Analysis
- max time kernel
300s - max time network
301s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
01/10/2026, 06:52
General
- Target 0903087850142.exe
- Size 451KB
- Sample261001-hm96fada46
- SHA256 5ef3fe4a5e70d3750a11c73902e35b50b9ac007e8a95dde0569bf6bae17da73a
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
- Sets service image path in registry 3 TTPs 3 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 2 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0903087850142.exe"C:\Users\Admin\AppData\Local\Temp\0903087850142.exe"1⤵
- Sets service image path in registry
- Adds Run key to start application
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\cache.exeC:\Users\Public\cache.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Public\svchostsr.exe"C:\\Users\\Public\\svchostsr.exe"1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\drivers\kvckiller.sysC:\Windows\System32\drivers\kvckiller.sys1⤵
- Executes dropped EXE
-
C:\Users\Public\svchostsr.exeC:\Users\Public\svchostsr.exe1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
EmbeddedDriverService.sys
S2
cache.exe
mfc140u.dll
svchostsr.exe
wct999B.tmp
kvckiller.sys
memory/3104-676-0x0000000004910000-0x0000000004975000-memory.dmp
memory/3104-292-0x0000000003780000-0x00000000037E5000-memory.dmp
memory/3104-816-0x00000000033C0000-0x0000000003425000-memory.dmp
memory/3104-768-0x0000000003460000-0x00000000034C5000-memory.dmp
memory/3104-769-0x0000000004AE0000-0x0000000004B45000-memory.dmp
memory/3104-720-0x0000000004870000-0x00000000048D5000-memory.dmp
memory/3104-721-0x0000000004AE0000-0x0000000004B45000-memory.dmp
memory/3104-240-0x0000000003780000-0x00000000037E5000-memory.dmp
memory/3104-672-0x0000000004870000-0x00000000048D5000-memory.dmp
memory/3104-628-0x00000000040B0000-0x0000000004115000-memory.dmp
memory/3104-610-0x0000000004910000-0x0000000004975000-memory.dmp
memory/3104-580-0x0000000003F40000-0x0000000003FA5000-memory.dmp
memory/3104-576-0x00000000040B0000-0x0000000004115000-memory.dmp
memory/3104-532-0x0000000003FE0000-0x0000000004045000-memory.dmp
memory/3104-528-0x0000000003F40000-0x0000000003FA5000-memory.dmp
memory/3104-484-0x0000000003E10000-0x0000000003E75000-memory.dmp
memory/3104-480-0x0000000003FE0000-0x0000000004045000-memory.dmp
memory/3104-436-0x0000000003850000-0x00000000038B5000-memory.dmp
memory/3104-432-0x0000000003E10000-0x0000000003E75000-memory.dmp
memory/3104-388-0x0000000003CA0000-0x0000000003D05000-memory.dmp
memory/3104-384-0x0000000003850000-0x00000000038B5000-memory.dmp
memory/3104-340-0x0000000003C30000-0x0000000003C95000-memory.dmp
memory/3104-864-0x0000000004A40000-0x0000000004AA5000-memory.dmp
memory/3104-336-0x0000000003CA0000-0x0000000003D05000-memory.dmp
memory/3104-868-0x00000000033C0000-0x0000000003425000-memory.dmp
memory/3104-820-0x0000000003460000-0x00000000034C5000-memory.dmp
memory/3104-288-0x0000000003C30000-0x0000000003C95000-memory.dmp
memory/3104-227-0x0000000003780000-0x00000000037E5000-memory.dmp
memory/3104-229-0x0000000003780000-0x00000000037E5000-memory.dmp
memory/3104-231-0x0000000003780000-0x00000000037E5000-memory.dmp
memory/3104-913-0x0000000004BB0000-0x0000000004C15000-memory.dmp
memory/3104-232-0x0000000003780000-0x00000000037E5000-memory.dmp
memory/3104-233-0x0000000003780000-0x00000000037E5000-memory.dmp
memory/3104-234-0x0000000003780000-0x00000000037E5000-memory.dmp
memory/3104-235-0x0000000003780000-0x00000000037E5000-memory.dmp
memory/3104-912-0x0000000004A40000-0x0000000004AA5000-memory.dmp
memory/3104-960-0x0000000004ED0000-0x0000000004F35000-memory.dmp
memory/3104-236-0x0000000003780000-0x00000000037E5000-memory.dmp
memory/3104-964-0x0000000004BB0000-0x0000000004C15000-memory.dmp
memory/3104-1029-0x0000000004ED0000-0x0000000004F35000-memory.dmp
memory/3104-220-0x0000000002D50000-0x0000000002D72000-memory.dmp
memory/3104-221-0x0000000002D50000-0x0000000002D72000-memory.dmp
memory/3104-238-0x0000000003780000-0x00000000037E5000-memory.dmp
memory/3104-239-0x0000000003780000-0x00000000037E5000-memory.dmp
memory/3104-225-0x0000000002D50000-0x0000000002D72000-memory.dmp
memory/3104-224-0x0000000002D50000-0x0000000002D72000-memory.dmp
memory/3104-226-0x0000000002D50000-0x0000000002D72000-memory.dmp
memory/3104-230-0x0000000003780000-0x00000000037E5000-memory.dmp
memory/3104-237-0x0000000003780000-0x00000000037E5000-memory.dmp
memory/3104-241-0x0000000003780000-0x00000000037E5000-memory.dmp
memory/4252-245-0x0000000002780000-0x00000000027A2000-memory.dmp
memory/4252-502-0x0000000003690000-0x00000000036F5000-memory.dmp
memory/4252-222-0x0000000002780000-0x00000000027A2000-memory.dmp
memory/4252-1054-0x00000000046F0000-0x0000000004755000-memory.dmp
memory/4252-982-0x0000000004790000-0x00000000047F5000-memory.dmp
memory/4252-980-0x00000000046F0000-0x0000000004755000-memory.dmp
memory/4252-934-0x0000000004540000-0x00000000045A5000-memory.dmp
memory/4252-932-0x0000000004790000-0x00000000047F5000-memory.dmp
memory/4252-886-0x0000000004370000-0x00000000043D5000-memory.dmp
memory/4252-884-0x0000000004540000-0x00000000045A5000-memory.dmp
memory/4252-838-0x0000000002E50000-0x0000000002EB5000-memory.dmp
memory/4252-243-0x0000000002780000-0x00000000027A2000-memory.dmp
memory/4252-244-0x0000000002780000-0x00000000027A2000-memory.dmp
memory/4252-836-0x0000000004370000-0x00000000043D5000-memory.dmp
memory/4252-250-0x0000000003180000-0x00000000031E5000-memory.dmp
memory/4252-260-0x0000000003180000-0x00000000031E5000-memory.dmp
memory/4252-252-0x0000000003180000-0x00000000031E5000-memory.dmp
memory/4252-251-0x0000000003180000-0x00000000031E5000-memory.dmp
memory/4252-249-0x0000000003180000-0x00000000031E5000-memory.dmp
memory/4252-248-0x0000000003180000-0x00000000031E5000-memory.dmp
memory/4252-247-0x0000000003180000-0x00000000031E5000-memory.dmp
memory/4252-246-0x0000000003180000-0x00000000031E5000-memory.dmp
memory/4252-272-0x0000000002780000-0x00000000027A2000-memory.dmp
memory/4252-790-0x0000000004620000-0x0000000004685000-memory.dmp
memory/4252-788-0x0000000002E50000-0x0000000002EB5000-memory.dmp
memory/4252-741-0x0000000004620000-0x0000000004685000-memory.dmp
memory/4252-308-0x00000000030F0000-0x0000000003155000-memory.dmp
memory/4252-310-0x0000000003180000-0x00000000031E5000-memory.dmp
memory/4252-740-0x0000000004410000-0x0000000004475000-memory.dmp
memory/4252-694-0x0000000003AD0000-0x0000000003B35000-memory.dmp
memory/4252-356-0x0000000003250000-0x00000000032B5000-memory.dmp
memory/4252-358-0x00000000030F0000-0x0000000003155000-memory.dmp
memory/4252-692-0x0000000004410000-0x0000000004475000-memory.dmp
memory/4252-646-0x00000000042A0000-0x0000000004305000-memory.dmp
memory/4252-404-0x0000000003730000-0x0000000003795000-memory.dmp
memory/4252-406-0x0000000003250000-0x00000000032B5000-memory.dmp
memory/4252-644-0x0000000003AD0000-0x0000000003B35000-memory.dmp
memory/4252-598-0x0000000004230000-0x0000000004295000-memory.dmp
memory/4252-452-0x0000000003690000-0x00000000036F5000-memory.dmp
memory/4252-454-0x0000000003730000-0x0000000003795000-memory.dmp
memory/4252-596-0x00000000042A0000-0x0000000004305000-memory.dmp
memory/4252-550-0x0000000003A00000-0x0000000003A65000-memory.dmp
memory/4252-500-0x0000000003A00000-0x0000000003A65000-memory.dmp
memory/4252-223-0x0000000002780000-0x00000000027A2000-memory.dmp
memory/4252-548-0x0000000004230000-0x0000000004295000-memory.dmp
memory/4780-18-0x0000000003A30000-0x0000000003A95000-memory.dmp
memory/4780-48-0x0000000010000000-0x000000001001C000-memory.dmp
memory/4780-6-0x0000000002F40000-0x0000000002F62000-memory.dmp
memory/4780-9-0x0000000003A30000-0x0000000003A95000-memory.dmp
memory/4780-10-0x0000000003A30000-0x0000000003A95000-memory.dmp
memory/4780-24-0x0000000003A30000-0x0000000003A95000-memory.dmp
memory/4780-26-0x0000000003A30000-0x0000000003A95000-memory.dmp
memory/4780-11-0x0000000003A30000-0x0000000003A95000-memory.dmp
memory/4780-12-0x0000000003A30000-0x0000000003A95000-memory.dmp
memory/4780-27-0x0000000002F40000-0x0000000002F62000-memory.dmp
memory/4780-28-0x0000000002F40000-0x0000000002F62000-memory.dmp
memory/4780-13-0x0000000003A30000-0x0000000003A95000-memory.dmp
memory/4780-14-0x0000000003A30000-0x0000000003A95000-memory.dmp
memory/4780-29-0x0000000003A30000-0x0000000003A95000-memory.dmp
memory/4780-30-0x0000000010000000-0x0000000010071000-memory.dmp
memory/4780-15-0x0000000003A30000-0x0000000003A95000-memory.dmp
memory/4780-16-0x0000000003A30000-0x0000000003A95000-memory.dmp
memory/4780-45-0x0000000003A30000-0x0000000003A95000-memory.dmp
memory/4780-47-0x0000000003A30000-0x0000000003A95000-memory.dmp
memory/4780-17-0x0000000003A30000-0x0000000003A95000-memory.dmp
memory/4780-7-0x0000000003890000-0x00000000038F0000-memory.dmp
memory/4780-57-0x0000000003A30000-0x0000000003A95000-memory.dmp
memory/4780-8-0x0000000003A30000-0x0000000003A95000-memory.dmp
memory/4780-19-0x0000000003A30000-0x0000000003A95000-memory.dmp
memory/4780-20-0x0000000003A30000-0x0000000003A95000-memory.dmp
memory/4780-0-0x0000000002D00000-0x0000000002D01000-memory.dmp
memory/4780-60-0x0000000010000000-0x0000000010062000-memory.dmp
memory/4780-21-0x0000000003A30000-0x0000000003A95000-memory.dmp
memory/4780-22-0x0000000003A30000-0x0000000003A95000-memory.dmp
memory/4780-59-0x0000000003A30000-0x0000000003A95000-memory.dmp
memory/4780-161-0x0000000003A30000-0x0000000003A95000-memory.dmp
memory/4780-4-0x0000000002F40000-0x0000000002F62000-memory.dmp
memory/4780-5-0x0000000002F40000-0x0000000002F62000-memory.dmp
memory/4780-193-0x00000000035E0000-0x00000000035FC000-memory.dmp
memory/4780-201-0x0000000003A30000-0x0000000003A95000-memory.dmp
memory/4780-3-0x0000000002F40000-0x0000000002F62000-memory.dmp
memory/4780-2-0x0000000002F40000-0x0000000002F62000-memory.dmp
memory/4780-192-0x0000000003A30000-0x0000000003A95000-memory.dmp
memory/4780-173-0x0000000003A30000-0x0000000003A95000-memory.dmp
memory/4780-1-0x0000000002EB0000-0x0000000002F31000-memory.dmp
memory/4780-216-0x0000000003A30000-0x0000000003A95000-memory.dmp