Overview

overview

7

Static

static

3

0aecbde8ad...1f.exe

windows10-2004-x64

7

0aecbde8ad...1f.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/10/2026, 12:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    0aecbde8ad059bfc7b812255ae469962bf43b34d5c50d0e10b9e4631dca9db1f.exe
  • Size 4.7MB
  • Sample261011-ps5apsat2z
  • SHA256 0aecbde8ad059bfc7b812255ae469962bf43b34d5c50d0e10b9e4631dca9db1f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
bootkitdiscoverypersistencespywarestealerupx

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 20 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0aecbde8ad059bfc7b812255ae469962bf43b34d5c50d0e10b9e4631dca9db1f.exe
    "C:\Users\Admin\AppData\Local\Temp\0aecbde8ad059bfc7b812255ae469962bf43b34d5c50d0e10b9e4631dca9db1f.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:4896
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:4632

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          elevation_service.exe
          • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
          • Size 2.9MB
          • SHA256 bb6ac673fc9f8c0e23c531b0f581309e5b8f6a4b43f5b85acee781f1c45ca3f1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          maintenanceservice.exe
          • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
          • Size 1017KB
          • SHA256 eb7e31aa7ef735af5e7baca519d76ac6510cb15c2c1863938d87a628733d6257
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OSE.EXE
          • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
          • Size 997KB
          • SHA256 c91f2dab2eed62ffc77358cc3840cea8744a77dc1bf4726761509212ca720134
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          elevation_service.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
          • Size 3.0MB
          • SHA256 42f2e0fc4ae317fcdfa18c155fa93c19d18bfe401bed0e60ff76a69d2d11b9ea
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MsSense.exe
          • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
          • Size 1.2MB
          • SHA256 91bf116694c10301cb225c301ce524461893b82a551ba875c2675db372bd961d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NisSrv.exe
          • Path C:\Program Files\Windows Defender\NisSrv.exe
          • Size 3.7MB
          • SHA256 5207fd933f8e4837bf6ff959517f7713e8700aad69b31a080560bca24b768b14
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wmpnetwk.exe
          • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
          • Size 1.6MB
          • SHA256 21ad365242ca4391fb61f2bf8244bbfc9f4c648889eb214c18e31d2d2f5e18fe
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          [email protected]
          • Path C:\Users\Admin\AppData\Local\Temp\[email protected]
          • Size 3KB
          • SHA256 b0e9984fc866354bb9b99bc29f275799ebba9b6aef3a9ea667a78ce1009e38ff
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          computer_rescue_icon.png
          • Path C:\Users\Admin\AppData\Local\Temp\[email protected]\computer_rescue_icon.png
          • Size 838B
          • SHA256 e4b839057fcf4fa07d8e84e1a83f1096cf36c89a2f19f692d4ffbfd0706c62b4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          custom_wnd.ini
          • Path C:\Users\Admin\AppData\Local\Temp\[email protected]\custom_wnd.ini
          • Size 2KB
          • SHA256 045219484debeafdcedb04e6fd0c914cb4db13a712b2abdad75b33696f28f7ac
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          setup.ini
          • Path C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini
          • Size 1KB
          • SHA256 85e2140cdf196aedc53620ce64c631c04aa928255a3abbbcbee42773b6b3e25b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          soft_manager_icon.png
          • Path C:\Users\Admin\AppData\Local\Temp\[email protected]\soft_manager_icon.png
          • Size 646B
          • SHA256 4c2639778afba2c0d782996ea8a80152ed25ac2a954f3d525960583bddd12090
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          {324E94B7-D882-482e-A1A3-ECEAC7CD4A3F}.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\{324E94B7-D882-482e-A1A3-ECEAC7CD4A3F}.tmp
          • Size 297KB
          • SHA256 0ba9a3e6e4b89ed8c30c092845ecab5939afe4c701a130fdc6ecc9d0ec1a8386
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {3BFC508C-DE23-4c04-93C0-9A04F2C8FE26}.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\{3BFC508C-DE23-4c04-93C0-9A04F2C8FE26}.tmp
          • Size 1.3MB
          • SHA256 aa02bd7ab8bbf1c1ab138c20d0d7ebb6b5f2e2166e2184405e54d619526e9ac8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {527D5ECC-98E7-46b0-947D-09B91974CD65}.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\{527D5ECC-98E7-46b0-947D-09B91974CD65}.tmp
          • Size 14KB
          • SHA256 ee7f804a1c73b6d6935ff731ae87aefbbd1abe16dc5ff315c5d8d91e283c902d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          360P2SP.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{5F4DB0E5-5505-448b-BB28-CE967888A340}.tmp\360P2SP.dll
          • Size 688KB
          • SHA256 0eca2e140f973b2011c633d4d92e512a1f77e1da610cfe0f4538c0b451270016
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {7A0CA968-8EFF-497a-83AE-1BC0630F7B29}.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\{7A0CA968-8EFF-497a-83AE-1BC0630F7B29}.tmp
          • Size 15KB
          • SHA256 cbf7cd45fe193e0a438ce14b0176077762e984f897091a682f9e866983da9174
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sites.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp\sites.dll
          • Size 1.4MB
          • SHA256 c1eb83993c85e01ee6ae84eb6e05744ff8c3ccc02c41d09c22286e3012ef46fc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {B9AEB27A-7D55-4c5d-9123-A39A2A68C041}.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\{B9AEB27A-7D55-4c5d-9123-A39A2A68C041}.tmp
          • Size 1KB
          • SHA256 d82df7afa80ab17cf1d298488c66902f192034b6bb18176f5bd5c5b74e348e79
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          perfhost.exe
          • Path C:\Windows\SysWOW64\perfhost.exe
          • Size 778KB
          • SHA256 f729e7301edc05539a6127347c297357b596a3f788f03041fec63ef07f9e1a2f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AgentService.exe
          • Path C:\Windows\System32\AgentService.exe
          • Size 1.6MB
          • SHA256 f86918ef206daba3395a1cff833bd8fc3763ed4e0b2a96b8dd58d08e9f57ec83
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AppVClient.exe
          • Path C:\Windows\System32\AppVClient.exe
          • Size 1.5MB
          • SHA256 08fd8216bcb5c67e93aedaf39a2ac2c2d34a0b63accb2cad08f96f43cd121c53
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          GameInputSvc.exe
          • Path C:\Windows\System32\GameInputSvc.exe
          • Size 828KB
          • SHA256 0688b31da91468d60b2c08d121bd8c58b9cb2631d690f0c6e4ec0ff280120386
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Locator.exe
          • Path C:\Windows\System32\Locator.exe
          • Size 792KB
          • SHA256 85a5b03c129dbc4f0a775fc0113147fb6b993a68ea5b5284472dc8f6c071f415
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ssh-agent.exe
          • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
          • Size 1.3MB
          • SHA256 2d6d8fb2d24f6b876b7294a0a74ff527c2e7754f0878bc6b68386b8869c25664
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PerceptionSimulationService.exe
          • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
          • Size 996KB
          • SHA256 dae812b49f0a8e2700adc4c7053c0c56519c783ad54542d3611ccafc23558226
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ReFsDedupSvc.exe
          • Path C:\Windows\System32\ReFsDedupSvc.exe
          • Size 2.8MB
          • SHA256 45910c2652078687f06945cfdf3b2b58430fb7ed097f1cfb169dda242abb17b0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SearchIndexer.exe
          • Path C:\Windows\System32\SearchIndexer.exe
          • Size 1.6MB
          • SHA256 90bd07b6b2fcb64189834191fe076a32b5e896bc0931149de8675e489c3d223a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SensorDataService.exe
          • Path C:\Windows\System32\SensorDataService.exe
          • Size 1.9MB
          • SHA256 550a0f2da6659e9ecc58cadf7753c0d16e04f8e39395c4cf30241f22eea258db
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SgrmBroker.exe
          • Path C:\Windows\System32\Sgrm\SgrmBroker.exe
          • Size 1.1MB
          • SHA256 701d3e1d2e36f5190354a465146ae6b12c4b88a8753fe38fca4db604c7a78ee2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          TieringEngineService.exe
          • Path C:\Windows\System32\TieringEngineService.exe
          • Size 1.1MB
          • SHA256 a4fd7cdee17ebc3d9b110f39aaed8e7619bbe01e4bcb0a55b3024374fd3cfc3e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VSSVC.exe
          • Path C:\Windows\System32\VSSVC.exe
          • Size 2.1MB
          • SHA256 f6ce15c4dd6caab72a93a5d69122d311509779f779258c336015effb8f5262f9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          alg.exe
          • Path C:\Windows\System32\alg.exe
          • Size 944KB
          • SHA256 da7ae8ecadc6e2d146073409812c8dfdfe5059dd90fd30ac0708c67378b1d05d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msdtc.exe
          • Path C:\Windows\System32\msdtc.exe
          • Size 928KB
          • SHA256 22db0f464d54385ae7fbef50b89eef7060d822a31924c347dac312f3953c5a40
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msiexec.exe
          • Path C:\Windows\System32\msiexec.exe
          • Size 936KB
          • SHA256 877bda7be421b0cf8dce0f037705cb1a1d3fa775ef7dd296951de935474c88cf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          snmptrap.exe
          • Path C:\Windows\System32\snmptrap.exe
          • Size 800KB
          • SHA256 d234fe9c97ac149151b1048832c6f0a83be8ccb713240ad5df96ba0a5bdb16df
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vds.exe
          • Path C:\Windows\System32\vds.exe
          • Size 1.4MB
          • SHA256 9bfa00dbb7f872b95985bd1424c97bb8cd7b8301601c3f2a2ac915ef7922ce6a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WmiApSrv.exe
          • Path C:\Windows\System32\wbem\WmiApSrv.exe
          • Size 960KB
          • SHA256 ff9b8d3f358ae111d154941e8418747db8125f9bbc545eddcb1dc45f741c9f1f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wbengine.exe
          • Path C:\Windows\System32\wbengine.exe
          • Size 2.2MB
          • SHA256 9e4eddc06425762d7930d98e78433b35e4407d797f0a8e59ba4f1914958545b8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/4896-43-0x0000000007550000-0x0000000007551000-memory.dmp
          Download

          memory/4896-127-0x0000000007550000-0x0000000007551000-memory.dmp
          Download

          memory/4896-6-0x0000000003560000-0x00000000035E5000-memory.dmp
          Download

          memory/4896-1-0x0000000003560000-0x00000000035E5000-memory.dmp
          Download

          memory/4896-0-0x0000000003630000-0x0000000003702000-memory.dmp
          Download