Analysis
- max time kernel
300s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
16/09/2026, 14:07
General
- Target Ansiklopedi.exe
- Size 200.4MB
- Sample260916-re76jsbc53
- SHA256 7783adcbaaa224e9b780e8d969af57a24e4395e4f27e4262ab18b3517a8a6ce3
Malware Config
Signatures
- Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ansiklopedi.exe"C:\Users\Admin\AppData\Local\Temp\Ansiklopedi.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ansiklopedi.exe"C:\Users\Admin\AppData\Local\Temp\Ansiklopedi.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ansiklopedi-16" --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1756,i,10509974950244286902,10625662337908965531,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1752 /prefetch:22⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Ansiklopedi.exe"C:\Users\Admin\AppData\Local\Temp\Ansiklopedi.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ansiklopedi-16" --field-trial-handle=1756,i,10509974950244286902,10625662337908965531,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:112⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Ansiklopedi.exe"C:\Users\Admin\AppData\Local\Temp\Ansiklopedi.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ansiklopedi-16" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1789568028907288 --launch-time-ticks=527688614 --field-trial-handle=1756,i,10509974950244286902,10625662337908965531,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Ansiklopedi.exe"C:\Users\Admin\AppData\Local\Temp\Ansiklopedi.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\ansiklopedi-16" --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1756,i,10509974950244286902,10625662337908965531,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
default.exc
data_0
data_1
data_2
data_3
CURRENT
memory/3064-45-0x00007FFE5F400000-0x00007FFE5F401000-memory.dmp
memory/3064-44-0x00007FFE5E7B0000-0x00007FFE5E7B1000-memory.dmp
memory/3064-105-0x0000021B4F690000-0x0000021B4F77A000-memory.dmp
memory/4580-139-0x000001EB53F90000-0x000001EB53F91000-memory.dmp
memory/4580-138-0x000001EB53F90000-0x000001EB53F91000-memory.dmp
memory/4580-127-0x000001EB53F90000-0x000001EB53F91000-memory.dmp
memory/4580-129-0x000001EB53F90000-0x000001EB53F91000-memory.dmp
memory/4580-128-0x000001EB53F90000-0x000001EB53F91000-memory.dmp
memory/4580-133-0x000001EB53F90000-0x000001EB53F91000-memory.dmp
memory/4580-140-0x000001EB54AB0000-0x000001EB5637A000-memory.dmp
memory/4580-134-0x000001EB53F90000-0x000001EB53F91000-memory.dmp
memory/4580-137-0x000001EB53F90000-0x000001EB53F91000-memory.dmp
memory/4580-136-0x000001EB53F90000-0x000001EB53F91000-memory.dmp
memory/4580-135-0x000001EB53F90000-0x000001EB53F91000-memory.dmp
memory/4868-108-0x000001C623FD0000-0x000001C62589A000-memory.dmp
memory/4868-104-0x000001C623FD0000-0x000001C62589A000-memory.dmp
memory/4868-145-0x000001C623FD0000-0x000001C62589A000-memory.dmp