbP46IIEeHP1.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Temp\Files\donut.exe"C:\Users\Admin\AppData\Local\Temp\Files\donut.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa399d055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Winlogon Helper DLL
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
5Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
1.exe
NoEscape.exe
UrbanVPN.exe
donut.exe
hbvTmbP46IIEeHP1.exe
pe2shc.exe
teleport-assist-windows.exe
InstallOptions.dll
System.dll
UserInfo.dll
ioSpecial.ini
⮶Ⴑປ᭖ᕼዛ❍⅐܅⧫ᨁ☱〭⡷ട⁰ଣⷓ⪴➻ٗ
memory/2536-56-0x0000000000400000-0x00000000005CC000-memory.dmp
memory/2536-523-0x0000000000400000-0x00000000005CC000-memory.dmp
memory/2688-146-0x0000000140000000-0x0000000140A09000-memory.dmp
memory/2688-156-0x0000000140000000-0x0000000140A09000-memory.dmp
memory/2688-157-0x0000000140000000-0x0000000140A09000-memory.dmp
memory/2688-159-0x0000000140000000-0x0000000140A09000-memory.dmp
memory/4304-0-0x0000000000970000-0x0000000000978000-memory.dmp
memory/4304-3-0x0000000005440000-0x0000000005450000-memory.dmp
memory/4304-2-0x0000000005440000-0x0000000005450000-memory.dmp
memory/4304-1-0x00000000051A0000-0x000000000523C000-memory.dmp