Analysis
- user interaction
yes - max time kernel
36s - max time network
38s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
01/08/2026, 21:06
General
- Target 网易邮箱小号鸡.exe
- Size 6.3MB
- Sample260801-zxt1msgl21
- SHA256 6636dac777c2f5a266a0916ae3bef6bb8153acf8627e21c654aa1e85f3568b39
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- VMProtect packed file 24 IoCs
Detects executables packed with VMProtect commercial packer.
- UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\网易邮箱小号鸡.exe"C:\Users\Admin\AppData\Local\Temp\网易邮箱小号鸡.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\yuankong.exeC:\Windows\yuankong.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
yuankong.exe
memory/3248-76-0x0000000000990000-0x0000000001435000-memory.dmp
memory/3248-65-0x0000000010000000-0x000000001000E000-memory.dmp
memory/3248-57-0x0000000000990000-0x0000000001435000-memory.dmp
memory/4160-14-0x0000000003160000-0x000000000319E000-memory.dmp
memory/4160-78-0x0000000000400000-0x0000000001215000-memory.dmp
memory/4160-22-0x0000000003160000-0x000000000319E000-memory.dmp
memory/4160-50-0x0000000003160000-0x000000000319E000-memory.dmp
memory/4160-52-0x000000000049A000-0x000000000049B000-memory.dmp
memory/4160-26-0x0000000003160000-0x000000000319E000-memory.dmp
memory/4160-49-0x0000000003160000-0x000000000319E000-memory.dmp
memory/4160-46-0x0000000003160000-0x000000000319E000-memory.dmp
memory/4160-44-0x0000000003160000-0x000000000319E000-memory.dmp
memory/4160-59-0x0000000000400000-0x0000000001215000-memory.dmp
memory/4160-4-0x0000000010000000-0x0000000010017000-memory.dmp
memory/4160-42-0x0000000003160000-0x000000000319E000-memory.dmp
memory/4160-40-0x0000000003160000-0x000000000319E000-memory.dmp
memory/4160-38-0x0000000003160000-0x000000000319E000-memory.dmp
memory/4160-36-0x0000000003160000-0x000000000319E000-memory.dmp
memory/4160-34-0x0000000003160000-0x000000000319E000-memory.dmp
memory/4160-32-0x0000000003160000-0x000000000319E000-memory.dmp
memory/4160-30-0x0000000003160000-0x000000000319E000-memory.dmp
memory/4160-28-0x0000000003160000-0x000000000319E000-memory.dmp
memory/4160-20-0x0000000003160000-0x000000000319E000-memory.dmp
memory/4160-18-0x0000000003160000-0x000000000319E000-memory.dmp
memory/4160-16-0x0000000003160000-0x000000000319E000-memory.dmp
memory/4160-0-0x0000000000400000-0x0000000001215000-memory.dmp
memory/4160-12-0x0000000003160000-0x000000000319E000-memory.dmp
memory/4160-24-0x0000000003160000-0x000000000319E000-memory.dmp
memory/4160-8-0x0000000003160000-0x000000000319E000-memory.dmp
memory/4160-10-0x0000000003160000-0x000000000319E000-memory.dmp
memory/4160-51-0x0000000003160000-0x000000000319E000-memory.dmp
memory/4160-60-0x0000000000400000-0x0000000001215000-memory.dmp
memory/4160-61-0x0000000000400000-0x0000000001215000-memory.dmp
memory/4160-64-0x0000000000400000-0x0000000001215000-memory.dmp
memory/4160-3-0x0000000075EB0000-0x0000000075EB1000-memory.dmp
memory/4160-68-0x0000000000400000-0x0000000001215000-memory.dmp
memory/4160-69-0x0000000000400000-0x0000000001215000-memory.dmp
memory/4160-70-0x0000000000400000-0x0000000001215000-memory.dmp
memory/4160-71-0x0000000000400000-0x0000000001215000-memory.dmp
memory/4160-72-0x0000000000400000-0x0000000001215000-memory.dmp
memory/4160-73-0x0000000000400000-0x0000000001215000-memory.dmp
memory/4160-74-0x0000000000400000-0x0000000001215000-memory.dmp
memory/4160-75-0x00000000031E0000-0x00000000032BA000-memory.dmp
memory/4160-1-0x0000000000400000-0x0000000001215000-memory.dmp
memory/4160-9-0x0000000003160000-0x000000000319E000-memory.dmp
memory/4160-79-0x0000000000400000-0x0000000001215000-memory.dmp
memory/4160-80-0x0000000000400000-0x0000000001215000-memory.dmp
memory/4160-81-0x0000000000400000-0x0000000001215000-memory.dmp
memory/4160-82-0x0000000000400000-0x0000000001215000-memory.dmp
memory/4160-83-0x0000000000400000-0x0000000001215000-memory.dmp
memory/4160-84-0x0000000000400000-0x0000000001215000-memory.dmp
memory/4160-85-0x0000000000400000-0x0000000001215000-memory.dmp