Analysis
- user interaction
yes - max time kernel
899s - max time network
467s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 16:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ISq8PE2cxO.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
900 seconds
Behavioral task
behavioral2
Sample
ISq8PE2cxO.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
7 signatures
900 seconds
General
- Target ISq8PE2cxO.exe
- Size 23.2MB
- Sample260720-vaycbsat2w
- SHA256 14c576d5f65012336c506d55558c39f7829fd6be7759c5796543646f7a9ebe32
- MD5 f82c9cddf856b792db2ce75d682121e9
- SHA1 1b14da004ea26bc7061cf2622d30de1ab636446d
- SHA512 52f10744a0d74008a8f25658d511ba425c6de5b10843d33e9617eb70140a492ed106820cebcc37c0ce01a4b6aa41100fac82abdeeca1f5522670bbe38da32b18
- SSDEEP 393216:LsrZF4vRTy/9OIkDesQEUA14iLlyt+aW3hwF5rDbFh1+1f0p78yn+O8MAb:+ZF4Zu/9OIkDe1A14UygaWhwFB/14Min
- TLSH T11837332027E80655D2BE8F79C2B40492CB75BB07964AEB4F3C8D70EE1B62781CD5176B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nbRZCIvTfBArlgTltgIEmtkLHGqsd\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\nbRZCIvTfBArlgTltgIEmtkLHGqsd" mapper.exe - Executes dropped EXE 1 IoCs
pid Process 820 mapper.exe - Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 4216 ISq8PE2cxO.exe 4216 ISq8PE2cxO.exe 5348 wmic.exe 5348 wmic.exe 5348 wmic.exe 5348 wmic.exe 4164 wmic.exe 4164 wmic.exe 4164 wmic.exe 4164 wmic.exe 4084 wmic.exe 4084 wmic.exe 4084 wmic.exe 4084 wmic.exe 4216 ISq8PE2cxO.exe 4216 ISq8PE2cxO.exe 4216 ISq8PE2cxO.exe 4216 ISq8PE2cxO.exe 4216 ISq8PE2cxO.exe 4216 ISq8PE2cxO.exe 4216 ISq8PE2cxO.exe 4216 ISq8PE2cxO.exe 4216 ISq8PE2cxO.exe 820 mapper.exe 820 mapper.exe 4216 ISq8PE2cxO.exe 4216 ISq8PE2cxO.exe 4216 ISq8PE2cxO.exe 4216 ISq8PE2cxO.exe 4216 ISq8PE2cxO.exe 4216 ISq8PE2cxO.exe 4216 ISq8PE2cxO.exe 4216 ISq8PE2cxO.exe 4216 ISq8PE2cxO.exe 4216 ISq8PE2cxO.exe 4216 ISq8PE2cxO.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 820 mapper.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4216 ISq8PE2cxO.exe Token: SeIncreaseQuotaPrivilege 5348 wmic.exe Token: SeSecurityPrivilege 5348 wmic.exe Token: SeTakeOwnershipPrivilege 5348 wmic.exe Token: SeLoadDriverPrivilege 5348 wmic.exe Token: SeSystemProfilePrivilege 5348 wmic.exe Token: SeSystemtimePrivilege 5348 wmic.exe Token: SeProfSingleProcessPrivilege 5348 wmic.exe Token: SeIncBasePriorityPrivilege 5348 wmic.exe Token: SeCreatePagefilePrivilege 5348 wmic.exe Token: SeBackupPrivilege 5348 wmic.exe Token: SeRestorePrivilege 5348 wmic.exe Token: SeShutdownPrivilege 5348 wmic.exe Token: SeDebugPrivilege 5348 wmic.exe Token: SeSystemEnvironmentPrivilege 5348 wmic.exe Token: SeRemoteShutdownPrivilege 5348 wmic.exe Token: SeUndockPrivilege 5348 wmic.exe Token: SeManageVolumePrivilege 5348 wmic.exe Token: 33 5348 wmic.exe Token: 34 5348 wmic.exe Token: 35 5348 wmic.exe Token: 36 5348 wmic.exe Token: SeIncreaseQuotaPrivilege 5348 wmic.exe Token: SeSecurityPrivilege 5348 wmic.exe Token: SeTakeOwnershipPrivilege 5348 wmic.exe Token: SeLoadDriverPrivilege 5348 wmic.exe Token: SeSystemProfilePrivilege 5348 wmic.exe Token: SeSystemtimePrivilege 5348 wmic.exe Token: SeProfSingleProcessPrivilege 5348 wmic.exe Token: SeIncBasePriorityPrivilege 5348 wmic.exe Token: SeCreatePagefilePrivilege 5348 wmic.exe Token: SeBackupPrivilege 5348 wmic.exe Token: SeRestorePrivilege 5348 wmic.exe Token: SeShutdownPrivilege 5348 wmic.exe Token: SeDebugPrivilege 5348 wmic.exe Token: SeSystemEnvironmentPrivilege 5348 wmic.exe Token: SeRemoteShutdownPrivilege 5348 wmic.exe Token: SeUndockPrivilege 5348 wmic.exe Token: SeManageVolumePrivilege 5348 wmic.exe Token: 33 5348 wmic.exe Token: 34 5348 wmic.exe Token: 35 5348 wmic.exe Token: 36 5348 wmic.exe Token: SeIncreaseQuotaPrivilege 4164 wmic.exe Token: SeSecurityPrivilege 4164 wmic.exe Token: SeTakeOwnershipPrivilege 4164 wmic.exe Token: SeLoadDriverPrivilege 4164 wmic.exe Token: SeSystemProfilePrivilege 4164 wmic.exe Token: SeSystemtimePrivilege 4164 wmic.exe Token: SeProfSingleProcessPrivilege 4164 wmic.exe Token: SeIncBasePriorityPrivilege 4164 wmic.exe Token: SeCreatePagefilePrivilege 4164 wmic.exe Token: SeBackupPrivilege 4164 wmic.exe Token: SeRestorePrivilege 4164 wmic.exe Token: SeShutdownPrivilege 4164 wmic.exe Token: SeDebugPrivilege 4164 wmic.exe Token: SeSystemEnvironmentPrivilege 4164 wmic.exe Token: SeRemoteShutdownPrivilege 4164 wmic.exe Token: SeUndockPrivilege 4164 wmic.exe Token: SeManageVolumePrivilege 4164 wmic.exe Token: 33 4164 wmic.exe Token: 34 4164 wmic.exe Token: 35 4164 wmic.exe Token: 36 4164 wmic.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4216 ISq8PE2cxO.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4216 wrote to memory of 5348 4216 ISq8PE2cxO.exe 90 PID 4216 wrote to memory of 4164 4216 ISq8PE2cxO.exe 92 PID 4216 wrote to memory of 4084 4216 ISq8PE2cxO.exe 94 PID 4216 wrote to memory of 820 4216 ISq8PE2cxO.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\ISq8PE2cxO.exe"C:\Users\Admin\AppData\Local\Temp\ISq8PE2cxO.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get PNPDeviceID,Caption2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5348
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" cpu get Name2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4164
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" diskdrive get model,serialnumber,size2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4084
-
-
C:\Users\Admin\AppData\Local\Temp\mapper.exe"C:\Users\Admin\AppData\Local\Temp\mapper.exe" "C:\Users\Admin\AppData\Local\Temp\DumperDriver.sys"2⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
PID:820
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:6136
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:4980
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\mapper.exe
- Size 149KB
- SHA256 a409196f988e71b5d1cba96714cfd9d260e122b2a5217c73601350bf04c3ec50
- MD5 3adf4078b07c24b51d6c611ac7a8e4ba
- SHA1 0df3f08cd170990b8d6f12e7ac88b42c5dacbf78
- SHA512 4621a8da3dd558c9b00c77315f7bd77dc6086070ca396eb6cce5b6df37efe8ddf9eaccd5a65ea36dd731b35971961d654527936e5c71474df35cd33d2e0c6409
- SSDEEP 3072:XTPLc/WCB8AQtDdUIIPkwJmJTQSaMm5/6yU/Q:riXBzOdyM1WllE
- TLSH T12DE32A1797A5102DE1B7DAB8CAB24911EB717C550B74E6CF135049B90F32BD0BA3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\ISOLogs\debug.log
- Size 2KB
- SHA256 bc1f3b555744a66106cbeeb5bc57558b25aa09816a01b568e9185dd29eedd4fe
- MD5 a47762837a5157106e83100107999824
- SHA1 7d37e7ce4289db4b2491be74883e7ea2819587f1
- SHA512 5fa0d708268b6a7852b8ea4a367242af2abdd9d874e0d5c8d62b488ab93fcd2ad760dd2c4a0e58ebcc57b9bc4b407d0d4773831ca8aacc8ac275f9bde58190df
- TLSH T1A6514116ABD0406E553BB0B7810345F06F9496064BE11DB1903FB50AB5A5097B3BFDFE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\ISOLogs\debug.log
- Size 3KB
- SHA256 3ba2da040754afde9511b69043106e14d9a808e5f9676cde9bc5f86e54ea7b70
- MD5 0c10d1b98a29c8da908bc02b204d547d
- SHA1 0e063d876f84e30519e17c4b54e5f2cf3e54fb14
- SHA512 74b7fbaaf2ac7e6a1c597fdfec4d0f71ca67946983904edbedb380f93a2084a08f8a5e9bd6c9f651b37c3410cb734fc3e072e60b47597dcee62d391348a37863
- TLSH T102610E06ABD0017AA57B707B810355F11F9093465BE12CB1943FB04AB1A6197B2BFCFA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\ISOLogs\debug.log
- Size 3KB
- SHA256 2414facf7cb18e4c98927f1ce8211aeefe3485f139b1618c5c739cd995e863e5
- MD5 3e970ae9fac761ea991978e89f00c285
- SHA1 f4f09b52224eb66c8d39a723e50a9cb2afd44e0a
- SHA512 8c2244e9bccd42713f20cac07f597142e99d11be6b48ae716652c63a1c20efa7b083dba0df983d14edf56b5cc6474225bcf1399d4f83cf5fe9ed295fe7a74369
- TLSH T1E3810C026BD0017BA57FB07B810355F11F9482466BF12CB1943F744772E65AAA2BBCF9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\ISOLogs\debug.log
- Size 4KB
- SHA256 07059ec5c8523a3a317ab1564f615d05d122759a0f852bb9731aa1960da9f6b4
- MD5 329521da173309c270beaae28ff9836e
- SHA1 97b3c010fd0b3e33c35d6dd63d53dfafa80498b9
- SHA512 140c54062ca21d67669fdb30b2491c05a3bc32679a8800f0accc3ff981a69e0a9abe85f9b210ceafb2a7f869522be5bcf2c98c174cedb0b515f8a56e889cc1ef
- SSDEEP 48:wz9hkcXxHIQH5cdb9Jm3IhFJBA7tgWKgqHrf/FsA+PJ07+njC/bMucbTx6X+fJu2:U/x3H5cVjmYhFYWWKgn2OJACf/3
- TLSH T1F5911D02ABD0057B91BF707B920345F01B9482476BF12CB1943F744771E556AA6BBCF9
- MD5 SHA1 SHA512 SSDEEP TLSH