b7ce2cf4c4a9cf3a2906bd3f53fff00f2c3e8ae4200451bf6194b00d94617490

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 23:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 2.5MB
Sample260723-3hlmhayfkg
SHA256 b7ce2cf4c4a9cf3a2906bd3f53fff00f2c3e8ae4200451bf6194b00d94617490
MD5 5f547fc905221d41397fba715e7c578f
SHA1 e5183f5b14a57bc3e06ad108940757eaaa0eb948
SHA512 9da53f76923c11426234e6f01d1589d393a001be4826b9a95c33eee916752bc02df96862680f659f2cfef4a632f042bed4684cb0f7f2d87f6e2eaec517beb755
SSDEEP 49152:VdB+Ul6gn/CSS8EHC9s6Au6TiB/BcZZMV9GdR1dYiERjVEBfVm8sRi:cU0gnKSS8ls6AFmTcjMzGouQR
TLSH
T111C5335A7128B7B0C91A4733E6050F3110D671D09F7B5AC70B961BB09A93AE64833EFB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution persistence upx

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
4368	gojyuqthxylq.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4368 set thread context of 1656	4368	gojyuqthxylq.exe	98
PID 4368 set thread context of 5716	4368	gojyuqthxylq.exe	99

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5716-11-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/5716-12-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/5716-10-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3512	sc.exe
2276	sc.exe
5044	sc.exe
1144	sc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1188	file.exe
1188	file.exe
1188	file.exe
1188	file.exe
4368	gojyuqthxylq.exe
4368	gojyuqthxylq.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 1656	4368	gojyuqthxylq.exe	98
PID 4368 wrote to memory of 1656	4368	gojyuqthxylq.exe	98
PID 4368 wrote to memory of 1656	4368	gojyuqthxylq.exe	98
PID 4368 wrote to memory of 1656	4368	gojyuqthxylq.exe	98
PID 4368 wrote to memory of 1656	4368	gojyuqthxylq.exe	98
PID 4368 wrote to memory of 1656	4368	gojyuqthxylq.exe	98
PID 4368 wrote to memory of 1656	4368	gojyuqthxylq.exe	98
PID 4368 wrote to memory of 1656	4368	gojyuqthxylq.exe	98
PID 4368 wrote to memory of 5716	4368	gojyuqthxylq.exe	99
PID 4368 wrote to memory of 5716	4368	gojyuqthxylq.exe	99
PID 4368 wrote to memory of 5716	4368	gojyuqthxylq.exe	99

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1188
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe delete "JVPHHQQU"
  2⤵
  - Launches sc.exe
  PID:1144
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe create "JVPHHQQU" binpath= "C:\ProgramData\zlkiefeaadia\gojyuqthxylq.exe" start= "auto"
  2⤵
  - Launches sc.exe
  PID:3512
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop eventlog
  2⤵
  - Launches sc.exe
  PID:2276
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe start "JVPHHQQU"
  2⤵
  - Launches sc.exe
  PID:5044

C:\ProgramData\zlkiefeaadia\gojyuqthxylq.exe
C:\ProgramData\zlkiefeaadia\gojyuqthxylq.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:1656
- C:\Windows\system32\conhost.exe
  conhost.exe
  2⤵
  PID:5716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

gojyuqthxylq.exe

Path C:\ProgramData\zlkiefeaadia\gojyuqthxylq.exe
Size 2.5MB
SHA256 b7ce2cf4c4a9cf3a2906bd3f53fff00f2c3e8ae4200451bf6194b00d94617490
MD5 5f547fc905221d41397fba715e7c578f
SHA1 e5183f5b14a57bc3e06ad108940757eaaa0eb948
SHA512 9da53f76923c11426234e6f01d1589d393a001be4826b9a95c33eee916752bc02df96862680f659f2cfef4a632f042bed4684cb0f7f2d87f6e2eaec517beb755
SSDEEP 49152:VdB+Ul6gn/CSS8EHC9s6Au6TiB/BcZZMV9GdR1dYiERjVEBfVm8sRi:cU0gnKSS8ls6AFmTcjMzGouQR
TLSH
T111C5335A7128B7B0C91A4733E6050F3110D671D09F7B5AC70B961BB09A93AE64833EFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1656-7-0x0000000140000000-0x000000014000D000-memory.dmp

Download

memory/1656-6-0x0000000140000000-0x000000014000D000-memory.dmp

Download

memory/1656-5-0x0000000140000000-0x000000014000D000-memory.dmp

Download

memory/1656-4-0x0000000140000000-0x000000014000D000-memory.dmp

Download

memory/1656-3-0x0000000140000000-0x000000014000D000-memory.dmp

Download

memory/5716-11-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/5716-12-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/5716-10-0x0000000140000000-0x0000000140848000-memory.dmp

Download