Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
25/08/2026, 12:29
General
- Target oke.vbs
- Size 989KB
- Sample260825-pn445shb84
- SHA256 67ef2b5d6a41473c065f6962b5ef4a780d821476109486e7b97026e3a6b5c320
Malware Config
Signatures
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Executes dropped EXE 1 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\oke.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\helo.exe"C:\Users\Admin\AppData\Local\Temp\helo.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
helo.exe
memory/3516-8-0x0000000074E32000-0x0000000074E33000-memory.dmp
memory/3516-9-0x00000000005F0000-0x00000000006A4000-memory.dmp
memory/3516-10-0x00000000057C0000-0x0000000005D7A000-memory.dmp
memory/3516-11-0x0000000005200000-0x0000000005292000-memory.dmp
memory/3516-12-0x00000000052A0000-0x000000000533C000-memory.dmp
memory/3516-13-0x0000000074E20000-0x00000000755DC000-memory.dmp
memory/3516-14-0x0000000005340000-0x00000000053A6000-memory.dmp
memory/3516-15-0x0000000074E20000-0x00000000755DC000-memory.dmp