cc475bcc39e88d9071daec95be7e2e9b9d89a4e316a8d9f457d79e83ff72a375

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 00:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deps.exe
Size 2.5MB
Sample261017-ad565aft21
SHA256 cc475bcc39e88d9071daec95be7e2e9b9d89a4e316a8d9f457d79e83ff72a375
MD5 a854b46ea6be1f70c59287bccd8d01ad
SHA1 02df2aa88821d6a145ce1e0872e7ee11ce5a7d62
SHA512 b85ec26e517c735296e4683b444965413c46b832fa710d4b46528fad968fc2ec9178bb4654d854fe79fb0a4dea7adca9ba2fe1152cd44ecc27fec1dc4110b8e2
SSDEEP 49152:8AIQEWtIxT5fgHB04PoIFL3iHkCsMTOL4LEnpNwShWLh18xteWpAbo:8AIwtIl5fgHnPolEnMqL4LE7lhqhS7vP
TLSH
T110C533594BAB927CCD6A40F071479497209BCF4813CAA6EB6ED702B523D47DA90FC707
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution persistence upx

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
3416	mbcvundccnjl.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3416 set thread context of 5216	3416	mbcvundccnjl.exe	98
PID 3416 set thread context of 4468	3416	mbcvundccnjl.exe	99

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4468-11-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4468-12-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4468-10-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2640	sc.exe
4580	sc.exe
4260	sc.exe
5396	sc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
6024	deps.exe
6024	deps.exe
6024	deps.exe
6024	deps.exe
3416	mbcvundccnjl.exe
3416	mbcvundccnjl.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 5216	3416	mbcvundccnjl.exe	98
PID 3416 wrote to memory of 5216	3416	mbcvundccnjl.exe	98
PID 3416 wrote to memory of 5216	3416	mbcvundccnjl.exe	98
PID 3416 wrote to memory of 5216	3416	mbcvundccnjl.exe	98
PID 3416 wrote to memory of 5216	3416	mbcvundccnjl.exe	98
PID 3416 wrote to memory of 5216	3416	mbcvundccnjl.exe	98
PID 3416 wrote to memory of 5216	3416	mbcvundccnjl.exe	98
PID 3416 wrote to memory of 5216	3416	mbcvundccnjl.exe	98
PID 3416 wrote to memory of 4468	3416	mbcvundccnjl.exe	99
PID 3416 wrote to memory of 4468	3416	mbcvundccnjl.exe	99
PID 3416 wrote to memory of 4468	3416	mbcvundccnjl.exe	99

C:\Users\Admin\AppData\Local\Temp\deps.exe
"C:\Users\Admin\AppData\Local\Temp\deps.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:6024
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe delete "GHBSVZND"
  2⤵
  - Launches sc.exe
  PID:2640
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe create "GHBSVZND" binpath= "C:\ProgramData\atuyxjznzvgj\mbcvundccnjl.exe" start= "auto"
  2⤵
  - Launches sc.exe
  PID:4580
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop eventlog
  2⤵
  - Launches sc.exe
  PID:4260
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe start "GHBSVZND"
  2⤵
  - Launches sc.exe
  PID:5396

C:\ProgramData\atuyxjznzvgj\mbcvundccnjl.exe
C:\ProgramData\atuyxjznzvgj\mbcvundccnjl.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:5216
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:4468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

mbcvundccnjl.exe

Path C:\ProgramData\atuyxjznzvgj\mbcvundccnjl.exe
Size 2.5MB
SHA256 cc475bcc39e88d9071daec95be7e2e9b9d89a4e316a8d9f457d79e83ff72a375
MD5 a854b46ea6be1f70c59287bccd8d01ad
SHA1 02df2aa88821d6a145ce1e0872e7ee11ce5a7d62
SHA512 b85ec26e517c735296e4683b444965413c46b832fa710d4b46528fad968fc2ec9178bb4654d854fe79fb0a4dea7adca9ba2fe1152cd44ecc27fec1dc4110b8e2
SSDEEP 49152:8AIQEWtIxT5fgHB04PoIFL3iHkCsMTOL4LEnpNwShWLh18xteWpAbo:8AIwtIl5fgHnPolEnMqL4LE7lhqhS7vP
TLSH
T110C533594BAB927CCD6A40F071479497209BCF4813CAA6EB6ED702B523D47DA90FC707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4468-11-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4468-12-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4468-10-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/5216-6-0x0000000140000000-0x000000014000D000-memory.dmp

Download

memory/5216-5-0x0000000140000000-0x000000014000D000-memory.dmp

Download

memory/5216-4-0x0000000140000000-0x000000014000D000-memory.dmp

Download

memory/5216-3-0x0000000140000000-0x000000014000D000-memory.dmp

Download

memory/5216-7-0x0000000140000000-0x000000014000D000-memory.dmp

Download