Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
09/09/2026, 12:31
General
- Target filezilla.exe
- Size 4.1MB
- Sample260909-pp46jacb93
- SHA256 84ade0a797ffab4771eb4b0521b4404ec0be86e91824bbe0dafb69c099d74828
Malware Config
Signatures
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\filezilla.exe"C:\Users\Admin\AppData\Local\Temp\filezilla.exe"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4824-0-0x00007FF612110000-0x00007FF612538000-memory.dmp
memory/4824-52-0x00007FF8A5B50000-0x00007FF8A5B90000-memory.dmp
memory/4824-53-0x00007FF8A4F60000-0x00007FF8A4F9E000-memory.dmp
memory/4824-51-0x00007FF89F9F0000-0x00007FF89FC23000-memory.dmp
memory/4824-48-0x00007FF8A09F0000-0x00007FF8A0F02000-memory.dmp
memory/4824-43-0x00007FF8A1320000-0x00007FF8A1551000-memory.dmp
memory/4824-41-0x0000000066380000-0x00000000664BB000-memory.dmp
memory/4824-36-0x00007FF8A5BF0000-0x00007FF8A5D14000-memory.dmp
memory/4824-50-0x000000005DEA0000-0x000000005DEC9000-memory.dmp
memory/4824-49-0x00007FF8A5B90000-0x00007FF8A5BE9000-memory.dmp
memory/4824-47-0x00007FF8B3D80000-0x00007FF8B3D91000-memory.dmp
memory/4824-37-0x00007FF8A1710000-0x00007FF8A18E2000-memory.dmp
memory/4824-46-0x00007FF8A85B0000-0x00007FF8A8654000-memory.dmp
memory/4824-45-0x00007FF8B3F90000-0x00007FF8B3FA2000-memory.dmp
memory/4824-44-0x00007FF8AA480000-0x00007FF8AA4C6000-memory.dmp
memory/4824-42-0x00007FF8AA4D0000-0x00007FF8AA504000-memory.dmp
memory/4824-40-0x00007FF8B1BD0000-0x00007FF8B1BFB000-memory.dmp
memory/4824-39-0x00007FF8A4FA0000-0x00007FF8A506A000-memory.dmp
memory/4824-38-0x00007FF8AA510000-0x00007FF8AA596000-memory.dmp
memory/4824-35-0x00007FF8AAE00000-0x00007FF8AAE67000-memory.dmp
memory/4824-32-0x00007FF612110000-0x00007FF612538000-memory.dmp
memory/4824-34-0x00007FF8AA6D0000-0x00007FF8AA779000-memory.dmp
memory/4824-33-0x00007FF8A6600000-0x00007FF8A6774000-memory.dmp
memory/4824-60-0x00007FF8A1710000-0x00007FF8A18E2000-memory.dmp
memory/4824-71-0x00007FF8A09F0000-0x00007FF8A0F02000-memory.dmp
memory/4824-93-0x00007FF8A09F0000-0x00007FF8A0F02000-memory.dmp
memory/4824-115-0x00007FF8A09F0000-0x00007FF8A0F02000-memory.dmp
memory/4824-159-0x00007FF8A09F0000-0x00007FF8A0F02000-memory.dmp