Analysis
- max time kernel
148s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 07:29
Behavioral task
behavioral1
Sample
349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe
- Size 6.3MB
- Sample260722-jbmrfa1dja
- SHA256 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e
- MD5 07e13bf3495e15be1bfa0f7081f4b53e
- SHA1 3cebf0e830227839d77da70f1328189624479b00
- SHA512 92e4f8b63ad75a093223269c84b667a660e941d9c02e5198d62c24e7f67a004d37d3d4668d44f9f06e14b307a4174a77ce175dc056696518448507bc224bd0e8
- SSDEEP 98304:H3DJYMi2FtXheq8gh2sx1nTxQ1Dp7kV8p9J1L1VWjNz93PNms:H3DJYWhrk2tT+1SO9tcF
- TLSH T1B266D04F79E905ACD86FC039C6926A74F5B238606FB096CF2EC58ACD1F235E59439312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4884 mvxol28qm5.sys - Loads dropped DLL 1 IoCs
pid Process 4336 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe -
resource yara_rule behavioral2/memory/4336-7-0x00007FF7FF670000-0x00007FF7FFCCD000-memory.dmp vmprotect - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4336 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe - Drops file in Windows directory 46 IoCs
description ioc Process File created C:\Windows\dg8ln\UI\antivirus.png 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\Module\ControlWindow\cwapi_32.dll 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\icon.png 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\sys_dlg_restore.png 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\vertical_border.bmp 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\button_normal.png 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\button_pushed.png 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\commmon.png 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\xroo3ua\mvxol28qm5.sys 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\NoNoNoUse.txt 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\Module\ControlWindow\remote.exe 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\tabbar_normal.png 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File opened for modification C:\Windows\dg8ln\AdhLog.txt 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\dv.dat 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\AdhUiRes.zip 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\Module\ControlWindow\ControlWindow.dll 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\Module\ControlWindow\hkthunk.dll 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\skin.xml 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\softwaremanager.png 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\sys_dlg_menu.png 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\bg.jpg 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\Module\ControlWindow\hkthunk64.dll 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\preventnumber.png 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\scrollbar.bmp 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\toolbar_hover.png 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\toolbar_normal.png 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\cloud.png 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\Module\ControlWindow\ControlWindow.dll.__config.ini 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\ComputerExamine.xml 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\tabbar_pushed.png 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\networkshield.png 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\Module\ControlWindow\GLLA.exe 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\horizontal_border.bmp 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\search_bg.png 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\tabbar_hover.png 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\toolbar_pushed.png 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\button_hover.png 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\firewall_ok.png 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\skin.xml.bak 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\sys_dlg_min.png 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\AdhRes.zip 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\examine_background.bmp 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\firewall.png 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\navigationbar.bmp 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\sys_dlg_close.png 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe File created C:\Windows\dg8ln\UI\sys_dlg_max.png 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4336 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe 4336 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe 4336 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe 4336 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe 4336 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe 4336 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 816 Process not Found - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4336 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4336 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4336 349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe"C:\Users\Admin\AppData\Local\Temp\349979387d29222e3a0da4aee99cc3b1f2c37f4a419fdb11d168c12fac4d751e.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4336
-
C:\Windows\xroo3ua\mvxol28qm5.sysC:\Windows\xroo3ua\mvxol28qm5.sys1⤵
- Executes dropped EXE
PID:4884
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\dg8ln\AdhLog.txt
- Size 3KB
- SHA256 fe1364d77b2a15f327b4ec7921f66dd89fa3e4a55e55bc1ec47e5904e0d4b2f0
- MD5 a7d42f07e0cae65877658e47dba37582
- SHA1 eabc291d737969963329098c503c23a3a9e81f00
- SHA512 ea4a4318905d4f8a652f023157a6405802ecee683015422caa52c856153f34572f9ad4bad2e8e35cd86b35d742e1a4d048bb10cd6aa7cc90544400e5da082bd0
- TLSH T1C8519B9B132A21970C87CDE590DF2ED96BCA2307648F9D162292283ED43F6B7C9421D5
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\dg8ln\AdhLog.txt
- Size 5KB
- SHA256 77c93eb083ad7993d0a5f1a6dddff54b47c87da3456048f931060bfb0570d098
- MD5 43b02bf352a1a587c1415f5834356209
- SHA1 1516f64ec6070e00dd8a453e7f4cb5ffad9f4a59
- SHA512 22b56d0296180cfbd84827fb2e50138077357ac56a1b4c41c8c16c197c480825491ed8c1a4ec9011c20795dd812fcd3a998bb2eda3f77900b03e2762c41c596e
- SSDEEP 96:/2EruRArDLUfN2EhMwQWsj00U2pYF1sQ9Z:/2Er3ri2EhTQWsjbpk1sQf
- TLSH T1A4B1EE9B032A21D70CC7CDE5A0DF2ED96BC92317658F9D162292243ED83FAB7C9421D5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\dg8ln\Module\ControlWindow\ControlWindow.dll
- Size 949KB
- SHA256 b16405230e1be42383fe1eb1da6a9cead6d167706f57825cd283883b39f533c7
- MD5 497d1af3a71c3af04d720abb4f96d9b2
- SHA1 d50d157c549b9db703fb6283d20d23dec0154596
- SHA512 5364bae36bd6666d5d4af6996c6839ec3564b54a9f43cafc597d97d8ed8f0d4f39ed1b2f7c66461c95b1a369a8a9e1dbf6ba2e44b9aa428a208edfd7c6bfb977
- SSDEEP 24576:V0GcS3NPNhNZeNWdYTC9xMSFNNLNCxddbYSUZ5nr0Fn76qVLrCIqhqw3h+QnI8Sr:OYh7x
- TLSH T13F25A19B8BB66185E0F6903544622276BE31389FD735B383C7C6D6D62BA2390D93DF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\xroo3ua\mvxol28qm5.sys
- Size 245KB
- SHA256 c9e1bc1813bf3e181946641a42c4e73830c69dd75008a9b4358213e143dff712
- MD5 b1cac3bdea0b24261ea669024c0ee0f0
- SHA1 853d4e2507f45742cfbe70bd49c0fe5ee9e71fe8
- SHA512 c330873c4902b9a89dbe990a86eb06fead711a615ce17d985869548fb09a87e696fc6187c6c93faf9a0dfc25f05e6487f273e218fab3b16dac1e2e4afce361c6
- SSDEEP 3072:8diNFj78fakbPmRLhGWhdkOJxlS+24NibvsX7fJL54Cf:Q2Fj7I9bP4GWsy/jNibvsAM
- TLSH T15434295872F80158D2BAB1B48AE78685E772793153260BDF0155C47A0F23EE49E3BF29
- MD5 SHA1 SHA512 SSDEEP TLSH