Overview

overview

9

Static

static

3

Checker.exe

windows10-ltsc_2021-x64

9

Checker.exe

windows11-21h2-x64

9

Analysis

  • user interaction
    yes
  • max time kernel
    62s
  • max time network
    572s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    28/08/2026, 13:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Checker.exe
  • Size 2.1MB
  • Sample260828-qxtkfaycnd
  • SHA256 63f5a766fd62d10cf1b2a63324ff2a94ef5703fe8aecdcfc71e20f3b9c8ff137
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionspywarestealertrojan

Malware Config

Signatures

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    defense_evasion
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks for any installed AV software in registry 1 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies boot configuration data using bcdedit 2 IoCs
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 4 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Executes a command shell one-liner 1 TTPs 10 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Time Discovery 1 TTPs 4 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Checker.exe
    "C:\Users\Admin\AppData\Local\Temp\Checker.exe"
    1⤵
    • Checks for any installed AV software in registry
    • Checks whether UAC is enabled
    • Enumerates connected drives
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4548
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c dotnet --list-runtimes 2>nul
      2⤵
      • Executes a command shell one-liner
      • System Time Discovery
      • Suspicious use of WriteProcessMemory
      PID:3228
      • C:\Program Files\dotnet\dotnet.exe
        dotnet --list-runtimes
        3⤵
        • System Time Discovery
        PID:4008
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c bcdedit /enum {current}
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4256
      • C:\Windows\system32\bcdedit.exe
        bcdedit /enum {current}
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:4028
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference -ErrorAction SilentlyContinue).PUAProtection"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5096
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference -ErrorAction SilentlyContinue).PUAProtection"
        3⤵
        • Hide Artifacts: Ignore Process Interrupts
        • Suspicious use of AdjustPrivilegeToken
        PID:2464
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c manage-bde -status C:
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2572
      • C:\Windows\system32\manage-bde.exe
        manage-bde -status C:
        3⤵
          PID:2864
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference -ErrorAction SilentlyContinue).MAPSReporting"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2028
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference -ErrorAction SilentlyContinue).MAPSReporting"
          3⤵
          • Hide Artifacts: Ignore Process Interrupts
          • Suspicious use of AdjustPrivilegeToken
          PID:2912
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c dotnet --list-runtimes 2>nul
        2⤵
        • Executes a command shell one-liner
        • System Time Discovery
        • Suspicious use of WriteProcessMemory
        PID:340
        • C:\Program Files\dotnet\dotnet.exe
          dotnet --list-runtimes
          3⤵
          • System Time Discovery
          PID:4024
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c bcdedit /enum {current}
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3180
        • C:\Windows\system32\bcdedit.exe
          bcdedit /enum {current}
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:4536
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference -ErrorAction SilentlyContinue).PUAProtection"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2624
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference -ErrorAction SilentlyContinue).PUAProtection"
          3⤵
          • Hide Artifacts: Ignore Process Interrupts
          • Suspicious use of AdjustPrivilegeToken
          PID:1020
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c manage-bde -status C:
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:920
        • C:\Windows\system32\manage-bde.exe
          manage-bde -status C:
          3⤵
            PID:8
        • C:\Windows\SYSTEM32\cmd.exe
          cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference -ErrorAction SilentlyContinue).MAPSReporting"
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3716
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference -ErrorAction SilentlyContinue).MAPSReporting"
            3⤵
            • Hide Artifacts: Ignore Process Interrupts
            • Suspicious use of AdjustPrivilegeToken
            PID:668
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /7
        1⤵
          PID:4268
        • C:\Windows\system32\taskmgr.exe
          "C:\Windows\system32\taskmgr.exe" /7
          1⤵
            PID:1032
          • C:\Windows\system32\taskmgr.exe
            "C:\Windows\system32\taskmgr.exe" /7
            1⤵
              PID:3732
            • C:\Windows\system32\taskmgr.exe
              "C:\Windows\system32\taskmgr.exe" /7
              1⤵
                PID:3916
              • C:\Windows\system32\taskmgr.exe
                "C:\Windows\system32\taskmgr.exe" /7
                1⤵
                  PID:672
                • C:\Windows\system32\taskmgr.exe
                  "C:\Windows\system32\taskmgr.exe" /7
                  1⤵
                    PID:588
                  • C:\Windows\system32\taskmgr.exe
                    "C:\Windows\system32\taskmgr.exe" /7
                    1⤵
                      PID:2000
                    • C:\Windows\system32\taskmgr.exe
                      "C:\Windows\system32\taskmgr.exe" /7
                      1⤵
                        PID:1560

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            powershell.exe.log
                            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                            • Size 4KB
                            • SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 5716a31c2cf137c367ebddac8f375d014af9f4e1318720ea51109fa02d69ebe3
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 85fe8ed3fc48c6b103275a82eaa1de0e1763a611162e253fa4b75aaa53f1ea3a
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 e89a29d9204324bdb3e6e02751de9c25d3a7f10188f254b00975c461c1363f14
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            __PSScriptPolicyTest_opfsfm3l.m5b.ps1
                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_opfsfm3l.m5b.ps1
                            • Size 60B
                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            memory/2464-20-0x000001CBA7E20000-0x000001CBA7E3C000-memory.dmp
                            Download

                            memory/2464-4-0x000001CBA7A80000-0x000001CBA7AA2000-memory.dmp
                            Download

                            memory/2464-21-0x000001CBA7E00000-0x000001CBA7E0A000-memory.dmp
                            Download

                            memory/2464-22-0x000001CBA80C0000-0x000001CBA80DA000-memory.dmp
                            Download

                            memory/2464-23-0x000001CBA7E10000-0x000001CBA7E18000-memory.dmp
                            Download

                            memory/2464-24-0x000001CBA80A0000-0x000001CBA80A6000-memory.dmp
                            Download

                            memory/2464-25-0x000001CBA80B0000-0x000001CBA80BA000-memory.dmp
                            Download

                            memory/2464-19-0x000001CBA7DF0000-0x000001CBA7DFA000-memory.dmp
                            Download

                            memory/2464-18-0x000001CBA7D30000-0x000001CBA7DE3000-memory.dmp
                            Download

                            memory/2464-17-0x000001CBA7D10000-0x000001CBA7D2C000-memory.dmp
                            Download

                            memory/3916-71-0x0000019560EB0000-0x0000019560EB1000-memory.dmp
                            Download

                            memory/3916-73-0x0000019560EB0000-0x0000019560EB1000-memory.dmp
                            Download

                            memory/3916-72-0x0000019560EB0000-0x0000019560EB1000-memory.dmp
                            Download

                            memory/3916-83-0x0000019560EB0000-0x0000019560EB1000-memory.dmp
                            Download

                            memory/3916-82-0x0000019560EB0000-0x0000019560EB1000-memory.dmp
                            Download

                            memory/3916-81-0x0000019560EB0000-0x0000019560EB1000-memory.dmp
                            Download

                            memory/3916-80-0x0000019560EB0000-0x0000019560EB1000-memory.dmp
                            Download

                            memory/3916-79-0x0000019560EB0000-0x0000019560EB1000-memory.dmp
                            Download

                            memory/3916-78-0x0000019560EB0000-0x0000019560EB1000-memory.dmp
                            Download

                            memory/3916-77-0x0000019560EB0000-0x0000019560EB1000-memory.dmp
                            Download

                            memory/4548-0-0x00007FF6971A0000-0x00007FF6975D7000-memory.dmp
                            Download