Analysis
- custom tags
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/07/2026, 07:34
General
- Target ebe335ce3c9574bd6f66d17be71f52172a3741d45ed99b0f3ed540e3c4847b57.exe
- Size 1.9MB
- Sample260718-jee6rsct9n
- SHA256 ebe335ce3c9574bd6f66d17be71f52172a3741d45ed99b0f3ed540e3c4847b57
Malware Config
Signatures
- detect oss ak 24 IoCs
oss ak information detected.
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: RenamesItself 2 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebe335ce3c9574bd6f66d17be71f52172a3741d45ed99b0f3ed540e3c4847b57.exe"C:\Users\Admin\AppData\Local\Temp\ebe335ce3c9574bd6f66d17be71f52172a3741d45ed99b0f3ed540e3c4847b57.exe"1⤵
- Downloads MZ/PE file
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ebe335ce3c9574bd6f66d17be71f52172a3741d45ed99b0f3ed540e3c4847b57.exe"C:\Users\Admin\AppData\Local\Temp\ebe335ce3c9574bd6f66d17be71f52172a3741d45ed99b0f3ed540e3c4847b57.exe" 42002⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\data\Bugreport-655678.dllC:\Users\Admin\AppData\Local\Temp\data\Bugreport-655678.dll Bugreport %E9%AA%A8%E5%A4%B4QQ%E7%A9%BA%E9%97%B4%E8%AE%BF%E5%AE%A2%E7%9B%91%E6%8E%A7%E6%8F%90%203⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Bugreport-655678.dll
Bugreport.ini
ebe335ce3c9574bd6f66d17be71f52172a3741d45ed99b0f3ed540e3c4847b57.exe
iext1.fnr.bbs.125.la
memory/1376-82-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1376-106-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1376-160-0x0000000000400000-0x00000000008BA200-memory.dmp
memory/1376-159-0x0000000000400000-0x00000000008BA200-memory.dmp
memory/1376-158-0x0000000000400000-0x00000000008BA200-memory.dmp
memory/1376-157-0x0000000000400000-0x00000000008BA200-memory.dmp
memory/1376-156-0x0000000000400000-0x00000000008BA200-memory.dmp
memory/1376-155-0x0000000000400000-0x00000000008BA200-memory.dmp
memory/1376-154-0x0000000000400000-0x00000000008BA200-memory.dmp
memory/1376-153-0x0000000000400000-0x00000000008BA200-memory.dmp
memory/1376-152-0x0000000000400000-0x00000000008BA200-memory.dmp
memory/1376-124-0x0000000000400000-0x00000000008BA200-memory.dmp
memory/1376-125-0x0000000000400000-0x00000000008BA200-memory.dmp
memory/1376-79-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1376-80-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1376-94-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1376-108-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1376-77-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1376-84-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1376-86-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1376-120-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1376-88-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1376-90-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1376-92-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1376-96-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1376-98-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1376-100-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1376-102-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1376-104-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1376-118-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1376-110-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1376-123-0x0000000000400000-0x00000000008BA200-memory.dmp
memory/1376-112-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1376-114-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1376-73-0x0000000000400000-0x00000000008BA200-memory.dmp
memory/1376-116-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1376-121-0x00000000039C0000-0x0000000003A32000-memory.dmp
memory/1376-122-0x0000000000400000-0x00000000008BA200-memory.dmp
memory/4200-17-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4200-25-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4200-51-0x0000000000400000-0x00000000008BA200-memory.dmp
memory/4200-74-0x0000000000400000-0x00000000008BA200-memory.dmp
memory/4200-49-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4200-63-0x0000000000400000-0x00000000008BA200-memory.dmp
memory/4200-60-0x0000000000400000-0x00000000008BA200-memory.dmp
memory/4200-59-0x0000000000400000-0x00000000008BA200-memory.dmp
memory/4200-58-0x0000000000400000-0x00000000008BA200-memory.dmp
memory/4200-7-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4200-8-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4200-11-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4200-23-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4200-9-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4200-13-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4200-15-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4200-19-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4200-21-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4200-0-0x0000000000400000-0x00000000008BA200-memory.dmp
memory/4200-62-0x0000000000400000-0x00000000008BA200-memory.dmp
memory/4200-27-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4200-29-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4200-31-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4200-33-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4200-35-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4200-37-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4200-46-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4200-52-0x0000000000400000-0x00000000008BA200-memory.dmp
memory/4200-1-0x00000000008B8000-0x00000000008B9000-memory.dmp
memory/4200-53-0x0000000000400000-0x00000000008BA200-memory.dmp
memory/4200-55-0x0000000000400000-0x00000000008BA200-memory.dmp
memory/4200-39-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4200-41-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4200-44-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4200-47-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4200-50-0x0000000003800000-0x0000000003872000-memory.dmp
memory/4200-54-0x0000000000400000-0x00000000008BA200-memory.dmp
memory/5648-150-0x0000000000400000-0x0000000000442200-memory.dmp
memory/5648-135-0x0000000000400000-0x0000000000442200-memory.dmp