Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
12/10/2026, 23:16
General
- Target BUAA-WaterPoweredRocket/BUAA-WaterPoweredRocket.exe
- Size 934KB
- Sample261012-29cm8sfa92
- SHA256 2874ad1aba5462441cd8ebfa3c37ed86000137c56090a944ec845bef4b55bf40
Malware Config
Signatures
- Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BUAA-WaterPoweredRocket\BUAA-WaterPoweredRocket.exe"C:\Users\Admin\AppData\Local\Temp\BUAA-WaterPoweredRocket\BUAA-WaterPoweredRocket.exe"1⤵
- Enumerates video capture drivers
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1572-0-0x0000000000F30000-0x000000000101E000-memory.dmp
memory/1572-1-0x000000001BD10000-0x000000001BD20000-memory.dmp
memory/1572-2-0x0000000021F80000-0x0000000022126000-memory.dmp
memory/1572-3-0x000000001BD10000-0x000000001BD20000-memory.dmp
memory/1572-5-0x000000001BD10000-0x000000001BD20000-memory.dmp
memory/1572-4-0x000000001BD10000-0x000000001BD20000-memory.dmp
memory/1572-6-0x0000000022620000-0x00000000227E2000-memory.dmp
memory/1572-7-0x000000001BD10000-0x000000001BD20000-memory.dmp
memory/1572-8-0x000000001BD10000-0x000000001BD20000-memory.dmp
memory/1572-9-0x000000001BD10000-0x000000001BD20000-memory.dmp
memory/1572-13-0x000000001BD10000-0x000000001BD20000-memory.dmp
memory/1572-14-0x000000001BD10000-0x000000001BD20000-memory.dmp
memory/1572-15-0x000000001BD10000-0x000000001BD20000-memory.dmp
memory/1572-16-0x0000000021510000-0x0000000021610000-memory.dmp
memory/1572-17-0x000000001BD10000-0x000000001BD20000-memory.dmp
memory/1572-18-0x0000000021510000-0x0000000021610000-memory.dmp
memory/1572-19-0x000000001BD10000-0x000000001BD20000-memory.dmp
memory/1572-20-0x0000000021510000-0x0000000021610000-memory.dmp
memory/1572-21-0x0000000021510000-0x0000000021610000-memory.dmp
memory/1572-22-0x0000000021510000-0x0000000021610000-memory.dmp
memory/1572-23-0x0000000021510000-0x0000000021610000-memory.dmp
memory/1572-24-0x0000000021510000-0x0000000021610000-memory.dmp
memory/1572-25-0x0000000021510000-0x0000000021610000-memory.dmp