Analysis
- max time kernel
149s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
12/10/2026, 23:16
General
- Target BUAA-WaterPoweredRocket/BUAA-WaterPoweredRocket.exe
- Size 934KB
- Sample261012-29cm8sfa92
- SHA256 2874ad1aba5462441cd8ebfa3c37ed86000137c56090a944ec845bef4b55bf40
Malware Config
Signatures
- Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BUAA-WaterPoweredRocket\BUAA-WaterPoweredRocket.exe"C:\Users\Admin\AppData\Local\Temp\BUAA-WaterPoweredRocket\BUAA-WaterPoweredRocket.exe"1⤵
- Enumerates video capture drivers
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/948-0-0x00007FFD30CDF000-0x00007FFD30CE0000-memory.dmp
memory/948-1-0x0000000000430000-0x000000000051E000-memory.dmp
memory/948-2-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-3-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-4-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-5-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-6-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-7-0x0000000021CF0000-0x0000000021E96000-memory.dmp
memory/948-8-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-9-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-10-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-11-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-12-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-13-0x0000000024700000-0x00000000248C2000-memory.dmp
memory/948-14-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-15-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-16-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-17-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-18-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-19-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-20-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-21-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-25-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-26-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-27-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-28-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-29-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-30-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-31-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-32-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-33-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-34-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-35-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-36-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-37-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-38-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-39-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-40-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-41-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-42-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-43-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-44-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-45-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-46-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-47-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-48-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-49-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-50-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp
memory/948-51-0x00007FFD30B50000-0x00007FFD314F4000-memory.dmp