Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/08/2026, 13:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe
- Size 8.1MB
- Sample260806-qh4f4aaa65
- SHA256 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7
- MD5 06ffd690f2f2a969b5610cb44f39d2b3
- SHA1 683f92846a4769b8acc148de978431cb255a62db
- SHA512 b0cb843a281f9331db554f34bd9f63523f55cfe7d467324b8b46946e6c3bd5d78879bef2c8a07c5eb388c5a064a5e38b22e1fc2907cf0732cd1bb81b0ce8ecb9
- SSDEEP 98304:PMOWJcGFlcblDhHrklAWKrV3jt7m7rl475I6exroGgF0maZLSzeJBAUZLi:IcGFMZhaAWmXmvlgfL9BzeJV2
- TLSH T10B86D012B3818573C056133175BAE77AB738BD424E698657B3C8BFBC7C726628A4314B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe -
resource yara_rule behavioral2/memory/3364-2-0x0000000010000000-0x000000001001E000-memory.dmp upx behavioral2/memory/3364-3-0x00000000060B0000-0x00000000060BB000-memory.dmp upx behavioral2/memory/1908-10-0x0000000003F90000-0x0000000003F9B000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3364 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 3364 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 1908 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3364 wrote to memory of 1908 3364 173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe"C:\Users\Admin\AppData\Local\Temp\173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe173917a6c879677af41e13db02e42ca016fefb59193077bcc9b3a4e7ae42d4b7.exe2⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1908
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\ExuiKrnln_Win32.lib
- Size 2.0MB
- SHA256 11aee837a1d673cc98f5e6d8bda15683309fdc5b9716774bcc5a98e9cdbce8b9
- MD5 a0114ae5ea2d9335bc69efb7e08bed24
- SHA1 27fed39a52c7f7903cc8acfa0394163a7540b3c9
- SHA512 b64088a8cc451bf8e577a0177e6770dbe6a381702e5d0e36935d3f34943c0d51c48c41553e8d67fc639f455235e53d8784d8f94c644268acd76836b7e852d471
- SSDEEP 49152:YZQ2hHrGVNlGeMdeRWlYKFWAJdY0UUO8J3jty2q6a:YDhHrklAWKrV3jt
- TLSH T146A59F61F7C298B2D8A733713666B377B735B8414C2D46DFA3C43A5CA9B42604A87363
- MD5 SHA1 SHA512 SSDEEP TLSH