Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
31/08/2026, 04:20
General
- Target c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
- Size 1.5MB
- Sample260831-ex5rxsef39
- SHA256 c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7
Malware Config
Signatures
- Downloads MZ/PE file 4 IoCs
- Executes dropped EXE 10 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 62 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe"C:\Users\Admin\AppData\Local\Temp\c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe"3⤵
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchlp1.exeC:\Users\Admin\AppData\Local\Temp\svchlp1.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\zr5ijp7d.exe"C:\Users\Admin\AppData\Local\Temp\zr5ijp7d.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchlp2.exeC:\Users\Admin\AppData\Local\Temp\svchlp2.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Opqogy\nyuq.exe"C:\Users\Admin\AppData\Roaming\Opqogy\nyuq.exe"5⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp0a92bc2b.exe"C:\Users\Admin\AppData\Local\Temp\tmp0a92bc2b.exe"6⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpb8488db4.bat"5⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchlp3.exeC:\Users\Admin\AppData\Local\Temp\svchlp3.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /xml "C:\Users\Admin\AppData\Local\Temp\MsEdgeUpdate.xml" /tn "\Users\Admin\WindowsPushNotifSvc" /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchlp5.exeC:\Users\Admin\AppData\Local\Temp\svchlp5.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /xml "C:\Users\Admin\AppData\Local\Temp\MsEdgeUpdate.xml" /tn "\Users\Admin\WindowsPushNotifSvc" /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Microsoft\syshost.exeC:\Users\Admin\AppData\Local\Microsoft\syshost.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /xml "C:\Users\Admin\AppData\Local\Temp\MsEdgeUpdate.xml" /tn "\Users\Admin\WindowsPushNotifSvc" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\Opqogy\nyuq.exeC:\Users\Admin\AppData\Roaming\Opqogy\nyuq.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
MsEdgeUpdate.xml
svchlp1.exe
svchlp2.exe
svchlp3.exe
tmp0a92bc2b.exe
tmpb8488db4.bat
zr5ijp7d.exe
nyuq.exe
memory/936-73-0x00000000005B0000-0x0000000000677000-memory.dmp
memory/936-106-0x0000000004130000-0x0000000004168000-memory.dmp
memory/936-88-0x0000000001DC0000-0x0000000001DE7000-memory.dmp
memory/936-89-0x0000000001DF0000-0x0000000001E1A000-memory.dmp
memory/936-93-0x00000000020D0000-0x0000000002173000-memory.dmp
memory/936-79-0x0000000001010000-0x0000000001706000-memory.dmp
memory/936-81-0x0000000001740000-0x00000000018D9000-memory.dmp
memory/936-83-0x00000000019A0000-0x0000000001B16000-memory.dmp
memory/936-100-0x0000000002650000-0x0000000002698000-memory.dmp
memory/936-91-0x0000000001F00000-0x0000000001FA7000-memory.dmp
memory/936-92-0x0000000001FB0000-0x00000000020C6000-memory.dmp
memory/936-98-0x0000000002180000-0x00000000022CB000-memory.dmp
memory/936-84-0x00000000018E0000-0x00000000018ED000-memory.dmp
memory/936-102-0x00000000027D0000-0x00000000027EB000-memory.dmp
memory/936-82-0x0000000001920000-0x0000000001994000-memory.dmp
memory/936-103-0x00000000027F0000-0x00000000027FD000-memory.dmp
memory/936-104-0x0000000002A10000-0x0000000002A3F000-memory.dmp
memory/936-105-0x0000000004030000-0x000000000404C000-memory.dmp
memory/936-87-0x0000000001DB0000-0x0000000001DBB000-memory.dmp
memory/936-107-0x0000000004170000-0x000000000417C000-memory.dmp
memory/936-108-0x0000000004550000-0x00000000045E9000-memory.dmp
memory/936-112-0x0000000005040000-0x0000000005075000-memory.dmp
memory/936-78-0x0000000000FB0000-0x000000000100D000-memory.dmp
memory/936-76-0x0000000000CD0000-0x0000000000E93000-memory.dmp
memory/936-74-0x0000000000680000-0x0000000000A21000-memory.dmp
memory/936-77-0x0000000000EF0000-0x0000000000FA2000-memory.dmp
memory/936-90-0x0000000001E50000-0x0000000001EF9000-memory.dmp
memory/936-85-0x0000000001B20000-0x0000000001DA3000-memory.dmp
memory/936-109-0x00000000045F0000-0x0000000004616000-memory.dmp
memory/936-110-0x0000000004720000-0x0000000004F4A000-memory.dmp
memory/936-99-0x00000000022D0000-0x000000000264C000-memory.dmp
memory/936-75-0x0000000000B30000-0x0000000000BCD000-memory.dmp
memory/936-101-0x00000000026A0000-0x00000000027C1000-memory.dmp
memory/936-86-0x00000000018F0000-0x000000000190A000-memory.dmp
memory/936-80-0x0000000000EA0000-0x0000000000EA8000-memory.dmp
memory/936-111-0x0000000004F50000-0x0000000005023000-memory.dmp
memory/4204-151-0x0000000001DF0000-0x0000000001E1A000-memory.dmp
memory/4204-135-0x0000000000490000-0x0000000000557000-memory.dmp
memory/4204-137-0x0000000000BC0000-0x0000000000C5D000-memory.dmp
memory/4204-138-0x0000000000D60000-0x0000000000F23000-memory.dmp
memory/4204-155-0x00000000020D0000-0x0000000002173000-memory.dmp
memory/4204-152-0x0000000001E50000-0x0000000001EF9000-memory.dmp
memory/4204-160-0x00000000027D0000-0x00000000027EB000-memory.dmp
memory/4204-158-0x0000000002650000-0x0000000002698000-memory.dmp
memory/4204-139-0x0000000000F30000-0x0000000000FE2000-memory.dmp
memory/4204-153-0x0000000001F00000-0x0000000001FA7000-memory.dmp
memory/4204-149-0x0000000001DB0000-0x0000000001DBB000-memory.dmp
memory/4204-150-0x0000000001DC0000-0x0000000001DE7000-memory.dmp
memory/4204-140-0x0000000000FF0000-0x000000000104D000-memory.dmp
memory/4204-148-0x0000000001D90000-0x0000000001DAA000-memory.dmp
memory/4204-136-0x0000000000730000-0x0000000000AD1000-memory.dmp
memory/4204-146-0x0000000001AF0000-0x0000000001AFD000-memory.dmp
memory/4204-144-0x00000000018F0000-0x0000000001964000-memory.dmp
memory/4204-142-0x00000000005A0000-0x00000000005A8000-memory.dmp
memory/4340-21-0x0000019D4CE10000-0x0000019D4CE12000-memory.dmp
memory/4340-120-0x0000019D509F0000-0x0000019D50A22000-memory.dmp
memory/5396-4-0x00007FFCA6A60000-0x00007FFCA7404000-memory.dmp
memory/5396-20-0x0000021125C60000-0x0000021125C6E000-memory.dmp
memory/5396-13-0x00007FFCA6A60000-0x00007FFCA7404000-memory.dmp
memory/5396-1-0x00007FFCA6BEF000-0x00007FFCA6BF0000-memory.dmp
memory/5396-3-0x00007FFCA6A60000-0x00007FFCA7404000-memory.dmp
memory/5396-226-0x000002113E220000-0x000002113E230000-memory.dmp
memory/5396-227-0x000002113E220000-0x000002113E230000-memory.dmp
memory/5396-225-0x000002113E220000-0x000002113E230000-memory.dmp
memory/5396-0-0x00007FF7CCA50000-0x00007FF7CCBE4000-memory.dmp
memory/5396-175-0x00007FFCA6A60000-0x00007FFCA7404000-memory.dmp
memory/5396-2-0x00000211255C0000-0x00000211255FA000-memory.dmp
memory/5396-174-0x00007FFCA6A60000-0x00007FFCA7404000-memory.dmp
memory/5396-173-0x00007FF7CCA50000-0x00007FF7CCBE4000-memory.dmp
memory/5396-5-0x00007FFCA6A60000-0x00007FFCA7404000-memory.dmp
memory/5396-60-0x000002113E220000-0x000002113E230000-memory.dmp
memory/5396-61-0x000002113E220000-0x000002113E230000-memory.dmp
memory/5396-59-0x000002113E220000-0x000002113E230000-memory.dmp
memory/5396-58-0x00007FFCA6A60000-0x00007FFCA7404000-memory.dmp
memory/5396-56-0x00007FFCA6A60000-0x00007FFCA7404000-memory.dmp
memory/5396-50-0x000002113FA60000-0x000002113FAA0000-memory.dmp
memory/5396-6-0x00007FFCA6A60000-0x00007FFCA7404000-memory.dmp
memory/5396-10-0x00007FFCA6A60000-0x00007FFCA7404000-memory.dmp
memory/5396-15-0x0000021125C10000-0x0000021125C18000-memory.dmp
memory/5396-19-0x00000211439C0000-0x00000211439FE000-memory.dmp
memory/5396-14-0x00007FFCA6A60000-0x00007FFCA7404000-memory.dmp
memory/5396-34-0x00007FFCA6A60000-0x00007FFCA7404000-memory.dmp
memory/5396-12-0x00007FFCA6A60000-0x00007FFCA7404000-memory.dmp
memory/5828-25-0x0000000180000000-0x0000000180005000-memory.dmp
memory/5828-35-0x00000000007C0000-0x00000000007C1000-memory.dmp
memory/5828-68-0x0000000004650000-0x0000000004691000-memory.dmp
memory/5828-71-0x0000000004650000-0x0000000004691000-memory.dmp
memory/5828-122-0x00000000007A0000-0x00000000007A1000-memory.dmp
memory/5828-70-0x0000000004650000-0x0000000004691000-memory.dmp
memory/5828-72-0x0000000004650000-0x0000000004691000-memory.dmp
memory/5828-119-0x0000000004650000-0x0000000004691000-memory.dmp