Analysis
- max time kernel
149s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
17/10/2026, 04:35
General
- Target 客户端/客户端.exe
- Size 5.0MB
- Sample261017-e7skcahz21
- SHA256 6f37b63bdffd07f93989f50026c89da4990f6fb34bf5871b3cfb34eb0f510f06
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\客户端\客户端.exe"C:\Users\Admin\AppData\Local\Temp\客户端\客户端.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
cache_meta.json
cache_meta.json.tmp
games.dat
games.dat.tmp
games.dat.tmp
settings.dat
settings.dat.tmp
sync_state_mini.json
WMSDKNS.XML.bak
HVMRuntm.dll
memory/4964-14-0x0000000006330000-0x00000000063F2000-memory.dmp
memory/4964-53-0x0000000007300000-0x0000000007338000-memory.dmp
memory/4964-15-0x0000000006420000-0x000000000642A000-memory.dmp
memory/4964-19-0x0000000006590000-0x00000000065B8000-memory.dmp
memory/4964-20-0x0000000006430000-0x0000000006438000-memory.dmp
memory/4964-21-0x00000000065D0000-0x00000000065EA000-memory.dmp
memory/4964-22-0x00000000065F0000-0x00000000065FA000-memory.dmp
memory/4964-23-0x0000000006610000-0x0000000006618000-memory.dmp
memory/4964-24-0x0000000006600000-0x000000000660A000-memory.dmp
memory/4964-25-0x00000000066C0000-0x00000000066DE000-memory.dmp
memory/4964-27-0x0000000004E60000-0x0000000004E78000-memory.dmp
memory/4964-13-0x00000000053B0000-0x00000000053C0000-memory.dmp
memory/4964-12-0x0000000005B80000-0x0000000005B9A000-memory.dmp
memory/4964-11-0x0000000005B40000-0x0000000005B60000-memory.dmp
memory/4964-10-0x00000000053B0000-0x00000000053C0000-memory.dmp
memory/4964-51-0x0000000008B70000-0x0000000008BD6000-memory.dmp
memory/4964-52-0x00000000053B0000-0x00000000053C0000-memory.dmp
memory/4964-0-0x00000000004D0000-0x00000000009D8000-memory.dmp
memory/4964-54-0x0000000006D00000-0x0000000006D0E000-memory.dmp
memory/4964-55-0x0000000008880000-0x0000000008888000-memory.dmp
memory/4964-9-0x00000000053B0000-0x00000000053C0000-memory.dmp
memory/4964-65-0x000000000F320000-0x000000000F34C000-memory.dmp
memory/4964-66-0x00000000053B0000-0x00000000053C0000-memory.dmp
memory/4964-67-0x00000000053B0000-0x00000000053C0000-memory.dmp
memory/4964-79-0x00000000053B0000-0x00000000053C0000-memory.dmp
memory/4964-83-0x00000000053B0000-0x00000000053C0000-memory.dmp
memory/4964-8-0x0000000005880000-0x00000000058A2000-memory.dmp
memory/4964-7-0x00000000053B0000-0x00000000053C0000-memory.dmp
memory/4964-6-0x00000000053B0000-0x00000000053C0000-memory.dmp
memory/4964-5-0x0000000073800000-0x0000000073889000-memory.dmp
memory/4964-112-0x00000000053B0000-0x00000000053C0000-memory.dmp
memory/4964-122-0x00000000053B0000-0x00000000053C0000-memory.dmp
memory/4964-126-0x00000000053B0000-0x00000000053C0000-memory.dmp
memory/4964-127-0x00000000053B0000-0x00000000053C0000-memory.dmp