Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
22/10/2026, 19:41
General
- Target e64342bbca9a176ea53eab5ee56ca6e2a0667ffdd74c59273ff2830dac6bea9f.exe
- Size 3.4MB
- Sample261022-yefjvse16w
- SHA256 e64342bbca9a176ea53eab5ee56ca6e2a0667ffdd74c59273ff2830dac6bea9f
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e64342bbca9a176ea53eab5ee56ca6e2a0667ffdd74c59273ff2830dac6bea9f.exe"C:\Users\Admin\AppData\Local\Temp\e64342bbca9a176ea53eab5ee56ca6e2a0667ffdd74c59273ff2830dac6bea9f.exe"1⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\xkjqbylkj\Volumouse\Volumouse\Volumouse.exe"C:\Users\Admin\AppData\Local\xkjqbylkj\Volumouse\Volumouse\Volumouse.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\xkjqbylkj\Volumouse\Volumouse'"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_pj4tzaon.d1g.ps1
ExVoiceSoundWare.dll
Volumouse.exe
XChat.bmp
memory/1592-92-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-94-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-109-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-108-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-107-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-106-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-105-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-104-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-103-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-102-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-101-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-100-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-99-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-98-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-97-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-96-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-95-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-68-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-93-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-91-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-90-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-89-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-88-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-61-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-67-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-77-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-76-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-75-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-79-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-83-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-82-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-78-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-86-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-72-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-74-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-73-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-66-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-63-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-85-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-84-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-64-0x0000000002890000-0x0000000002981000-memory.dmp
memory/1592-62-0x0000000002890000-0x0000000002981000-memory.dmp
memory/4164-21-0x0000000003010000-0x0000000003020000-memory.dmp
memory/4164-52-0x0000000007BC0000-0x0000000007C56000-memory.dmp
memory/4164-57-0x0000000007BB0000-0x0000000007BB8000-memory.dmp
memory/4164-56-0x0000000007C80000-0x0000000007C9A000-memory.dmp
memory/4164-55-0x0000000007B70000-0x0000000007B84000-memory.dmp
memory/4164-50-0x0000000007720000-0x000000000773A000-memory.dmp
memory/4164-54-0x0000000007B60000-0x0000000007B6E000-memory.dmp
memory/4164-48-0x00000000075F0000-0x0000000007693000-memory.dmp
memory/4164-39-0x000000006FD20000-0x000000006FD6C000-memory.dmp
memory/4164-24-0x00000000058B0000-0x0000000005ED8000-memory.dmp
memory/4164-22-0x0000000003020000-0x0000000003056000-memory.dmp
memory/4164-51-0x0000000007780000-0x000000000778A000-memory.dmp
memory/4164-53-0x0000000007B30000-0x0000000007B41000-memory.dmp
memory/4164-47-0x00000000075C0000-0x00000000075DE000-memory.dmp
memory/4164-38-0x0000000006BD0000-0x0000000006C02000-memory.dmp
memory/4164-49-0x0000000008020000-0x000000000869A000-memory.dmp
memory/4164-37-0x0000000006650000-0x000000000669C000-memory.dmp
memory/4164-36-0x0000000006600000-0x000000000661E000-memory.dmp
memory/4164-35-0x0000000006140000-0x0000000006494000-memory.dmp
memory/4164-23-0x0000000003010000-0x0000000003020000-memory.dmp
memory/4164-27-0x0000000005FD0000-0x0000000006036000-memory.dmp
memory/4164-26-0x0000000005800000-0x0000000005866000-memory.dmp
memory/4164-25-0x0000000005760000-0x0000000005782000-memory.dmp