Analysis
- max time kernel
300s - max time network
295s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/10/2026, 01:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Z#2743130870.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
300 seconds
Behavioral task
behavioral2
Sample
Z#2743130870.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
300 seconds
Behavioral task
behavioral3
Sample
certpick.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
300 seconds
Behavioral task
behavioral4
Sample
rimE.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral5
Sample
rimE.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
300 seconds
General
- Target Z#2743130870.exe
- Size 1.9MB
- Sample261011-cble2styb1
- SHA256 c74f55247aa2c72001024bd977c869cb5adce6f8604a4d32329f015b73ae2a49
- MD5 711cd47d4524145f9c488afecc85ebc7
- SHA1 2f9e5368c039db49018ec41bbb20a3b085788b24
- SHA512 8bf03abb818d6d11f210e17a7e8c8f3c941774390cf0c5e679cb18331089341d43486cdc7af1203b29eac476f2f802f789f17ec6926d17fdd099d13172a79a15
- SSDEEP 24576:DitHbptR5UngkbfXXqO7jiugTdtHxVAuN9AGFwzojqnIXxXi2+QV8epwMGqtc:WtR5UngkzvyPtHxWzojqnIXtl+NeBGqq
- TLSH T105953A203942C13EEA9113718D78EAFA565DAD102F35D1CF63987A6A3B78DC31933627
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4996 mksSandbox-debug.exe - Loads dropped DLL 2 IoCs
pid Process 4996 mksSandbox-debug.exe 1260 rundll32.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3624 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname mksSandbox-debug.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain mksSandbox-debug.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Z#2743130870.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mksSandbox-debug.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe 4996 mksSandbox-debug.exe - Suspicious behavior: LoadsDriver 64 IoCs
pid Process 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4996 mksSandbox-debug.exe Token: SeLoadDriverPrivilege 4996 mksSandbox-debug.exe Token: SeTakeOwnershipPrivilege 4996 mksSandbox-debug.exe Token: SeIncBasePriorityPrivilege 4996 mksSandbox-debug.exe Token: SeTcbPrivilege 4996 mksSandbox-debug.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2880 wrote to memory of 4996 2880 Z#2743130870.exe 89 PID 4996 wrote to memory of 3624 4996 mksSandbox-debug.exe 92 PID 3624 wrote to memory of 1260 3624 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\Z#2743130870.exe"C:\Users\Admin\AppData\Local\Temp\Z#2743130870.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\ProgramData\f]&]@&^+=`{b\mksSandbox-debug.exe"C:\ProgramData\f]&]@&^+=`{b\mksSandbox-debug.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start "" "C:\Windows\SysWOW64\rundll32.exe" "C:\ProgramData\f]&]@&^+=`{b\RIME.dll",_vmclientcore@16 "C:\ProgramData\f]&]@&^+=`{b\mksSandbox-debug.exe"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\ProgramData\f]&]@&^+=`{b\RIME.dll",_vmclientcore@16 "C:\ProgramData\f]&]@&^+=`{b\mksSandbox-debug.exe"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1260
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\f]&]@&^+=`{b\mksSandbox-debug.exe
- Size 1.9MB
- SHA256 c74f55247aa2c72001024bd977c869cb5adce6f8604a4d32329f015b73ae2a49
- MD5 711cd47d4524145f9c488afecc85ebc7
- SHA1 2f9e5368c039db49018ec41bbb20a3b085788b24
- SHA512 8bf03abb818d6d11f210e17a7e8c8f3c941774390cf0c5e679cb18331089341d43486cdc7af1203b29eac476f2f802f789f17ec6926d17fdd099d13172a79a15
- SSDEEP 24576:DitHbptR5UngkbfXXqO7jiugTdtHxVAuN9AGFwzojqnIXxXi2+QV8epwMGqtc:WtR5UngkzvyPtHxWzojqnIXtl+NeBGqq
- TLSH T105953A203942C13EEA9113718D78EAFA565DAD102F35D1CF63987A6A3B78DC31933627
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\f]&]@&^+=`{b\rImE.DLL
- Size 3.4MB
- SHA256 4c939547cdfa87e7d732c55ade2cf98e9eedd7559d18a65c150c2f6e3685aa58
- MD5 960846b9ea93b14bde8cdcfcb492140b
- SHA1 941f455e95eca78ec56fc09815dc8db919e18a5f
- SHA512 14a6fd284794961dd93443d473677aad1db4c9a080806c962cda5dec8165fbf74633a8ed736a80e5eaca001215097c3f3b7016a70f12ae7072355ed649a77f56
- SSDEEP 98304:CWCPEp3NBOMoNxY9J4SwEi8qmlNOZxOs3gz5da2aUydgHG:O5QCv8qmlNOPtgzzcG
- TLSH T1A3F5E12379D4807AC26F02704E6F776D72FDA5704D3545AB36C86E2C6DB08A2763C6A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\8%%%!'=[)^[1\3@{%$}`@.521
- Size 16KB
- SHA256 4d07b6423f4d5d80d2daec8faed7ecc40855339bee95c26289179c1fd083078e
- MD5 a21bc9c04bd840d655bfcd274cc84e40
- SHA1 da57a16315d9e9c7bd426cc69bbb0427874b52d7
- SHA512 8f66e04fe5820551aeb0059d313009a4e479dad9702ab1c658747fbf44a6070848e98a845e74b154fc41b8633e3b3af2b42ba51a16af1d1a696b87908b346091
- SSDEEP 192:wvuYacCCpQIw9l0H7os0GxxuSnYe+PjP8srcQqwBjtlA1U18U:cuoCCpQIY0H7os08uSnYPL1tqOU1UR
- TLSH T111724B8A4729709AFAD7CE75C2B6826BEC31FAD0B75605FF0159C1911D82FE05B3E209
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\8%%%!'=[)^[1\3@{%$}`@.521.mds
- Size 16KB
- SHA256 2870bda9e07108ce4635dfad11c70d181626d348b68827cd984202af49410928
- MD5 52b2975c9bced7634146ffc94d5ea49f
- SHA1 d3c57efa566057d56f50f35341338408f033e009
- SHA512 b6c92d33283317cef145b4cb65cf210ea6a55dda9d932dd2a8065af1aa58d9c86c6dec14bdffd8c69ffd0b6ac14ac24f2a4d37e11e2ca8bd5ea0dbd9b75a174a
- SSDEEP 384:8OhQ6kti/UYTqSVakfb8e2zgieVy51l3wW0uJrxWlEqx2GR+jK:BhQg7+cHzxSgbVGlgMqEGR+2
- TLSH T1B272D07753AE0D65A6082EA739A123D27C454F2D79834213C4CFCCD56A3A9DCF9B911C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\8%%%!'=[)^[1\6@]={&^}.971
- Size 91KB
- SHA256 46883bc25c77678f60c1b836f4c438d87158c9af6b229f533522f635a0d5276e
- MD5 d751a1ebc49ecd3ce75ef683878057db
- SHA1 8887fc3afcdf48721312d8df9865c6c8234b8614
- SHA512 f0565d8b7c92877327bc8939cf09d21010dbb0498200f358f7d060ae70839a2349a0a2bc6d080be531400b47529d5e7fe0e7a425929096e22c77760f8a498e4d
- SSDEEP 1536:AtFSIfIlTfynQGkaeEa69TXdZSip9M+PccXX6G+2+z2q:pIfIlT6QGK69TrDDMSzX+2+2q
- TLSH T1CF935B83D35615C6D6AACAB9C1AA9223EF71BC09172553CF4E60B6501F32FE19F39306
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\8%%%!'=[)^[1\6@]={&^}.971.mds
- Size 91KB
- SHA256 a5050a2546862adecbf5abeecadeaa2623a5e57fee0f82dd6e07a04f5d27d46e
- MD5 52ae6cfdee0229d293ea21d836c31505
- SHA1 dcb131d6bc77ea2c5ced00b39754fe81a6049a63
- SHA512 8c75b19329bcfe3036f851fa9642b28e541c13993521ae57b7c297761e74823872c5fc14791a40b0f1614ddfe6a3c739db246101859bf1a5d850b91e09faff6f
- SSDEEP 1536:UGiblyZ2+DRhRr6493pZtP9863lM8O1Pe2ZtMsUvDTSMjvXowm4XMXHM35DuQxJ6:UGMQ2+849Z7988l/OETBv/jLm5XnEoCE
- TLSH T1C7931241FA6052B891E938A6A78108D27C7EF32CA51F3CEC9DCD5C5C841ED4CE5E4AE5
- MD5 SHA1 SHA512 SSDEEP TLSH