Analysis
- user interaction
yes - max time kernel
178s - max time network
263s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
- submitted
03/10/2026, 15:25
General
- Target UnlockToolPro 18.12.2025.exe
- Size 164.1MB
- Sample261003-styq4atset
- SHA256 c9e31542663da41bea0255edd0b82ee0e64610131a24e2c8bb5d9e70c633abdb
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Costura .NET executable packer 1 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\UnlockToolPro 18.12.2025.exe"C:\Users\Admin\AppData\Local\Temp\UnlockToolPro 18.12.2025.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\UnlockToolPro\Excluded.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\UnlockToolPro\'"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\UnlockToolPro\UnlockToolPRO.exe"C:\UnlockToolPro\UnlockToolPRO.exe"2⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unlocktoolpro\Unlock-Tool-Pro-Update.exe"C:\Users\Admin\AppData\Local\Temp\unlocktoolpro\Unlock-Tool-Pro-Update.exe"3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Replay Monitor
Loading Replay Monitor...
Downloads
Excluded.bat
Uninstall.exe
UnlockToolPRO.exe.config
config.ini
090.img
120.img
900.img
ca-bundle.crt
ct_log_list.cnf.dist
info.exe
tsget.pl
openssl.cnf.dist
libusb0.dll
Mi3.jpg
libusb0.dll
libusbK.dll
frp.img
filter-x64.exe
0001.tmp
0002.tmp
0003.tmp
0004.tmp
0005.tmp
0006.tmp
0007.tmp
0008.tmp
0009.tmp
0010.tmp
0011.tmp
0012.tmp
0013.tmp
0020.tmp
__PSScriptPolicyTest_3nlgn1ay.pkb.ps1
Unlock-Tool-Pro-Update.exe
memory/2448-1333-0x0000000009170000-0x0000000009716000-memory.dmp
memory/2448-1346-0x0000000011C70000-0x000000001246A000-memory.dmp
memory/2448-1375-0x000000000F530000-0x000000000F55C000-memory.dmp
memory/2448-1374-0x0000000018BB0000-0x0000000018C5A000-memory.dmp
memory/2448-1373-0x00000000170F0000-0x0000000017447000-memory.dmp
memory/2448-1372-0x0000000008520000-0x0000000008540000-memory.dmp
memory/2448-1371-0x0000000012870000-0x0000000012F2C000-memory.dmp
memory/2448-1349-0x0000000011260000-0x0000000011298000-memory.dmp
memory/2448-1309-0x00000000004C0000-0x0000000003D10000-memory.dmp
memory/2448-1345-0x000000000E740000-0x000000000EC6C000-memory.dmp
memory/2448-1344-0x000000000B120000-0x000000000B23A000-memory.dmp
memory/2448-1312-0x00000000043B0000-0x00000000043C0000-memory.dmp
memory/2448-1313-0x0000000006090000-0x00000000060B8000-memory.dmp
memory/2448-1343-0x000000000C720000-0x000000000C822000-memory.dmp
memory/2448-1342-0x00000000206F0000-0x0000000021C86000-memory.dmp
memory/2448-1341-0x00000000043B0000-0x00000000043C0000-memory.dmp
memory/2448-1340-0x000000000C120000-0x000000000C698000-memory.dmp
memory/2448-1339-0x0000000013120000-0x00000000144B8000-memory.dmp
memory/2448-1338-0x0000000009030000-0x0000000009086000-memory.dmp
memory/2448-1337-0x0000000008F90000-0x0000000008F9A000-memory.dmp
memory/2448-1334-0x0000000008D60000-0x0000000008DF2000-memory.dmp
memory/2448-1331-0x00000000281C0000-0x000000002B160000-memory.dmp
memory/2448-1332-0x0000000008B20000-0x0000000008BBC000-memory.dmp
memory/2916-1310-0x0000000004A50000-0x0000000004A6E000-memory.dmp
memory/2916-1296-0x0000000004720000-0x0000000004756000-memory.dmp
memory/2916-1329-0x0000000007120000-0x000000000712A000-memory.dmp
memory/2916-1327-0x0000000007700000-0x0000000007D7A000-memory.dmp
memory/2916-1328-0x00000000070C0000-0x00000000070DA000-memory.dmp
memory/2916-1326-0x0000000006F80000-0x0000000007023000-memory.dmp
memory/2916-1325-0x0000000006F60000-0x0000000006F7E000-memory.dmp
memory/2916-1316-0x0000000006370000-0x00000000063A2000-memory.dmp
memory/2916-1317-0x0000000070940000-0x000000007098C000-memory.dmp
memory/2916-1308-0x0000000005870000-0x0000000005BC7000-memory.dmp
memory/2916-1330-0x0000000007330000-0x00000000073C6000-memory.dmp
memory/2916-1297-0x0000000004E30000-0x00000000054FA000-memory.dmp
memory/2916-1311-0x0000000005DF0000-0x0000000005E3C000-memory.dmp
memory/2916-1298-0x0000000005500000-0x0000000005522000-memory.dmp
memory/2916-1299-0x0000000005690000-0x00000000056F6000-memory.dmp
memory/2916-1300-0x0000000005700000-0x0000000005766000-memory.dmp
memory/2916-1295-0x00000000026F0000-0x0000000002700000-memory.dmp
memory/3584-1370-0x0000000140000000-0x000000014003E000-memory.dmp
memory/3584-1369-0x0000000140000000-0x000000014003E000-memory.dmp
memory/4148-1273-0x0000000000400000-0x000000000046B000-memory.dmp
memory/4148-1292-0x0000000000400000-0x000000000046B000-memory.dmp
memory/4148-0-0x000000000042B000-0x000000000042C000-memory.dmp