Analysis
- max time kernel
149s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
26/08/2026, 16:26
General
- Target 四方ws接码客户端4.3.p.exe
- Size 9.1MB
- Sample260826-txrbvssdnb
- SHA256 70076decfe89dc4cb2c7f22db6685b9fdc9a8f9f181d0d6974ac578718084344
Malware Config
Signatures
- Adds policy Run key to start application 2 TTPs 3 IoCs
- Executes dropped EXE 8 IoCs
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 29 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\四方ws接码客户端4.3.p.exe"C:\Users\Admin\AppData\Local\Temp\四方ws接码客户端4.3.p.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ProgramDate\zy_3b4.k.exe"C:\Users\Admin\AppData\Local\ProgramDate\zy_3b4.k.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ProgramDate\zy_3b4.k.exeC:\Users\Admin\AppData\Local\ProgramDate\zy_3b4.k.exe 47043E0458045104770461047604770458044504600469046D046A0458044504740474044004650470046504580456046B04650469046D046A0463045804600476046C04600431046E046C0458046F0435043C0450043D04760447043604300430045B043D046704680468046604340432046A0458046A045C043504680446045504--a\k\`4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\drhd5jh\k18T9rC244_9cllb06n\nX1lBQ.exe"C:\Users\Admin\AppData\Roaming\drhd5jh\k18T9rC244_9cllb06n\nX1lBQ.exe"5⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\2.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\2.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\ProgramDate\zy_3b4.k.exeC:\Users\Admin\AppData\Local\ProgramDate\zy_3b4.k.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ProgramDate\zy_3b4.k.exeC:\Users\Admin\AppData\Local\ProgramDate\zy_3b4.k.exe 47043E0458045104770461047604770458044504600469046D046A0458044504740474044004650470046504580456046B04650469046D046A0463045804600476046C04600431046E046C04580430043C0434044F046C045B044104490431044F043C047E047504300458047E0474046704680448045C043104--a\k\`2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\drhd5jh\480Kh_EM5K8zq4\zpclLX5.exe"C:\Users\Admin\AppData\Roaming\drhd5jh\480Kh_EM5K8zq4\zpclLX5.exe"3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
178BFBFF000306D2
1.exe
2.exe
msvcp140.dll
zy_3b4.k.exe
zpclLX5.exe
zpclLX5.txt
.lnk
vjsc.dll
memory/1884-62-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-144-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-94-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-91-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-39-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-53-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-51-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-100-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-137-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-136-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-133-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-128-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-125-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-122-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-119-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-116-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-111-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-110-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-107-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-98-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-55-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-87-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-85-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-79-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-78-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-46-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-47-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-41-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-37-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-84-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-81-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-76-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-73-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-72-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-67-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-69-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-65-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-95-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-60-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-58-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-89-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-36-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-63-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-43-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-32-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-170-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-167-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-163-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-156-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-158-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-149-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-131-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-129-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-123-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-117-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-145-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-113-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-105-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-154-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-49-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-103-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-101-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-26-0x0000000004FC0000-0x00000000050D0000-memory.dmp
memory/1884-28-0x0000000004EA0000-0x0000000004FAE000-memory.dmp
memory/1884-27-0x00000000050D0000-0x000000000568A000-memory.dmp
memory/1884-29-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-30-0x0000000004EA0000-0x0000000004FA8000-memory.dmp
memory/1884-4983-0x000000000BDC0000-0x000000000C11B000-memory.dmp
memory/1884-4982-0x000000000BD90000-0x000000000BDB2000-memory.dmp
memory/1884-4975-0x00000000057F0000-0x000000000588C000-memory.dmp
memory/1884-4976-0x00000000058A0000-0x0000000005932000-memory.dmp
memory/1884-4977-0x00000000059C0000-0x00000000059CA000-memory.dmp
memory/1884-4978-0x00000000059D0000-0x0000000005A26000-memory.dmp
memory/1884-4979-0x00000000079E0000-0x0000000007B16000-memory.dmp
memory/1884-4981-0x000000000B4F0000-0x000000000B5A2000-memory.dmp
memory/2116-975-0x0000000000400000-0x000000000185F000-memory.dmp
memory/2116-22-0x0000000000400000-0x000000000185F000-memory.dmp
memory/2908-2541-0x0000000000400000-0x000000000185F000-memory.dmp
memory/2908-4991-0x0000000000400000-0x000000000185F000-memory.dmp
memory/5048-742-0x0000000000400000-0x000000000185F000-memory.dmp
memory/5048-288-0x0000000000400000-0x000000000185F000-memory.dmp
memory/5152-2181-0x0000000000400000-0x000000000185F000-memory.dmp
memory/5152-589-0x0000000000400000-0x000000000185F000-memory.dmp
memory/5152-5011-0x0000000000400000-0x000000000185F000-memory.dmp