Analysis
- user interaction
yes - max time kernel
76s - max time network
84s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
23/10/2026, 04:34
General
- Target Implant.exe
- Size 108.6MB
- Sample261023-e67mwaby9k
- SHA256 9da757ed4bea2cc9d2a50a2b4e7ea9153d1acb72cbd62a09d522a0791deeb113
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Writes a Windows system DLL name to a user directory 2 TTPs 1 IoCs
A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Implant.exe"C:\Users\Admin\AppData\Local\Temp\Implant.exe"1⤵
- Writes a Windows system DLL name to a user directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Implant.exe"C:\Users\Admin\AppData\Local\Temp\Implant.exe"2⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_MEI33282\PyQt5\Qt5\bin\QtWebEngineProcess.exe"C:\Users\Admin\AppData\Local\Temp\_MEI33282\PyQt5\Qt5\bin\QtWebEngineProcess.exe" --type=utility --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --lang=en-US --service-sandbox-type=network --use-gl=angle --application-name=Implant --webengine-schemes=qrc:sLV --mojo-platform-channel-handle=2432 /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\_MEI33282\PyQt5\Qt5\bin\QtWebEngineProcess.exe"C:\Users\Admin\AppData\Local\Temp\_MEI33282\PyQt5\Qt5\bin\QtWebEngineProcess.exe" --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --mojo-platform-channel-handle=2488 /prefetch:13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Hijack Execution Flow
1DLL Search Order Hijacking
1Masquerading
1Match Legitimate Name or Location
1Replay Monitor
Loading Replay Monitor...
Downloads
CURRENT
MSVCP140.dll
MSVCP140_1.dll
Qt5Core.dll
Qt5Gui.dll
Qt5Network.dll
Qt5PrintSupport.dll
Qt5Qml.dll
Qt5QmlModels.dll
Qt5Quick.dll
Qt5QuickWidgets.dll
Qt5WebEngineWidgets.dll
Qt5Widgets.dll
VCRUNTIME140_1.dll
qtdeclarative_en.qm
QtCore.pyd
QtGui.pyd
QtWebEngineWidgets.pyd
QtWidgets.pyd
sip.cp313-win_amd64.pyd
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_wmi.pyd
base_library.zip
libffi-8.dll
_psutil_windows.pyd
python3.DLL
python313.dll
select.pyd
ucrtbase.dll
memory/1536-1698-0x00007FFE7B430000-0x00007FFE7B828000-memory.dmp
memory/3516-1659-0x00007FFE7C160000-0x00007FFE7C6A1000-memory.dmp
memory/3516-1633-0x00007FFE7DB60000-0x00007FFE7DDC3000-memory.dmp
memory/3516-1664-0x00007FFE7B830000-0x00007FFE7BA95000-memory.dmp
memory/3516-1661-0x00007FFE7C6B0000-0x00007FFE7CB9C000-memory.dmp
memory/6016-1695-0x00007FFE9EC90000-0x00007FFE9EC91000-memory.dmp
memory/6016-1697-0x00007FFE9D950000-0x00007FFE9D951000-memory.dmp
memory/6016-1696-0x00007FFE9E0E0000-0x00007FFE9E0E1000-memory.dmp
memory/6016-1699-0x00007FFE7B430000-0x00007FFE7B828000-memory.dmp
memory/6016-1718-0x0000017494D10000-0x0000017494EA9000-memory.dmp
memory/6016-1719-0x0000017494EB0000-0x0000017494F86000-memory.dmp