Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
22/09/2026, 11:50
General
- Target filezilla.exe
- Size 4.1MB
- Sample260922-nz3vsasvcs
- SHA256 84ade0a797ffab4771eb4b0521b4404ec0be86e91824bbe0dafb69c099d74828
Malware Config
Signatures
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\filezilla.exe"C:\Users\Admin\AppData\Local\Temp\filezilla.exe"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3236-0-0x00007FF7C9340000-0x00007FF7C9768000-memory.dmp
memory/3236-32-0x00007FF7C9340000-0x00007FF7C9768000-memory.dmp
memory/3236-37-0x00007FFAB2500000-0x00007FFAB25A9000-memory.dmp
memory/3236-38-0x0000000066380000-0x00000000664BB000-memory.dmp
memory/3236-51-0x00007FFAA0710000-0x00007FFAA0943000-memory.dmp
memory/3236-43-0x00007FFAA9840000-0x00007FFAA98E4000-memory.dmp
memory/3236-41-0x00007FFAA00A0000-0x00007FFAA05B2000-memory.dmp
memory/3236-39-0x00007FFAB0D50000-0x00007FFAB0E74000-memory.dmp
memory/3236-36-0x00007FFAA98F0000-0x00007FFAA9AC2000-memory.dmp
memory/3236-53-0x00007FFAB0D10000-0x00007FFAB0D4E000-memory.dmp
memory/3236-52-0x00007FFAB0F00000-0x00007FFAB0F40000-memory.dmp
memory/3236-50-0x00007FFAA76F0000-0x00007FFAA7749000-memory.dmp
memory/3236-49-0x00007FFAB0F40000-0x00007FFAB0F86000-memory.dmp
memory/3236-48-0x0000000077660000-0x0000000077689000-memory.dmp
memory/3236-47-0x00007FFAB21A0000-0x00007FFAB21D4000-memory.dmp
memory/3236-46-0x00007FFAB6D40000-0x00007FFAB6D51000-memory.dmp
memory/3236-45-0x00007FFAA3F80000-0x00007FFAA404A000-memory.dmp
memory/3236-42-0x00007FFAB7170000-0x00007FFAB7182000-memory.dmp
memory/3236-34-0x00007FFAB0F90000-0x00007FFAB1104000-memory.dmp
memory/3236-40-0x00007FFAB8800000-0x00007FFAB882B000-memory.dmp
memory/3236-35-0x00007FFAB5570000-0x00007FFAB55F6000-memory.dmp
memory/3236-33-0x00007FFAB5630000-0x00007FFAB5697000-memory.dmp
memory/3236-44-0x00007FFAA0950000-0x00007FFAA0B81000-memory.dmp
memory/3236-59-0x00007FFAA98F0000-0x00007FFAA9AC2000-memory.dmp
memory/3236-64-0x00007FFAA00A0000-0x00007FFAA05B2000-memory.dmp
memory/3236-86-0x00007FFAA00A0000-0x00007FFAA05B2000-memory.dmp
memory/3236-108-0x00007FFAA00A0000-0x00007FFAA05B2000-memory.dmp
memory/3236-152-0x00007FFAA00A0000-0x00007FFAA05B2000-memory.dmp
memory/3236-174-0x00007FFAA00A0000-0x00007FFAA05B2000-memory.dmp
memory/3236-218-0x00007FFAA00A0000-0x00007FFAA05B2000-memory.dmp
memory/3236-284-0x00007FFAA00A0000-0x00007FFAA05B2000-memory.dmp
memory/3236-306-0x00007FFAA00A0000-0x00007FFAA05B2000-memory.dmp