Analysis
- max time kernel
149s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 19:47
General
- Target filezilla.exe
- Size 4.0MB
- Sample260804-yhmscayepd
- SHA256 da6b36e2e247c99e6066e402a9784ab52938cd08c35797640b5dd9733786e25e
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 6 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\filezilla.exe"C:\Users\Admin\AppData\Local\Temp\filezilla.exe"1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\FileZilla_3.69.6_win64-setup.exeC:\Users\Admin\Downloads\FileZilla_3.69.6_win64-setup.exe /update /NCRC2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
System.dll
UAC.dll
UserInfo.dll
nsDialogs.dll
FileZilla_3.69.6_win64-setup.exe
memory/5740-61-0x00007FF8238B0000-0x00007FF82394E000-memory.dmp
memory/5740-66-0x00007FF820BA0000-0x00007FF820BC1000-memory.dmp
memory/5740-40-0x00007FF823820000-0x00007FF8238A2000-memory.dmp
memory/5740-39-0x00007FF810540000-0x00007FF810704000-memory.dmp
memory/5740-38-0x00007FF810FE0000-0x00007FF81113F000-memory.dmp
memory/5740-37-0x00007FF817BE0000-0x00007FF817CD6000-memory.dmp
memory/5740-36-0x00007FF8238B0000-0x00007FF82394E000-memory.dmp
memory/5740-50-0x00007FF817B80000-0x00007FF817BD6000-memory.dmp
memory/5740-49-0x000000005C050000-0x000000005C079000-memory.dmp
memory/5740-45-0x00007FF8186C0000-0x00007FF818764000-memory.dmp
memory/5740-41-0x00007FF820BA0000-0x00007FF820BC1000-memory.dmp
memory/5740-47-0x00007FF820750000-0x00007FF820799000-memory.dmp
memory/5740-35-0x00007FF74E0C0000-0x00007FF74E4D0000-memory.dmp
memory/5740-44-0x00007FF80C9D0000-0x00007FF80CED1000-memory.dmp
memory/5740-60-0x00007FF74E0C0000-0x00007FF74E4D0000-memory.dmp
memory/5740-51-0x00007FF8159B0000-0x00007FF8159F0000-memory.dmp
memory/5740-62-0x00007FF817BE0000-0x00007FF817CD6000-memory.dmp
memory/5740-42-0x00007FF810F20000-0x00007FF810FDA000-memory.dmp
memory/5740-63-0x00007FF810FE0000-0x00007FF81113F000-memory.dmp
memory/5740-43-0x0000000066380000-0x00000000664BB000-memory.dmp
memory/5740-46-0x00007FF810320000-0x00007FF810538000-memory.dmp
memory/5740-48-0x00007FF80C7E0000-0x00007FF80C9C7000-memory.dmp
memory/5740-80-0x000000005C010000-0x000000005C04F000-memory.dmp
memory/5740-79-0x00007FF8159B0000-0x00007FF8159F0000-memory.dmp
memory/5740-78-0x00007FF817B80000-0x00007FF817BD6000-memory.dmp
memory/5740-76-0x00007FF80C7E0000-0x00007FF80C9C7000-memory.dmp
memory/5740-73-0x00007FF810320000-0x00007FF810538000-memory.dmp
memory/5740-77-0x000000005C050000-0x000000005C079000-memory.dmp
memory/5740-75-0x00007FF820750000-0x00007FF820799000-memory.dmp
memory/5740-72-0x00007FF8186C0000-0x00007FF818764000-memory.dmp
memory/5740-69-0x00007FF80C9D0000-0x00007FF80CED1000-memory.dmp
memory/5740-68-0x0000000066380000-0x00000000664BB000-memory.dmp
memory/5740-67-0x00007FF810F20000-0x00007FF810FDA000-memory.dmp
memory/5740-65-0x00007FF823820000-0x00007FF8238A2000-memory.dmp
memory/5740-64-0x00007FF810540000-0x00007FF810704000-memory.dmp
memory/5740-52-0x000000005C010000-0x000000005C04F000-memory.dmp