Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 14:07
General
- Target c29dcdb6d0b967b3a0f236ab0c6b7c414e5c327862e5281bb4efd88472cbb4f3.exe
- Size 1.7MB
- Sample260804-rfc2ssyxbw
- SHA256 c29dcdb6d0b967b3a0f236ab0c6b7c414e5c327862e5281bb4efd88472cbb4f3
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: RenamesItself 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c29dcdb6d0b967b3a0f236ab0c6b7c414e5c327862e5281bb4efd88472cbb4f3.exe"C:\Users\Admin\AppData\Local\Temp\c29dcdb6d0b967b3a0f236ab0c6b7c414e5c327862e5281bb4efd88472cbb4f3.exe"1⤵
- Downloads MZ/PE file
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c29dcdb6d0b967b3a0f236ab0c6b7c414e5c327862e5281bb4efd88472cbb4f3.exe"C:\Users\Admin\AppData\Local\Temp\c29dcdb6d0b967b3a0f236ab0c6b7c414e5c327862e5281bb4efd88472cbb4f3.exe" 26682⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\data\Bugreport-262538.dllC:\Users\Admin\AppData\Local\Temp\data\Bugreport-262538.dll Bugreport %E9%AA%8C%E8%AF%81%E6%B6%88%203⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
c29dcdb6d0b967b3a0f236ab0c6b7c414e5c327862e5281bb4efd88472cbb4f3.exe
Bugreport-262538.dll
Bugreport.ini
Bugreport_error.ini
iext1.fnr.bbs.125.la
memory/2548-74-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2548-77-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2548-168-0x0000000000400000-0x0000000000866200-memory.dmp
memory/2548-167-0x0000000000400000-0x0000000000866200-memory.dmp
memory/2548-166-0x0000000000400000-0x0000000000866200-memory.dmp
memory/2548-165-0x0000000000400000-0x0000000000866200-memory.dmp
memory/2548-120-0x0000000000400000-0x0000000000866200-memory.dmp
memory/2548-164-0x0000000000400000-0x0000000000866200-memory.dmp
memory/2548-163-0x0000000000400000-0x0000000000866200-memory.dmp
memory/2548-162-0x0000000000400000-0x0000000000866200-memory.dmp
memory/2548-161-0x0000000000400000-0x0000000000866200-memory.dmp
memory/2548-153-0x0000000000400000-0x0000000000866200-memory.dmp
memory/2548-152-0x0000000000400000-0x0000000000866200-memory.dmp
memory/2548-151-0x0000000000400000-0x0000000000866200-memory.dmp
memory/2548-103-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2548-150-0x0000000000400000-0x0000000000866200-memory.dmp
memory/2548-124-0x0000000002850000-0x0000000002851000-memory.dmp
memory/2548-123-0x0000000002860000-0x0000000002861000-memory.dmp
memory/2548-93-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2548-72-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2548-75-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2548-101-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2548-79-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2548-81-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2548-83-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2548-85-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2548-87-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2548-89-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2548-121-0x0000000000400000-0x0000000000866200-memory.dmp
memory/2548-91-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2548-116-0x0000000003700000-0x0000000003772000-memory.dmp
memory/2548-115-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2548-113-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2548-111-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2548-119-0x0000000000400000-0x0000000000866200-memory.dmp
memory/2548-109-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2548-107-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2548-105-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2548-97-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2548-95-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2548-99-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2668-15-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2668-25-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2668-29-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2668-118-0x0000000000400000-0x0000000000866200-memory.dmp
memory/2668-50-0x0000000000400000-0x0000000000866200-memory.dmp
memory/2668-59-0x0000000000400000-0x0000000000866200-memory.dmp
memory/2668-58-0x0000000000400000-0x0000000000866200-memory.dmp
memory/2668-19-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2668-47-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2668-8-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2668-9-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2668-11-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2668-14-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2668-52-0x0000000000400000-0x0000000000866200-memory.dmp
memory/2668-0-0x0000000000400000-0x0000000000866200-memory.dmp
memory/2668-18-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2668-21-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2668-69-0x0000000000400000-0x0000000000866200-memory.dmp
memory/2668-23-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2668-39-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2668-49-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2668-51-0x0000000003610000-0x0000000003682000-memory.dmp
memory/2668-7-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2668-1-0x0000000000864000-0x0000000000865000-memory.dmp
memory/2668-45-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2668-27-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2668-31-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2668-57-0x0000000000400000-0x0000000000866200-memory.dmp
memory/2668-55-0x0000000000400000-0x0000000000866200-memory.dmp
memory/2668-56-0x0000000000400000-0x0000000000866200-memory.dmp
memory/2668-33-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2668-35-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2668-37-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2668-41-0x0000000010000000-0x000000001003F000-memory.dmp
memory/2668-43-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4564-148-0x0000000000400000-0x0000000000442200-memory.dmp
memory/4564-133-0x0000000000400000-0x0000000000442200-memory.dmp