Analysis
- max time kernel
149s - max time network
142s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
- submitted
23/10/2026, 14:05
General
- Target vtfedit133/x86/VTFEdit.exe
- Size 428KB
- Sample261023-rd28xab151
- SHA256 dc63970cbab65d720a5582ab242386bbbe5fbc7ab28b3336c0f0e54b8df6618a
Malware Config
Signatures
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\vtfedit133\x86\VTFEdit.exe"C:\Users\Admin\AppData\Local\Temp\vtfedit133\x86\VTFEdit.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4300-0-0x0000000000890000-0x0000000000929000-memory.dmp
memory/4300-2-0x0000000000B80000-0x0000000000E3E000-memory.dmp
memory/4300-3-0x0000000000B80000-0x0000000000E3E000-memory.dmp
memory/4300-5-0x0000000075092000-0x0000000075094000-memory.dmp
memory/4300-4-0x0000000002780000-0x0000000002790000-memory.dmp
memory/4300-6-0x0000000075090000-0x0000000075641000-memory.dmp
memory/4300-7-0x0000000075090000-0x0000000075641000-memory.dmp
memory/4300-8-0x0000000075090000-0x0000000075641000-memory.dmp
memory/4300-9-0x0000000000B80000-0x0000000000E3E000-memory.dmp
memory/4300-11-0x0000000075092000-0x0000000075094000-memory.dmp
memory/4300-10-0x0000000002780000-0x0000000002790000-memory.dmp
memory/4300-13-0x0000000075090000-0x0000000075641000-memory.dmp
memory/4300-14-0x0000000075090000-0x0000000075641000-memory.dmp