Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/09/2026, 12:31
General
- Target filezilla.exe
- Size 4.1MB
- Sample260909-pp46jacb93
- SHA256 84ade0a797ffab4771eb4b0521b4404ec0be86e91824bbe0dafb69c099d74828
Malware Config
Signatures
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\filezilla.exe"C:\Users\Admin\AppData\Local\Temp\filezilla.exe"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4116-0-0x00007FF6FDF90000-0x00007FF6FE3B8000-memory.dmp
memory/4116-33-0x00007FFE68CE0000-0x00007FFE68D89000-memory.dmp
memory/4116-41-0x00007FFE69A70000-0x00007FFE69A9B000-memory.dmp
memory/4116-52-0x00007FFE5BDB0000-0x00007FFE5BDF0000-memory.dmp
memory/4116-51-0x00007FFE5BDF0000-0x00007FFE5BE2E000-memory.dmp
memory/4116-50-0x00007FFE5CB70000-0x00007FFE5CBA4000-memory.dmp
memory/4116-49-0x0000000058580000-0x00000000585A9000-memory.dmp
memory/4116-48-0x00007FFE69380000-0x00007FFE69391000-memory.dmp
memory/4116-47-0x00007FFE5BE30000-0x00007FFE5BED4000-memory.dmp
memory/4116-46-0x00007FFE68BF0000-0x00007FFE68C49000-memory.dmp
memory/4116-45-0x00007FFE693A0000-0x00007FFE693E6000-memory.dmp
memory/4116-44-0x00007FFE69A50000-0x00007FFE69A62000-memory.dmp
memory/4116-42-0x00007FFE5C120000-0x00007FFE5C632000-memory.dmp
memory/4116-40-0x0000000066380000-0x00000000664BB000-memory.dmp
memory/4116-39-0x00007FFE63E30000-0x00007FFE63EFA000-memory.dmp
memory/4116-38-0x00007FFE5C640000-0x00007FFE5C812000-memory.dmp
memory/4116-37-0x00007FFE68C50000-0x00007FFE68CD6000-memory.dmp
memory/4116-36-0x00007FFE5C820000-0x00007FFE5C944000-memory.dmp
memory/4116-35-0x00007FFE5C950000-0x00007FFE5CAC4000-memory.dmp
memory/4116-34-0x00007FFE696D0000-0x00007FFE69737000-memory.dmp
memory/4116-43-0x00007FFE5BEE0000-0x00007FFE5C111000-memory.dmp
memory/4116-32-0x00007FF6FDF90000-0x00007FF6FE3B8000-memory.dmp
memory/4116-53-0x00007FFE5BB70000-0x00007FFE5BDA3000-memory.dmp
memory/4116-61-0x00007FFE5C640000-0x00007FFE5C812000-memory.dmp
memory/4116-65-0x00007FFE5C120000-0x00007FFE5C632000-memory.dmp
memory/4116-87-0x00007FFE5C120000-0x00007FFE5C632000-memory.dmp
memory/4116-109-0x00007FFE5C120000-0x00007FFE5C632000-memory.dmp
memory/4116-153-0x00007FFE5C120000-0x00007FFE5C632000-memory.dmp
memory/4116-175-0x00007FFE5C120000-0x00007FFE5C632000-memory.dmp
memory/4116-241-0x00007FFE5C120000-0x00007FFE5C632000-memory.dmp
memory/4116-285-0x00007FFE5C120000-0x00007FFE5C632000-memory.dmp
memory/4116-307-0x00007FFE5C120000-0x00007FFE5C632000-memory.dmp