ffb9f0fefdd64f78bbb755b6ac9dabc2e3a084752185dab6b62f866a6c797e77

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vcdx19ECdyOB.exe
Size 21.0MB
Sample260720-sdc5fsfy8x
SHA256 ffb9f0fefdd64f78bbb755b6ac9dabc2e3a084752185dab6b62f866a6c797e77
MD5 14fba135673b86d9e6280a409c1448ab
SHA1 0b44aad8dd667e1811656f4d52d4aa99e89c67ce
SHA512 1ba2093879e8e80770f253d9fc1cbd2c41b56654529a88c0d2c5b3a0a117257f5fd70220d7569f6b618bcfc6c84686ba829e841b06061c53d9ce3606af91a72b
SSDEEP 393216:D0m0nJOgc0FMnVVPrdQllv7Y/XveHtWrL0n/:pgXIIlcdrLY/
TLSH
T170277C002FB8473AD2AE6772B8A162B047B1E817A312D74E64D4E5A53D537B5CE012FF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\viKwgDLjQZpztEPALvQGdXsqdPtkI\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\viKwgDLjQZpztEPALvQGdXsqdPtkI"	825fcfee.exe

Executes dropped EXE 2 IoCs

pid	Process
1872	qtHHuW2dKx.exe
3472	825fcfee.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1748	powershell.exe
3852	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\eclipsedunlocker	qtHHuW2dKx.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\eclipsedunlocker\URL Protocol	qtHHuW2dKx.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\eclipsedunlocker\DefaultIcon	qtHHuW2dKx.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\eclipsedunlocker\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Eclipsed\\Unlocker\\qtHHuW2dKx.exe,1"	qtHHuW2dKx.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\eclipsedunlocker\shell\open	qtHHuW2dKx.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\eclipsedunlocker\ = "URL:Eclipsed Unlocker"	qtHHuW2dKx.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\eclipsedunlocker\shell\open\command	qtHHuW2dKx.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\eclipsedunlocker\shell	qtHHuW2dKx.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\eclipsedunlocker\shell\open\command\ = "powershell.exe -WindowStyle Hidden -Command \"$exe = Get-ChildItem -Path 'C:\\Users\\Admin\\AppData\\Local\\Eclipsed\\Unlocker' -Filter '.exe' \| Where-Object { $_.Name -notlike 'updater*' } \| Select-Object -First 1 -ExpandProperty FullName; if ($exe) { Start-Process -FilePath $exe -ArgumentList '%1' }\""	qtHHuW2dKx.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1748	powershell.exe
1748	powershell.exe
1872	qtHHuW2dKx.exe
1872	qtHHuW2dKx.exe
1872	qtHHuW2dKx.exe
3852	powershell.exe
3852	powershell.exe
3852	powershell.exe
3472	825fcfee.exe
3472	825fcfee.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
3472	825fcfee.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	5572	vcdx19ECdyOB.exe
Token: SeDebugPrivilege	1748	powershell.exe
Token: SeDebugPrivilege	1872	qtHHuW2dKx.exe
Token: SeDebugPrivilege	3852	powershell.exe
Token: SeDebugPrivilege	3472	825fcfee.exe
Token: SeLoadDriverPrivilege	3472	825fcfee.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5572 wrote to memory of 1748	5572	vcdx19ECdyOB.exe	89
PID 5572 wrote to memory of 1872	5572	vcdx19ECdyOB.exe	91
PID 1872 wrote to memory of 3852	1872	qtHHuW2dKx.exe	93
PID 1872 wrote to memory of 3472	1872	qtHHuW2dKx.exe	96

C:\Users\Admin\AppData\Local\Temp\vcdx19ECdyOB.exe
"C:\Users\Admin\AppData\Local\Temp\vcdx19ECdyOB.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command " $WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\Desktop\UnlockerCore.lnk'); $Shortcut.TargetPath = 'C:\Users\Admin\AppData\Local\Eclipsed\Unlocker\qtHHuW2dKx.exe'; $Shortcut.WorkingDirectory = 'C:\Users\Admin\AppData\Local\Eclipsed\Unlocker'; $Shortcut.Description = 'Eclipsed Unlocker'; $Shortcut.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1748
- C:\Users\Admin\AppData\Local\Eclipsed\Unlocker\qtHHuW2dKx.exe
  "C:\Users\Admin\AppData\Local\Eclipsed\Unlocker\qtHHuW2dKx.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command " $WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\Desktop\UnlockerCore.lnk'); $Shortcut.TargetPath = 'C:\Users\Admin\AppData\Local\Eclipsed\Unlocker\qtHHuW2dKx.exe'; $Shortcut.WorkingDirectory = 'C:\Users\Admin\AppData\Local\Eclipsed\Unlocker'; $Shortcut.Description = 'Eclipsed Unlocker'; $Shortcut.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3852
- - C:\Users\Admin\AppData\Local\Temp\825fcfee.exe
    "C:\Users\Admin\AppData\Local\Temp\825fcfee.exe" "C:\Users\Admin\AppData\Local\Temp\67cf66dc.sys"
    3⤵
    - Sets service image path in registry
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: LoadsDriver
    - Suspicious use of AdjustPrivilegeToken
    PID:3472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.mutex_id

Path C:\Users\Admin\AppData\Local\Eclipsed\Unlocker\.mutex_id
Size 43B
SHA256 22143d10ca489b9008cc4883d012d420ac51bc8b6d4d2d78ae27a2be43f4cf1a
MD5 52f7d5d97d96e71ad70fd30145b8afe1
SHA1 2b9d2f7e694e49ea91daf3bf4160c4fbfecc6043
SHA512 9ca493a953e9e796ae0963761b6f288952d6d41a11f6e1f8e9e51d0f8814604ad92a78ef41732b65a18b797fe4636b853ba07ec1d8d57271a9b1dd53b49c58c5
MD5 SHA1 SHA512

Submit Download

qtHHuW2dKx.exe

Path C:\Users\Admin\AppData\Local\Eclipsed\Unlocker\qtHHuW2dKx.exe
Size 21.0MB
SHA256 ffb9f0fefdd64f78bbb755b6ac9dabc2e3a084752185dab6b62f866a6c797e77
MD5 14fba135673b86d9e6280a409c1448ab
SHA1 0b44aad8dd667e1811656f4d52d4aa99e89c67ce
SHA512 1ba2093879e8e80770f253d9fc1cbd2c41b56654529a88c0d2c5b3a0a117257f5fd70220d7569f6b618bcfc6c84686ba829e841b06061c53d9ce3606af91a72b
SSDEEP 393216:D0m0nJOgc0FMnVVPrdQllv7Y/XveHtWrL0n/:pgXIIlcdrLY/
TLSH
T170277C002FB8473AD2AE6772B8A162B047B1E817A312D74E64D4E5A53D537B5CE012FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 452eb598b2884fd99242cb5db005e3ac8e31bc9e3d58fe88ad0dd79ba08fbfd1
MD5 33f7a6fe6a1ea0bc7232e4b50743aaab
SHA1 f6389fac11178ade648f5f722858ade7790e8676
SHA512 64fed57e8e59a8d4c52029e5b9a9e95959a860dd2b01f96eda9e0484d0ae4572a4759db8892bacc9ddc3f3b2def74d2f9da00853aedc08b55520c731ed45658a
TLSH
T12C115733F3CC8724DC9A413650CEAC1136B687DB409ECE6BBB84D548B42F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

825fcfee.exe

Path C:\Users\Admin\AppData\Local\Temp\825fcfee.exe
Size 147KB
SHA256 de9131947d40217279723514ccc6379d7acfc354bc2cca3ca6a0abe1153b3e11
MD5 779c178ad0eb7e8b119face166fa3564
SHA1 c41124eeebf8fb6c665b73da2ed631a5b6500a59
SHA512 2734d85828e3de10885ca956f62989af55fc4f97b6fad885325562d3bc3376ce644428f2615d6253a47165c754e84e300ef02a4750c74c3b4a9bf4204230b396
SSDEEP 3072:Ilvmx001c78K8pejkw/mJTQSaMm5/6/dY:IYy027t6PWlMu
TLSH
T16AE32B5797A5106DF2B7D6B8C9B20911EB717C950B74D2CF235048BA0F62BD0BA3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnlockerCore.lnk

Path C:\Users\Admin\Desktop\UnlockerCore.lnk
Size 1KB
SHA256 90bbe4e09897ac980cd6d36329acd5571211cbe19e4a1b4729eae00e025ac786
MD5 cd7a29979dcacd76ccffb1e0d73278b0
SHA1 2c714a9b732d3c7ae0055193f39093c7afc4d6bf
SHA512 0d89b08351afc8af8f7fef547f82ad08201aa9123fbd0742d95ba078add2d6b2f9da6af638096dbed7d2a75ed5ba7aad9b48b29d64ac49217b488d347e5ccbe2
TLSH
T1932100456AD61216C2EEC9767DFB2968DDB27C209A058F9C40E1C3092D72B56FE04F1F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1748-13-0x00007FFCF2AC0000-0x00007FFCF3464000-memory.dmp

Download

memory/1748-17-0x00007FFCF2AC0000-0x00007FFCF3464000-memory.dmp

Download

memory/1748-7-0x00007FFCF2AC0000-0x00007FFCF3464000-memory.dmp

Download

memory/1748-3-0x00007FFCF2C4F000-0x00007FFCF2C50000-memory.dmp

Download

memory/1748-12-0x00007FFCF2AC0000-0x00007FFCF3464000-memory.dmp

Download

memory/1748-15-0x00007FFCF2AC0000-0x00007FFCF3464000-memory.dmp

Download

memory/1748-16-0x00007FFCF2AC0000-0x00007FFCF3464000-memory.dmp

Download

memory/1748-11-0x00007FFCF2AC0000-0x00007FFCF3464000-memory.dmp

Download

memory/1748-18-0x00007FFCF2AC0000-0x00007FFCF3464000-memory.dmp

Download

memory/1748-10-0x000002A5E6BD0000-0x000002A5E6BF2000-memory.dmp

Download

memory/1748-22-0x00007FFCF2AC0000-0x00007FFCF3464000-memory.dmp

Download

memory/1748-6-0x00007FFCF2AC0000-0x00007FFCF3464000-memory.dmp

Download

memory/1748-5-0x00007FFCF2AC0000-0x00007FFCF3464000-memory.dmp

Download

memory/1748-4-0x00007FFCF2AC0000-0x00007FFCF3464000-memory.dmp

Download