Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/10/2026, 05:45
General
- Target KL.exe
- Size 58KB
- Sample261002-gfxfbsstbs
- SHA256 f51ecc147223a00881b9e32bf8eb8fc11599769ee4ea6c9778472cb4bc112612
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\KL.exe"C:\Users\Admin\AppData\Local\Temp\KL.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\pm9igds6lg\X64Helper.exe"C:\Users\Admin\AppData\Roaming\pm9igds6lg\X64Helper.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "7e7qipf5robn" /tr "C:\Users\Admin\AppData\Roaming\pm9igds6lg\X64Helper.exe" /sc onlogon /rl highest /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Roaming\pm9igds6lg\X64Helper.exeC:\Users\Admin\AppData\Roaming\pm9igds6lg\X64Helper.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
QQLiveBase.dll
X64Helper.exe
csy3n1.dat
memory/1072-38-0x0000000180000000-0x0000000180035000-memory.dmp
memory/1072-70-0x0000000180000000-0x0000000180035000-memory.dmp
memory/1072-13-0x000001DD1B840000-0x000001DD1B870000-memory.dmp
memory/1072-15-0x0000000180000000-0x0000000180035000-memory.dmp
memory/1072-26-0x0000000180000000-0x0000000180035000-memory.dmp
memory/1072-27-0x0000000180000000-0x0000000180035000-memory.dmp
memory/1072-39-0x0000000180000000-0x0000000180035000-memory.dmp
memory/1072-87-0x00007FFB95110000-0x00007FFB9511F000-memory.dmp
memory/1072-53-0x0000000180000000-0x0000000180035000-memory.dmp
memory/1072-10-0x000001DD1A030000-0x000001DD1A033000-memory.dmp
memory/1072-82-0x0000000180000000-0x0000000180035000-memory.dmp
memory/1072-29-0x0000000180000000-0x0000000180035000-memory.dmp
memory/1072-25-0x0000000180000000-0x0000000180035000-memory.dmp
memory/1072-24-0x0000000180000000-0x0000000180035000-memory.dmp
memory/1072-23-0x0000000180000000-0x0000000180035000-memory.dmp
memory/1072-22-0x0000000180000000-0x0000000180035000-memory.dmp
memory/1072-85-0x0000000180000000-0x0000000180035000-memory.dmp
memory/5100-7-0x00007FF648570000-0x00007FF648586000-memory.dmp
memory/5564-88-0x00007FFB95110000-0x00007FFB9511F000-memory.dmp