Analysis
- max time kernel
150s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
25/08/2026, 18:17
General
- Target filezilla.exe
- Size 4.1MB
- Sample260825-ww794aad39
- SHA256 edf7122d777bc0efddd7da1e75e8b75bceb9dd3b657f1ee997f60a75e7b320f8
Malware Config
Signatures
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\filezilla.exe"C:\Users\Admin\AppData\Local\Temp\filezilla.exe"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2456-0-0x00007FF7DA090000-0x00007FF7DA4B7000-memory.dmp
memory/2456-36-0x00007FF898C10000-0x00007FF898C96000-memory.dmp
memory/2456-37-0x00007FF898730000-0x00007FF898854000-memory.dmp
memory/2456-50-0x00007FF896060000-0x00007FF896572000-memory.dmp
memory/2456-49-0x00007FF897820000-0x00007FF897A53000-memory.dmp
memory/2456-44-0x00007FF898B60000-0x00007FF898C04000-memory.dmp
memory/2456-43-0x00007FF897A60000-0x00007FF897C91000-memory.dmp
memory/2456-39-0x00007FF897CA0000-0x00007FF897E72000-memory.dmp
memory/2456-38-0x0000000066380000-0x00000000664BB000-memory.dmp
memory/2456-35-0x00007FF89A1A0000-0x00007FF89A314000-memory.dmp
memory/2456-53-0x00007FF898AD0000-0x00007FF898B10000-memory.dmp
memory/2456-52-0x00007FF89A500000-0x00007FF89A53E000-memory.dmp
memory/2456-48-0x00007FF89D610000-0x00007FF89D644000-memory.dmp
memory/2456-47-0x00007FF8A6F60000-0x00007FF8A6F71000-memory.dmp
memory/2456-46-0x00007FF898600000-0x00007FF898659000-memory.dmp
memory/2456-45-0x00007FF89EEA0000-0x00007FF89EEE6000-memory.dmp
memory/2456-42-0x00007FF8AD030000-0x00007FF8AD042000-memory.dmp
memory/2456-41-0x00007FF898660000-0x00007FF89872A000-memory.dmp
memory/2456-33-0x00007FF8A1F30000-0x00007FF8A1FD9000-memory.dmp
memory/2456-32-0x00007FF7DA090000-0x00007FF7DA4B7000-memory.dmp
memory/2456-34-0x00007FF8A7160000-0x00007FF8A71C7000-memory.dmp
memory/2456-51-0x0000000052E10000-0x0000000052E39000-memory.dmp
memory/2456-40-0x00007FF8ACA60000-0x00007FF8ACA8B000-memory.dmp
memory/2456-62-0x00007FF897CA0000-0x00007FF897E72000-memory.dmp
memory/2456-73-0x00007FF896060000-0x00007FF896572000-memory.dmp
memory/2456-117-0x00007FF896060000-0x00007FF896572000-memory.dmp
memory/2456-183-0x00007FF896060000-0x00007FF896572000-memory.dmp
memory/2456-249-0x00007FF896060000-0x00007FF896572000-memory.dmp