Analysis
- user interaction
yes - max time kernel
66s - max time network
82s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
08/08/2026, 17:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AndroidUtility.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
AndroidUtility.exe
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target AndroidUtility.exe
- Size 336.8MB
- Sample260808-v4cygsar2w
- SHA256 f5fe706aa4c2050a4a3c900404f1a814c7d211a2efb4ef35abef6f26a2240deb
- MD5 2272064e479a415e6ac5ff2576c10d0e
- SHA1 cc43ecf1c3ad6128fd48a95f29babecc179b95cd
- SHA512 91eb9a3bc4a2b709176fad7a3ad6f080e5c778e1041fdd68ba8c2556f402b2a3d7bd225d8180da489aba7222007a129119d51194e3f66c8ebbd5799fed5fcec7
- SSDEEP 3145728:vwikZbbLwWxsOjnTzP9xNNvuEBvUpvu5ojTMX8qe/fhCWsEEcNvj:RhwVTX7HvOvHjRqesEEcNvj
- TLSH T105F8F106FA07ED72C64782748D6A9B3937327D5487018AD3B54CE6AEFC732D05A7E209
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 5140 AndroidUtility.exe 5140 AndroidUtility.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: AndroidUtility.exe File opened (read-only) \??\F: AndroidUtility.exe - System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AndroidUtility.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe - Enumerates system info in registry 2 TTPs 20 IoCs
description ioc Process Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS AndroidUtility.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS AndroidUtility.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS AndroidUtility.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer AndroidUtility.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily AndroidUtility.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMinorRelease AndroidUtility.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMajorRelease AndroidUtility.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct AndroidUtility.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate AndroidUtility.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU AndroidUtility.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName AndroidUtility.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\EnclosureType AndroidUtility.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BiosMajorRelease AndroidUtility.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardVersion AndroidUtility.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer AndroidUtility.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ AndroidUtility.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion AndroidUtility.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BiosMinorRelease AndroidUtility.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion AndroidUtility.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor AndroidUtility.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 5140 AndroidUtility.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5140 AndroidUtility.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2816 wmic.exe Token: SeSecurityPrivilege 2816 wmic.exe Token: SeTakeOwnershipPrivilege 2816 wmic.exe Token: SeLoadDriverPrivilege 2816 wmic.exe Token: SeSystemProfilePrivilege 2816 wmic.exe Token: SeSystemtimePrivilege 2816 wmic.exe Token: SeProfSingleProcessPrivilege 2816 wmic.exe Token: SeIncBasePriorityPrivilege 2816 wmic.exe Token: SeCreatePagefilePrivilege 2816 wmic.exe Token: SeBackupPrivilege 2816 wmic.exe Token: SeRestorePrivilege 2816 wmic.exe Token: SeShutdownPrivilege 2816 wmic.exe Token: SeDebugPrivilege 2816 wmic.exe Token: SeSystemEnvironmentPrivilege 2816 wmic.exe Token: SeRemoteShutdownPrivilege 2816 wmic.exe Token: SeUndockPrivilege 2816 wmic.exe Token: SeManageVolumePrivilege 2816 wmic.exe Token: 33 2816 wmic.exe Token: 34 2816 wmic.exe Token: 35 2816 wmic.exe Token: 36 2816 wmic.exe Token: SeIncreaseQuotaPrivilege 2816 wmic.exe Token: SeSecurityPrivilege 2816 wmic.exe Token: SeTakeOwnershipPrivilege 2816 wmic.exe Token: SeLoadDriverPrivilege 2816 wmic.exe Token: SeSystemProfilePrivilege 2816 wmic.exe Token: SeSystemtimePrivilege 2816 wmic.exe Token: SeProfSingleProcessPrivilege 2816 wmic.exe Token: SeIncBasePriorityPrivilege 2816 wmic.exe Token: SeCreatePagefilePrivilege 2816 wmic.exe Token: SeBackupPrivilege 2816 wmic.exe Token: SeRestorePrivilege 2816 wmic.exe Token: SeShutdownPrivilege 2816 wmic.exe Token: SeDebugPrivilege 2816 wmic.exe Token: SeSystemEnvironmentPrivilege 2816 wmic.exe Token: SeRemoteShutdownPrivilege 2816 wmic.exe Token: SeUndockPrivilege 2816 wmic.exe Token: SeManageVolumePrivilege 2816 wmic.exe Token: 33 2816 wmic.exe Token: 34 2816 wmic.exe Token: 35 2816 wmic.exe Token: 36 2816 wmic.exe Token: SeIncreaseQuotaPrivilege 3912 wmic.exe Token: SeSecurityPrivilege 3912 wmic.exe Token: SeTakeOwnershipPrivilege 3912 wmic.exe Token: SeLoadDriverPrivilege 3912 wmic.exe Token: SeSystemProfilePrivilege 3912 wmic.exe Token: SeSystemtimePrivilege 3912 wmic.exe Token: SeProfSingleProcessPrivilege 3912 wmic.exe Token: SeIncBasePriorityPrivilege 3912 wmic.exe Token: SeCreatePagefilePrivilege 3912 wmic.exe Token: SeBackupPrivilege 3912 wmic.exe Token: SeRestorePrivilege 3912 wmic.exe Token: SeShutdownPrivilege 3912 wmic.exe Token: SeDebugPrivilege 3912 wmic.exe Token: SeSystemEnvironmentPrivilege 3912 wmic.exe Token: SeRemoteShutdownPrivilege 3912 wmic.exe Token: SeUndockPrivilege 3912 wmic.exe Token: SeManageVolumePrivilege 3912 wmic.exe Token: 33 3912 wmic.exe Token: 34 3912 wmic.exe Token: 35 3912 wmic.exe Token: 36 3912 wmic.exe Token: SeIncreaseQuotaPrivilege 3912 wmic.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5140 AndroidUtility.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 5140 wrote to memory of 2816 5140 AndroidUtility.exe 79 PID 5140 wrote to memory of 3912 5140 AndroidUtility.exe 82 PID 5140 wrote to memory of 3360 5140 AndroidUtility.exe 84 PID 5140 wrote to memory of 3764 5140 AndroidUtility.exe 86 PID 5140 wrote to memory of 1488 5140 AndroidUtility.exe 88 PID 5140 wrote to memory of 3148 5140 AndroidUtility.exe 90 PID 5140 wrote to memory of 5820 5140 AndroidUtility.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\AndroidUtility.exe"C:\Users\Admin\AppData\Local\Temp\AndroidUtility.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic cpu get name2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2816
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic PATH Win32_videocontroller get VideoProcessor2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3912
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic PATH Win32_VideoController get AdapterRAM2⤵
- System Location Discovery: System Language Discovery
PID:3360
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic OS get Caption,OSArchitecture,Version2⤵
- System Location Discovery: System Language Discovery
PID:3764
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic Memorychip Get Manufacturer,Capacity,Speed,PartNumber2⤵
- System Location Discovery: System Language Discovery
PID:1488
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic Diskdrive Get Model,Size2⤵
- System Location Discovery: System Language Discovery
PID:3148
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic Path Win32_VideoController get Caption,VideoModeDescription2⤵
- System Location Discovery: System Language Discovery
PID:5820
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\AndroidUtility-hMicju\metacore.dll
- Size 13.5MB
- SHA256 338708bf1d47dfb3174452e87a0d29a5bf520d7700d66a256a1afedfccebd277
- MD5 49a8bfdf88676e98ee2a6b04e0f0c773
- SHA1 9627d6f8b1725b25ed5fec1f7596b53adf70e0cc
- SHA512 999552003e82d401279573a04219301d9a85a324bea962de1c0a9ef88d0a2f6e32b7a649f42a33285548e2c19fcdaa32d9ce1d80a1ad33195d25c2eb0ac969e5
- SSDEEP 98304:gNIQ7lSei4YM6+zcvBQSAgeM0LFWnrvNfEWEk7y0hUjO5kNP0IIsnM882dtAdL/b:BQXISvWrvmWjyMLKVWeZ83
- TLSH T1F4E66D136E4DDCB1E985203505A9AD0C426FB58B2B049BE3835EBE7EE4651D0AB3D3C7
- MD5 SHA1 SHA512 SSDEEP TLSH