Overview

overview

7

Static

static

3

0aecbde8ad...1f.exe

windows10-2004-x64

7

0aecbde8ad...1f.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    11/10/2026, 12:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    0aecbde8ad059bfc7b812255ae469962bf43b34d5c50d0e10b9e4631dca9db1f.exe
  • Size 4.7MB
  • Sample261011-ps5apsat2z
  • SHA256 0aecbde8ad059bfc7b812255ae469962bf43b34d5c50d0e10b9e4631dca9db1f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
bootkitdiscoverypersistencespywarestealerupx

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 21 IoCs
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0aecbde8ad059bfc7b812255ae469962bf43b34d5c50d0e10b9e4631dca9db1f.exe
    "C:\Users\Admin\AppData\Local\Temp\0aecbde8ad059bfc7b812255ae469962bf43b34d5c50d0e10b9e4631dca9db1f.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:2004

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 2a1cb40cda905b5125da2dbaabef90bfa7993c984f62dca722e91adb379fdb19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 f33c246416356a70373eb011a1a011b54c118aff9d8e93d145c234cc93ef4dd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 997KB
        • SHA256 98e83d62df90c585c76e17de936b0b8024a35be41d4791260b4c69b943aad198
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 6f27399d4c947e7c7268a8eaca10ec76fd276f363103406e2927a6f634a2fda5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        [email protected]
        • Path C:\Users\Admin\AppData\Local\Temp\[email protected]
        • Size 3KB
        • SHA256 b0e9984fc866354bb9b99bc29f275799ebba9b6aef3a9ea667a78ce1009e38ff
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        computer_rescue_icon.png
        • Path C:\Users\Admin\AppData\Local\Temp\[email protected]\computer_rescue_icon.png
        • Size 838B
        • SHA256 e4b839057fcf4fa07d8e84e1a83f1096cf36c89a2f19f692d4ffbfd0706c62b4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        custom_wnd.ini
        • Path C:\Users\Admin\AppData\Local\Temp\[email protected]\custom_wnd.ini
        • Size 2KB
        • SHA256 045219484debeafdcedb04e6fd0c914cb4db13a712b2abdad75b33696f28f7ac
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        setup.ini
        • Path C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini
        • Size 1KB
        • SHA256 85e2140cdf196aedc53620ce64c631c04aa928255a3abbbcbee42773b6b3e25b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        soft_manager_icon.png
        • Path C:\Users\Admin\AppData\Local\Temp\[email protected]\soft_manager_icon.png
        • Size 646B
        • SHA256 4c2639778afba2c0d782996ea8a80152ed25ac2a954f3d525960583bddd12090
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        {02353BAA-BB26-49dc-97C0-A00A65DE0F3B}.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\{02353BAA-BB26-49dc-97C0-A00A65DE0F3B}.tmp
        • Size 1KB
        • SHA256 d82df7afa80ab17cf1d298488c66902f192034b6bb18176f5bd5c5b74e348e79
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        {374A2206-226B-4e5e-B1A0-2A54DFE3B29D}.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\{374A2206-226B-4e5e-B1A0-2A54DFE3B29D}.tmp
        • Size 14KB
        • SHA256 ee7f804a1c73b6d6935ff731ae87aefbbd1abe16dc5ff315c5d8d91e283c902d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        360P2SP.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{48ECEDB0-FE72-49fa-B855-E0643C754C2F}.tmp\360P2SP.dll
        • Size 688KB
        • SHA256 0eca2e140f973b2011c633d4d92e512a1f77e1da610cfe0f4538c0b451270016
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {66018953-528C-4ac0-9816-276978777E41}.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\{66018953-528C-4ac0-9816-276978777E41}.tmp
        • Size 297KB
        • SHA256 0ba9a3e6e4b89ed8c30c092845ecab5939afe4c701a130fdc6ecc9d0ec1a8386
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sites.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp\sites.dll
        • Size 1.4MB
        • SHA256 c1eb83993c85e01ee6ae84eb6e05744ff8c3ccc02c41d09c22286e3012ef46fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {BDFA865B-19D6-476b-98C6-B29043ADF613}.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\{BDFA865B-19D6-476b-98C6-B29043ADF613}.tmp
        • Size 1.3MB
        • SHA256 aa02bd7ab8bbf1c1ab138c20d0d7ebb6b5f2e2166e2184405e54d619526e9ac8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {DFD533A7-2548-450d-A0DF-9E53D7F8364C}.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\{DFD533A7-2548-450d-A0DF-9E53D7F8364C}.tmp
        • Size 15KB
        • SHA256 cbf7cd45fe193e0a438ce14b0176077762e984f897091a682f9e866983da9174
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 777KB
        • SHA256 65fd66b46773dce47aa220e0c89b4b4e5a81e59831c25343f4b986bbb0afbe96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\System32\AppVClient.exe
        • Size 1.5MB
        • SHA256 f4241d6d7207eb54cd86e7fab0c1324ba2fd6a21f3dd4672f749ce4714e3d61b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DiagnosticsHub.StandardCollector.Service.exe
        • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
        • Size 848KB
        • SHA256 0fcbf96d9609b2c1d9ad92267ffb50d956bf2f1b068538610e5bbcc47aec25e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FXSSVC.exe
        • Path C:\Windows\System32\FXSSVC.exe
        • Size 1.4MB
        • SHA256 36b28cf1580b2dfe5039c7625d0ba5c30a52dfca6dba7afdfb9a3631c598f695
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 767KB
        • SHA256 f42c9264e75585443c612d11de65c3da396e2d652757773e1c727b65972c2504
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 860KB
        • SHA256 c58dab87bb08d07df1dfe59c01d0d4d4c3cae783fb967cf4639ce76612842731
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 a8ec4399eed6cc27213f4eb64ba7a079aecb8d8738ac17dbc329b412a85d0aff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\SgrmBroker.exe
        • Size 1.0MB
        • SHA256 8c1cc6e29a68ef6d94e28f3743001741d23819845173ee596427b5fa95332ab2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Spectrum.exe
        • Path C:\Windows\System32\Spectrum.exe
        • Size 489KB
        • SHA256 e9c89804318b7af1bc9da4cb732ed83394b942a8eb1f534176d0a3bf5dd58823
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 850KB
        • SHA256 81ff5af9b8ce6075526cf31782531c4584ac24a3b954df4fc1a013b4948e7a8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 901KB
        • SHA256 a51d786699474524ff8dff84a3ece5e03649dbb5c5a6deb1c272e489e01baf51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 824KB
        • SHA256 b456797bda7e1945ff91d144ff479a4609033dee7788403be926bdd2d0a5ae8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 773KB
        • SHA256 1523266c3625a77f05c12d99b76bf4f51e18673bd3fa00c773b0fe5b281f2d69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2004-0-0x0000000003390000-0x0000000003462000-memory.dmp
        Download

        memory/2004-126-0x0000000006390000-0x0000000006391000-memory.dmp
        Download

        memory/2004-44-0x0000000006390000-0x0000000006391000-memory.dmp
        Download

        memory/2004-7-0x0000000003600000-0x0000000003685000-memory.dmp
        Download

        memory/2004-1-0x0000000003600000-0x0000000003685000-memory.dmp
        Download