Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 08:12
General
- Target 9799e6a045e4b838a35be973e96071ab545e0c1548e5c92081c9cc915714d0bf.exe
- Size 14.0MB
- Sample260809-j4a84steld
- SHA256 9799e6a045e4b838a35be973e96071ab545e0c1548e5c92081c9cc915714d0bf
Malware Config
Signatures
- VMProtect packed file 20 IoCs
Detects executables packed with VMProtect commercial packer.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9799e6a045e4b838a35be973e96071ab545e0c1548e5c92081c9cc915714d0bf.exe"C:\Users\Admin\AppData\Local\Temp\9799e6a045e4b838a35be973e96071ab545e0c1548e5c92081c9cc915714d0bf.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3716-0-0x0000000000D2B000-0x0000000001364000-memory.dmp
memory/3716-5-0x0000000003E10000-0x0000000003E11000-memory.dmp
memory/3716-2-0x00000000027A0000-0x00000000027A1000-memory.dmp
memory/3716-6-0x0000000003E20000-0x0000000003E21000-memory.dmp
memory/3716-7-0x0000000003E30000-0x0000000003E31000-memory.dmp
memory/3716-4-0x0000000003E00000-0x0000000003E01000-memory.dmp
memory/3716-11-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3716-8-0x0000000000400000-0x0000000001ED4000-memory.dmp
memory/3716-53-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3716-51-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3716-49-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3716-47-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3716-45-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3716-43-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3716-39-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3716-37-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3716-35-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3716-33-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3716-31-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3716-29-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3716-27-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3716-25-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3716-21-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3716-20-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3716-17-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3716-15-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3716-13-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3716-12-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3716-41-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3716-23-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3716-3-0x0000000003DF0000-0x0000000003DF1000-memory.dmp
memory/3716-1-0x0000000002780000-0x0000000002781000-memory.dmp
memory/3716-54-0x0000000000400000-0x0000000001ED4000-memory.dmp
memory/3716-55-0x0000000000400000-0x0000000001ED4000-memory.dmp
memory/3716-58-0x0000000000400000-0x0000000001ED4000-memory.dmp
memory/3716-59-0x0000000000400000-0x0000000001ED4000-memory.dmp
memory/3716-60-0x0000000000400000-0x0000000001ED4000-memory.dmp
memory/3716-61-0x0000000000400000-0x0000000001ED4000-memory.dmp
memory/3716-62-0x0000000000400000-0x0000000001ED4000-memory.dmp
memory/3716-63-0x0000000000400000-0x0000000001ED4000-memory.dmp
memory/3716-64-0x0000000000400000-0x0000000001ED4000-memory.dmp
memory/3716-65-0x0000000000400000-0x0000000001ED4000-memory.dmp
memory/3716-66-0x0000000000400000-0x0000000001ED4000-memory.dmp
memory/3716-67-0x0000000000400000-0x0000000001ED4000-memory.dmp
memory/3716-68-0x0000000000400000-0x0000000001ED4000-memory.dmp
memory/3716-69-0x0000000000400000-0x0000000001ED4000-memory.dmp
memory/3716-78-0x0000000000400000-0x0000000001ED4000-memory.dmp
memory/3716-79-0x0000000000D2B000-0x0000000001364000-memory.dmp
memory/3716-80-0x0000000000400000-0x0000000001ED4000-memory.dmp
memory/3716-81-0x0000000000400000-0x0000000001ED4000-memory.dmp
memory/3716-82-0x0000000000400000-0x0000000001ED4000-memory.dmp
memory/3716-83-0x0000000000400000-0x0000000001ED4000-memory.dmp