Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
20/10/2026, 11:03
General
- Target EventLog.exe
- Size 398KB
- Sample261020-m51ryabb66
- SHA256 6c204d3433fb2b029a3b3d908b7bfa9e44e14bd66b4bfdb42ba1690079b17f19
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Drops file in Drivers directory 1 IoCs
- Sets service image path in registry 3 TTPs 2 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\EventLog.exe"C:\Users\Admin\AppData\Local\Temp\EventLog.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pack_proc_guard.ps1" -WatchPid 4204 -Slot "b2c86d068577a49c" -RelaunchCmd "C:\Users\Admin\AppData\Local\Temp\EventLog.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\EventLog.exeC:\Users\Admin\AppData\Local\Temp\EventLog.exe1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
PackExtraPlugin.Ksl666-diag.log
ksl666_last_step.txt
ksl666_last_step.txt
mm_pe_tls.log
mm_pe_tls.log
mm_pe_tls.log
proc_guard.log
proc_guard.log
proc_guard.log
uplink.log
__ksl666_diag__.txt
__ksl666_diag__.txt
__ksl666_diag__.txt
__ksl666_diag__.txt
__ksl666_drv__.txt
__ksl666_log_called__.txt
pack_proc_guard.ps1
packclientcore.primary.dll.pblob
packclientcore.primary.dll.json
ygp.dat
memory/720-840-0x00000000067A0000-0x00000000067EC000-memory.dmp
memory/720-825-0x0000000006240000-0x000000000659B000-memory.dmp
memory/720-738-0x0000000006160000-0x00000000061C6000-memory.dmp
memory/720-748-0x00000000061D0000-0x0000000006236000-memory.dmp
memory/720-839-0x0000000006740000-0x000000000675E000-memory.dmp
memory/720-859-0x0000000007990000-0x0000000007A26000-memory.dmp
memory/720-861-0x0000000007920000-0x0000000007942000-memory.dmp
memory/720-692-0x00000000060C0000-0x00000000060E2000-memory.dmp
memory/720-860-0x0000000006CD0000-0x0000000006CEA000-memory.dmp
memory/720-862-0x0000000007FF0000-0x00000000085AA000-memory.dmp
memory/720-493-0x0000000073690000-0x0000000073E4C000-memory.dmp
memory/720-863-0x0000000008C30000-0x00000000092AC000-memory.dmp
memory/720-463-0x0000000073690000-0x0000000073E4C000-memory.dmp
memory/720-464-0x0000000005980000-0x0000000005FCA000-memory.dmp
memory/720-462-0x0000000003220000-0x0000000003256000-memory.dmp
memory/720-459-0x00000000736A2000-0x00000000736A3000-memory.dmp
memory/720-866-0x00000000736A2000-0x00000000736A3000-memory.dmp
memory/720-867-0x0000000073690000-0x0000000073E4C000-memory.dmp
memory/720-868-0x0000000073690000-0x0000000073E4C000-memory.dmp
memory/4204-238-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-88-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-253-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-252-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-251-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-222-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-220-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-217-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-255-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-256-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-213-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-212-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-257-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-210-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-208-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-428-0x0000000009C90000-0x0000000009C91000-memory.dmp
memory/4204-205-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-202-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-201-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-138-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-134-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-133-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-132-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-129-0x0000000002790000-0x00000000027F0000-memory.dmp
memory/4204-258-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-115-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-97-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-96-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-94-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-92-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-91-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-90-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-89-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-254-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-87-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-86-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-85-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-259-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-260-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-261-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-224-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-227-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-228-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-231-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-233-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-235-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-0-0x0000000002790000-0x00000000027F0000-memory.dmp
memory/4204-239-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-629-0x00000000092F0000-0x00000000092F1000-memory.dmp
memory/4204-242-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-244-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-246-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-214-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-171-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-175-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-187-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-182-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-173-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-98-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-95-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-93-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-52-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-44-0x00000000036E0000-0x0000000003821000-memory.dmp
memory/4204-8-0x0000000002790000-0x00000000027F0000-memory.dmp
memory/4204-6-0x0000000002790000-0x00000000027F0000-memory.dmp
memory/4204-7-0x0000000002790000-0x00000000027F0000-memory.dmp