Analysis
- max time kernel
36s - max time network
46s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
23/10/2026, 23:34
General
- Target E68EA8E59C9FE69CBAE694BBE9809F_E697A0E99990E68EA8_.exe
- Size 27.7MB
- Sample261023-3kshtsv13m
- SHA256 de73ce653942dbcd23db5135c905f86495f813de6abf71efa317ae8ff1e802d7
Malware Config
Signatures
- ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
- Deletes itself 1 TTPs 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\E68EA8E59C9FE69CBAE694BBE9809F_E697A0E99990E68EA8_.exe"C:\Users\Admin\AppData\Local\Temp\E68EA8E59C9FE69CBAE694BBE9809F_E697A0E99990E68EA8_.exe"1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
F:\ÍÆÍÁ»ú¹¥ËÙ[ÎÞÏÞÍÆ]\719f7dc0.exeF:\ÍÆÍÁ»ú¹¥ËÙ[ÎÞÏÞÍÆ]\719f7dc0.exe 0|1804|C:\Users\Admin\AppData\Local\Temp\E68EA8E59C9FE69CBAE694BBE9809F_E697A0E99990E68EA8_.exe2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Indicator Removal
1File Deletion
1Pre-OS Boot
1Bootkit
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
719f7dc0.exe
ESP-B.DAT
MapDesc1.dat
MapDesc2.dat
SDC.dat
igamesdk32.dll
libcrypto-3.dll
libssl-3.dll
memory/1804-29-0x0000000003F60000-0x0000000004173000-memory.dmp
memory/1804-25-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/1804-3-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/1804-13-0x0000000003F60000-0x0000000004173000-memory.dmp
memory/1804-14-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/1804-16-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/1804-12-0x0000000003F60000-0x0000000004173000-memory.dmp
memory/1804-17-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/1804-18-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/1804-19-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/1804-20-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/1804-21-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/1804-22-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/1804-23-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/1804-24-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/1804-42-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/1804-26-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/1804-28-0x0000000000AF4000-0x0000000000B04000-memory.dmp
memory/1804-0-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/1804-30-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/1804-33-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/1804-31-0x0000000003F60000-0x0000000004173000-memory.dmp
memory/1804-5-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/1804-4-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/1804-1-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/1804-2-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/1804-7-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/1804-8-0x0000000000AF4000-0x0000000000B04000-memory.dmp
memory/1804-10-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/1804-6-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/1804-11-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/5272-38-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/5272-43-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/5272-46-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/5272-45-0x00000000040B0000-0x00000000042C3000-memory.dmp
memory/5272-44-0x00000000040B0000-0x00000000042C3000-memory.dmp
memory/5272-41-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/5272-34-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/5272-35-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/5272-36-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/5272-37-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/5272-39-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/5272-40-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/5272-77-0x0000000000400000-0x0000000000D19000-memory.dmp
memory/5272-78-0x00000000040B0000-0x00000000042C3000-memory.dmp
memory/5272-87-0x0000000000400000-0x0000000000D19000-memory.dmp