Analysis
- user interaction
yes - max time kernel
54s - max time network
32s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 03:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Cellik 4.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target Cellik 4.exe
- Size 28.2MB
- Sample261002-dprdwstsct
- SHA256 476d7fefbc5f078494d77bd393df9a97b4268faaf4908156d85c0155f8a1e00c
- MD5 42c0c78a69c68b16cffefde618c0eaaf
- SHA1 1997f44ba749fc341a49187a7b738f572c5e582d
- SHA512 dec21f5297389d8cf60105e3a65a9ad0ad2f654c4d05218c0381fa2c39c5780795e556068c5d68d707150f4f9b03bd5e5834f3129f65b42f5b47af1a455cb53c
- SSDEEP 786432:flwQIYoeQ7MYeOUsZ9Ia4RZhsN+X8Q9toyK7PeAqIp9:NwQrmeOUsZ2hKQp9297PeDIb
- TLSH T1265723066103523ADC4E2679A40DF36006165E8AB2BFCDC8E6547F5BD394DCCBED3AA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects BTMOB RAT 3 IoCs
resource yara_rule behavioral1/memory/2348-2-0x0000000000D10000-0x0000000002C12000-memory.dmp family_btmob_win behavioral1/memory/2348-3-0x0000000000D10000-0x0000000002C12000-memory.dmp family_btmob_win behavioral1/memory/2348-12-0x0000000000D10000-0x0000000002C12000-memory.dmp family_btmob_win - Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs
pid Process 2348 Cellik 4.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cellik 4.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 912 taskmgr.exe Token: SeSystemProfilePrivilege 912 taskmgr.exe Token: SeCreateGlobalPrivilege 912 taskmgr.exe Token: 33 912 taskmgr.exe Token: SeIncBasePriorityPrivilege 912 taskmgr.exe - Suspicious use of FindShellTrayWindow 63 IoCs
pid Process 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe - Suspicious use of SendNotifyMessage 63 IoCs
pid Process 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe 912 taskmgr.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2348 Cellik 4.exe 912 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cellik 4.exe"C:\Users\Admin\AppData\Local\Temp\Cellik 4.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2348
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:912
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5236