f02c012b21fbd9aa636afc247ff6677a6e635845bb36ab4d1e0f1b404af27fa1

Analysis

max time kernel
151s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/10/2026, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Real Executor.exe
Size 111.7MB
Sample261004-3dzcsss12q
SHA256 f02c012b21fbd9aa636afc247ff6677a6e635845bb36ab4d1e0f1b404af27fa1
MD5 1fd7690ad52a07ac52e6406bb52db5ba
SHA1 3a46d0c9383d961a5eef7a94aa7261fd582fe7f2
SHA512 bf974fabfbf47a1c77d975ea8aba961361c338fcb235505f6d53d474bc071ce7207c75166f6625640ee1f7f3361a21af19a0f4a489fc23542657386ab3777974
SSDEEP 1572864:1Pp36F/iKRz3o0EL9uXpXFxAI/MZqNrGZVOc4XIoC3MnluZQrZa:1PpIl3heuXpX/z/5NivOcC7hlTrk
TLSH
T18148F01663E111AAD577D178C7AB6203EB72B40713308BDB329C43652F73AE45E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4592	powershell.exe
4092	powershell.exe
4592	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
760	jMguJK0iS04y.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	jMguJK0iS04y.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4320	cmd.exe
4968	cmd.exe
5000	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4092	powershell.exe
4092	powershell.exe
4592	powershell.exe
4592	powershell.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	4092	powershell.exe
Token: SeDebugPrivilege	4592	powershell.exe
Token: SeIncreaseQuotaPrivilege	4592	powershell.exe
Token: SeSecurityPrivilege	4592	powershell.exe
Token: SeTakeOwnershipPrivilege	4592	powershell.exe
Token: SeLoadDriverPrivilege	4592	powershell.exe
Token: SeSystemProfilePrivilege	4592	powershell.exe
Token: SeSystemtimePrivilege	4592	powershell.exe
Token: SeProfSingleProcessPrivilege	4592	powershell.exe
Token: SeIncBasePriorityPrivilege	4592	powershell.exe
Token: SeCreatePagefilePrivilege	4592	powershell.exe
Token: SeBackupPrivilege	4592	powershell.exe
Token: SeRestorePrivilege	4592	powershell.exe
Token: SeShutdownPrivilege	4592	powershell.exe
Token: SeDebugPrivilege	4592	powershell.exe
Token: SeSystemEnvironmentPrivilege	4592	powershell.exe
Token: SeRemoteShutdownPrivilege	4592	powershell.exe
Token: SeUndockPrivilege	4592	powershell.exe
Token: SeManageVolumePrivilege	4592	powershell.exe
Token: 33	4592	powershell.exe
Token: 34	4592	powershell.exe
Token: 35	4592	powershell.exe
Token: 36	4592	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5884 wrote to memory of 4968	5884	Real Executor.exe	89
PID 4968 wrote to memory of 4092	4968	cmd.exe	91
PID 5884 wrote to memory of 5000	5884	Real Executor.exe	92
PID 5000 wrote to memory of 5124	5000	cmd.exe	94
PID 5124 wrote to memory of 4316	5124	net.exe	95
PID 5884 wrote to memory of 4320	5884	Real Executor.exe	96
PID 4320 wrote to memory of 4592	4320	cmd.exe	98
PID 4592 wrote to memory of 5476	4592	powershell.exe	100
PID 5884 wrote to memory of 760	5884	Real Executor.exe	101

C:\Users\Admin\AppData\Local\Temp\Real Executor.exe
"C:\Users\Admin\AppData\Local\Temp\Real Executor.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -Command [void][System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms'); [System.Windows.Forms.MessageBox]::Show('version 1.0.0','Program','OK','Information')"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command [void][System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms'); [System.Windows.Forms.MessageBox]::Show('version 1.0.0','Program','OK','Information')
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5124
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP,'C:\ProgramData','C:\ProgramData\Windows\Microsoft','C:\ProgramData\Microsoft\Windows'; gpupdate /force""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP,'C:\ProgramData','C:\ProgramData\Windows\Microsoft','C:\ProgramData\Microsoft\Windows'; gpupdate /force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4592
  - - C:\Windows\system32\gpupdate.exe
      "C:\Windows\system32\gpupdate.exe" /force
      4⤵
      PID:5476
- C:\ProgramData\jMguJK0iS04y.exe
  C:\ProgramData\jMguJK0iS04y.exe
  2⤵
  - Executes dropped EXE
  - Checks for VirtualBox DLLs, possible anti-VM trick
  PID:760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jMguJK0iS04y.exe

Path C:\ProgramData\jMguJK0iS04y.exe
Size 669KB
SHA256 6ae18e8c7a22826416f305e7ba5fba5c0eb26fe54fe33f23a740bd4e5fc7801e
MD5 c27149aeeb6f1c222682d87ca147bb67
SHA1 cfc27cd80df4714cce2c84681f48e6aa8b9d6944
SHA512 9e141966e5d8820d0111250007a134236b04984c3aefa547987970b0c69dfa0ff2ea41d01f8190b1273c68b505abe9d0a23c76ae9348f916520f7b9bd5b9bb88
SSDEEP 6144:6BXJJaw9NNfek39BxS2gBAe3OGP4Xk80I1osms7S1kFJEdw+qDZ+c1YYFsxMku5w:6BXdD34AFGQ/SrqDZ+c1YYFMMku5/Q99
TLSH
T1AFE492D1D28B2440ED434938A5CE43DBA7AD3C524856AB3A115B5F883FAC577289FB0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 92671c154d4e886f999580604f675416003965914ab8435babc0b11290f6a6a4
MD5 ccd060f9f366be151fe026216473d89d
SHA1 a2376b4d7e68f0f9b95afe6cb3d0dac53d4d3e67
SHA512 c32c5dc4f4034e964becf33399da8a09c393680520aa9163d4035bc8fa4a15453cf7c7ed1b309785266449f257b7ced4b8dca043917b2c5812b9a25c1da224cd
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_ljnm1o5b.otx.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ljnm1o5b.otx.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4092-9-0x00007FFB2F280000-0x00007FFB2FC24000-memory.dmp

Download

memory/4092-13-0x00007FFB2F280000-0x00007FFB2FC24000-memory.dmp

Download

memory/4092-7-0x00007FFB2F280000-0x00007FFB2FC24000-memory.dmp

Download

memory/4092-8-0x0000015663400000-0x0000015663422000-memory.dmp

Download

memory/4092-10-0x00007FFB2F280000-0x00007FFB2FC24000-memory.dmp

Download

memory/4092-11-0x00007FFB2F280000-0x00007FFB2FC24000-memory.dmp

Download

memory/4092-12-0x00007FFB2F280000-0x00007FFB2FC24000-memory.dmp

Download

memory/4092-1-0x00007FFB2F40F000-0x00007FFB2F410000-memory.dmp

Download

memory/4092-15-0x00007FFB2F280000-0x00007FFB2FC24000-memory.dmp

Download

memory/4092-6-0x00007FFB2F280000-0x00007FFB2FC24000-memory.dmp

Download

memory/4092-3-0x00007FFB2F280000-0x00007FFB2FC24000-memory.dmp

Download

memory/4092-2-0x00007FFB2F280000-0x00007FFB2FC24000-memory.dmp

Download

memory/4592-22-0x000002CCEFBE0000-0x000002CCEFC92000-memory.dmp

Download

memory/4592-23-0x000002CCD7380000-0x000002CCD738A000-memory.dmp

Download

memory/4592-21-0x000002CCEF910000-0x000002CCEF92E000-memory.dmp

Download