fd1aebb0a26886452964b7b72f0197d4e385b28f85714b63a160cfdb5d323d02

Analysis

user interaction
yes
max time kernel
12s
max time network
14s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
16/07/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New.vmp.exe
Size 12.8MB
Sample260716-e4da9ac12n
SHA256 fd1aebb0a26886452964b7b72f0197d4e385b28f85714b63a160cfdb5d323d02
MD5 d0afa4acb13f13c3b99b0df316c133fc
SHA1 5087855098d26696ecd70655318958d2d34bf379
SHA512 b39798cefba9a8e072cb2a104347fa86dea3f57386a41a80f137779801c5f6315e6599ba10e8684300334e08c31098be6f86c4d7249c91559769c807bcd9f33f
SSDEEP 196608:W6ZPgCXb4QOI2Z/PQ/pkTtN8fEJtscNmmg2xqEYBOZlC1CP/DixIUgNxzY2:9oc4BJK+8fETfgodDimUq
TLSH
T19BD623E684D522F4C6D70FA0624A93CF7190B17E09BCBC2D3BC51D829936DAA154EF63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1444	sc.exe
2712	sc.exe
2592	sc.exe
4664	sc.exe

Kills process with taskkill 16 IoCs

defense_evasion

pid	Process
3808	taskkill.exe
3064	taskkill.exe
1508	taskkill.exe
3816	taskkill.exe
2260	taskkill.exe
1944	taskkill.exe
3384	taskkill.exe
1920	taskkill.exe
4340	taskkill.exe
4800	taskkill.exe
2196	taskkill.exe
5080	taskkill.exe
1548	taskkill.exe
2100	taskkill.exe
1796	taskkill.exe
3996	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2168	New.vmp.exe
2168	New.vmp.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	4800	taskkill.exe
Token: SeDebugPrivilege	1796	taskkill.exe
Token: SeDebugPrivilege	2196	taskkill.exe
Token: SeDebugPrivilege	1508	taskkill.exe
Token: SeDebugPrivilege	5080	taskkill.exe
Token: SeDebugPrivilege	3384	taskkill.exe
Token: SeDebugPrivilege	3996	taskkill.exe
Token: SeDebugPrivilege	1548	taskkill.exe
Token: SeDebugPrivilege	1920	taskkill.exe
Token: SeDebugPrivilege	1944	taskkill.exe
Token: SeDebugPrivilege	3816	taskkill.exe
Token: SeDebugPrivilege	3808	taskkill.exe
Token: SeDebugPrivilege	2260	taskkill.exe
Token: SeDebugPrivilege	4340	taskkill.exe
Token: SeDebugPrivilege	3064	taskkill.exe
Token: SeDebugPrivilege	2100	taskkill.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 4584	2168	New.vmp.exe	83
PID 2168 wrote to memory of 1344	2168	New.vmp.exe	84
PID 2168 wrote to memory of 1764	2168	New.vmp.exe	85
PID 2168 wrote to memory of 3468	2168	New.vmp.exe	86
PID 2168 wrote to memory of 4052	2168	New.vmp.exe	87
PID 2168 wrote to memory of 2568	2168	New.vmp.exe	88
PID 2168 wrote to memory of 2940	2168	New.vmp.exe	89
PID 4052 wrote to memory of 4800	4052	cmd.exe	97
PID 2940 wrote to memory of 1704	2940	cmd.exe	98
PID 1344 wrote to memory of 1796	1344	cmd.exe	100
PID 3468 wrote to memory of 2592	3468	cmd.exe	101
PID 4584 wrote to memory of 2196	4584	cmd.exe	102
PID 1764 wrote to memory of 1508	1764	cmd.exe	103
PID 2168 wrote to memory of 4960	2168	New.vmp.exe	104
PID 2168 wrote to memory of 4236	2168	New.vmp.exe	105
PID 2168 wrote to memory of 4508	2168	New.vmp.exe	106
PID 2168 wrote to memory of 3920	2168	New.vmp.exe	107
PID 2168 wrote to memory of 4408	2168	New.vmp.exe	109
PID 2168 wrote to memory of 4336	2168	New.vmp.exe	110
PID 2168 wrote to memory of 2860	2168	New.vmp.exe	116
PID 2168 wrote to memory of 2488	2168	New.vmp.exe	117
PID 2168 wrote to memory of 5004	2168	New.vmp.exe	119
PID 2168 wrote to memory of 4936	2168	New.vmp.exe	120
PID 2168 wrote to memory of 2964	2168	New.vmp.exe	121
PID 2168 wrote to memory of 4196	2168	New.vmp.exe	122
PID 2168 wrote to memory of 3552	2168	New.vmp.exe	123
PID 2168 wrote to memory of 1368	2168	New.vmp.exe	124
PID 2168 wrote to memory of 2652	2168	New.vmp.exe	125
PID 2168 wrote to memory of 3884	2168	New.vmp.exe	126
PID 2168 wrote to memory of 4600	2168	New.vmp.exe	127
PID 2168 wrote to memory of 2676	2168	New.vmp.exe	128
PID 4408 wrote to memory of 5080	4408	cmd.exe	140
PID 4236 wrote to memory of 3384	4236	cmd.exe	141
PID 4960 wrote to memory of 1548	4960	cmd.exe	142
PID 4508 wrote to memory of 3996	4508	cmd.exe	143
PID 3920 wrote to memory of 4664	3920	cmd.exe	144
PID 4600 wrote to memory of 1920	4600	cmd.exe	145
PID 2488 wrote to memory of 1944	2488	cmd.exe	146
PID 2652 wrote to memory of 3816	2652	cmd.exe	147
PID 2860 wrote to memory of 3808	2860	cmd.exe	148
PID 2964 wrote to memory of 2260	2964	cmd.exe	149
PID 3552 wrote to memory of 4340	3552	cmd.exe	150
PID 4936 wrote to memory of 1444	4936	cmd.exe	151
PID 5004 wrote to memory of 3064	5004	cmd.exe	152
PID 3884 wrote to memory of 2712	3884	cmd.exe	153
PID 1368 wrote to memory of 2100	1368	cmd.exe	154

C:\Users\Admin\AppData\Local\Temp\New.vmp.exe
"C:\Users\Admin\AppData\Local\Temp\New.vmp.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2196
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1796
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1508
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:2592
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4800
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  PID:2568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\New.vmp.exe" MD5
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\New.vmp.exe" MD5
    3⤵
    PID:1704
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1548
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3384
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3996
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3920
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:4664
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5080
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  PID:4336
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3808
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1944
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3064
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:1444
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2260
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  PID:4196
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4340
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2100
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3816
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:2712
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1920
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  PID:2676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2168-0-0x00007FF774348000-0x00007FF774A9D000-memory.dmp

Download

memory/2168-1-0x00007FF8927B0000-0x00007FF8927B2000-memory.dmp

Download

memory/2168-2-0x00007FF7741C0000-0x00007FF775771000-memory.dmp

Download

memory/2168-6-0x00007FF774348000-0x00007FF774A9D000-memory.dmp

Download

memory/2168-7-0x00007FF7741C0000-0x00007FF775771000-memory.dmp

Download