Analysis
- max time kernel
152s - max time network
110s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
28/09/2026, 18:47
General
- Target StrataWX_Setup_SkyBound.exe
- Size 184.5MB
- Sample260928-xfd7rastes
- SHA256 a998cc60a763c25f662454133c76d6ab93b6578a526df0720e99f33fcef7ce8f
Malware Config
Signatures
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 12 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\StrataWX_Setup_SkyBound.exe"C:\Users\Admin\AppData\Local\Temp\StrataWX_Setup_SkyBound.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nsw2A8D.tmp\StrataWX Setup.exe"C:\Users\Admin\AppData\Local\Temp\nsw2A8D.tmp\StrataWX Setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nsw2A8D.tmp\StrataWX Setup.exe"C:\Users\Admin\AppData\Local\Temp\nsw2A8D.tmp\StrataWX Setup.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\@stratawx/installer" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2060,i,4665371622184360238,9868178596615977023,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\nsw2A8D.tmp\StrataWX Setup.exe"C:\Users\Admin\AppData\Local\Temp\nsw2A8D.tmp\StrataWX Setup.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\@stratawx/installer" --field-trial-handle=2768,i,4665371622184360238,9868178596615977023,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:113⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Users\Admin\AppData\Local\Temp\nsw2A8D.tmp\StrataWX Setup.exe"C:\Users\Admin\AppData\Local\Temp\nsw2A8D.tmp\StrataWX Setup.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\@stratawx/installer" --app-path="C:\Users\Admin\AppData\Local\Temp\nsw2A8D.tmp\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2828,i,4665371622184360238,9868178596615977023,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "(Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\StrataWx' -ErrorAction SilentlyContinue).InstallLocation"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='SilentlyContinue' $found=$false $paths=@( 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKCU:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' ) foreach ($p in $paths) { try { foreach ($it in (Get-ItemProperty $p -ErrorAction SilentlyContinue)) { if (\"$($it.DisplayName)\" -match 'Active\s*Sky') { $found=$true; break } } } catch {} if ($found) { break } } if (-not $found) { foreach ($base in @($env:ProgramFiles, ${env:ProgramFiles(x86)})) { if ($base -and (Test-Path $base)) { if (Get-ChildItem -Path $base -Directory -ErrorAction SilentlyContinue | Where-Object { $_.Name -like 'Active Sky*' -or $_.Name -like 'ActiveSky*' }) { $found=$true; break } } } } if ($found) { 'true' } else { 'false' }"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\nsw2A8D.tmp\StrataWX Setup.exe"C:\Users\Admin\AppData\Local\Temp\nsw2A8D.tmp\StrataWX Setup.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\@stratawx/installer" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2988,i,4665371622184360238,9868178596615977023,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:103⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
D3DCompiler_47.dll
chrome_100_percent.pak
chrome_200_percent.pak
ffmpeg.dll
icudtl.dat
libegl.dll
libglesv2.dll
en-US.pak
nsis7z.dll
resources.pak
app.asar
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
data_0
data_1
data_2
data_3
default.exc
memory/948-206-0x00007FFDEE440000-0x00007FFDEE441000-memory.dmp
memory/948-205-0x00007FFDEFC50000-0x00007FFDEFC51000-memory.dmp
memory/948-284-0x000001AC8FA10000-0x000001AC90106000-memory.dmp
memory/2124-312-0x000001B0C7730000-0x000001B0C7731000-memory.dmp
memory/2124-303-0x000001B0C7730000-0x000001B0C7731000-memory.dmp
memory/2124-301-0x000001B0C7730000-0x000001B0C7731000-memory.dmp
memory/2124-311-0x000001B0C7730000-0x000001B0C7731000-memory.dmp
memory/2124-310-0x000001B0C7730000-0x000001B0C7731000-memory.dmp
memory/2124-309-0x000001B0C7730000-0x000001B0C7731000-memory.dmp
memory/2124-308-0x000001B0C7730000-0x000001B0C7731000-memory.dmp
memory/2124-307-0x000001B0C7730000-0x000001B0C7731000-memory.dmp
memory/3684-279-0x000002191FA30000-0x000002191FB5F000-memory.dmp
memory/5736-274-0x00000227749B0000-0x0000022774ADF000-memory.dmp
memory/5736-272-0x0000022774830000-0x0000022774852000-memory.dmp