0ef04eb5c6b97a196a5b4321a1ed6636a49fc5a219aded17e0db64675f720a1f

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 2.0MB
Sample260924-wfwlcsssfx
SHA256 0ef04eb5c6b97a196a5b4321a1ed6636a49fc5a219aded17e0db64675f720a1f
MD5 3cb3ad8cf814c37a66caabb4c486f3af
SHA1 64c56a915b18231d92955d9dcf56166e971c6ab2
SHA512 e16b344678c940c1922d0361318689eaef9546eba65956e089b416be9f95dafcb28f0a098e0a0eaff3dc2578791a2e79383789231c0fbab1a013cfa100422d99
SSDEEP 49152:BZc6uYcgKzr7PNA55raPO4QCQId7l+OX381lPXgE:rwZr7SDraPBQbId7R38P
TLSH
T121A5235E76E0C1E6E0B687758FF395D7A9357C519F39A2CF3640AEC95E228C89132302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KoalaTrack.lnk	AutoIt3.exe

Executes dropped EXE 2 IoCs

pid	Process
2064	AutoIt3.exe
1076	AutoIt3.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2064 set thread context of 1076	2064	AutoIt3.exe	104

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2064	AutoIt3.exe
2064	AutoIt3.exe
2064	AutoIt3.exe
2064	AutoIt3.exe
2064	AutoIt3.exe
2064	AutoIt3.exe
2064	AutoIt3.exe
2064	AutoIt3.exe
2064	AutoIt3.exe
2064	AutoIt3.exe
2064	AutoIt3.exe
2064	AutoIt3.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2064	AutoIt3.exe
2064	AutoIt3.exe
2064	AutoIt3.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2064	AutoIt3.exe
2064	AutoIt3.exe
2064	AutoIt3.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 1600	4992	file.exe	89
PID 4992 wrote to memory of 2064	4992	file.exe	91
PID 2064 wrote to memory of 1076	2064	AutoIt3.exe	104
PID 2064 wrote to memory of 1076	2064	AutoIt3.exe	104
PID 2064 wrote to memory of 1076	2064	AutoIt3.exe	104

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\SYSTEM32\at.exe
  at.exe /mcnv023874jkadl
  2⤵
  PID:1600
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Room.a3x
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    PID:1076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
Size 1.1MB
SHA256 5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7
MD5 80cdd5f19d704a001589976bae277bab
SHA1 96bb030389ac938c5ebc6bd2e9fcc86a10e5f2fd
SHA512 03fbfd02d348c2b54af3eeb022ae2f1be4e4f9b30352ceb2c7589233275a914ec4fd81ff8c1544bebf96a87e28c75fd81811e658f092536367395048a82bf8fa
SSDEEP 24576:HsTBc4JYoji1a2gOI6fQJ77jkD1KV3wKct4frNFOB:MTC4a4p+E72SwRcrK
TLSH
T1DA356C0673A4419EFEA7F1329607C60BD6B17C4A07779A6F02646B626F337711A2E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Room.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Room.a3x
Size 1.4MB
SHA256 73cdc39406a821a41c9bc17a854074cf25155bf2b12e4a4e00fd2353acc18341
MD5 3dc1c6ee62c3a101b2c709bdc4aca23d
SHA1 22b8e62ee316489279335ff39d30dd167e40f7ef
SHA512 6c9f4de563fe0652c8257295912055ce86854ef4e74115b91e2962a223c6e6b873b581d924cfc90ade01becf37fbc62231f8e0ecc7c3796ffa8ed36f7649e364
SSDEEP 24576:oU5nZwTspcwyK+rPFNzojyhCbbN2IOOXnjG390WaTANm7e+Q1RTcKF9D:ZxKApcBK+rPFNcj4E2IOIGt0Rt7e+YD
TLSH
T1AF65337CF415D3AA7056842E8F96ACDBA53B1670EA93B1CAFD95AFC1D84CC4D4242360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1076-15-0x0000000140000000-0x000000014003B000-memory.dmp

Download

memory/1076-16-0x0000000140000000-0x000000014003B000-memory.dmp

Download

memory/1076-19-0x0000000140000000-0x000000014003B000-memory.dmp

Download

memory/1076-18-0x0000000140000000-0x000000014003B000-memory.dmp

Download

memory/1076-20-0x0000000140000000-0x000000014003B000-memory.dmp

Download

memory/1076-21-0x0000000140000000-0x000000014003B000-memory.dmp

Download

memory/2064-7-0x00007FFA9AB70000-0x00007FFA9AD65000-memory.dmp

Download

memory/2064-14-0x0000017F733D0000-0x0000017F733D1000-memory.dmp

Download