Overview
overview
8Static
static
3VixenFreePerm.zip
windows10-2004-x64
1VixenFreePerm.zip
windows11-ltsc_2024-x64
1RUN AS ADM...OF.bat
windows10-2004-x64
7RUN AS ADM...OF.bat
windows11-ltsc_2024-x64
7deps/AMIDEWINx64.exe
windows10-2004-x64
1deps/AMIDEWINx64.exe
windows11-ltsc_2024-x64
1deps/AMIFLDRV64.sys
windows10-2004-x64
3deps/AMIFLDRV64.sys
windows11-ltsc_2024-x64
3deps/EEUPDATE.exe
windows10-2004-x64
1deps/EEUPDATE.exe
windows11-ltsc_2024-x64
1deps/PSWOA.exe
windows10-2004-x64
7deps/PSWOA.exe
windows11-ltsc_2024-x64
7deps/RTIoLib64.dll
windows10-2004-x64
1deps/RTIoLib64.dll
windows11-ltsc_2024-x64
1deps/RTNicPgW64.exe
windows10-2004-x64
1deps/RTNicPgW64.exe
windows11-ltsc_2024-x64
1deps/amigendrv64.sys
windows10-2004-x64
3deps/i3782.bat
windows10-2004-x64
8deps/i3782.bat
windows11-ltsc_2024-x64
8deps/iqvsw64e.cat
windows10-2004-x64
1deps/iqvsw64e.cat
windows11-ltsc_2024-x64
8deps/iqvsw64e.inf
windows10-2004-x64
1deps/iqvsw64e.inf
windows11-ltsc_2024-x64
1deps/iqvsw64e.sys
windows10-2004-x64
3deps/rtkio64.sys
windows10-2004-x64
3deps/rtkio64.sys
windows11-ltsc_2024-x64
3deps/rtkiow10x64.sys
windows10-2004-x64
3Analysis
- max time kernel
148s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 00:59
Static task
static1
Behavioral task
behavioral1
Sample
VixenFreePerm.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
VixenFreePerm.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
RUN AS ADMIN TO SPOOF.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
RUN AS ADMIN TO SPOOF.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
deps/AMIDEWINx64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
deps/AMIDEWINx64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
deps/AMIFLDRV64.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
deps/AMIFLDRV64.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
deps/EEUPDATE.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
deps/EEUPDATE.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
deps/PSWOA.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
deps/PSWOA.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
deps/RTIoLib64.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
deps/RTIoLib64.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
deps/RTNicPgW64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
deps/RTNicPgW64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
deps/amigendrv64.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
deps/i3782.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
deps/i3782.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral20
Sample
deps/iqvsw64e.cat
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
deps/iqvsw64e.cat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral22
Sample
deps/iqvsw64e.inf
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
deps/iqvsw64e.inf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral24
Sample
deps/iqvsw64e.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
deps/rtkio64.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
deps/rtkio64.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
deps/rtkiow10x64.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
General
- Target RUN AS ADMIN TO SPOOF.bat
- Size 318B
- Sample261027-bcllrszzby
- SHA256 dff0fdf728408791b0fd6505e800a7ab75101d973c921c77ea334ec63fdc36aa
- MD5 60972c42004f8c1fb66bfdc828d061cd
- SHA1 4bb0dfc693820dc04da065ceb00aab1cdc82dcea
- SHA512 0715ccf5eb85ddbdeb8e63357b32d38808f7f09046d8fa71d1392a6fb8c27a30fd016824e89afa5fb882bed42220dcc32b891a89adbd967d084d55a7e3cede06
- TLSH T162E02601308A72114CB0489A1FB9A8AEDF4F826B4127AD14747B80395E6924CA1E80C9
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Stops running service(s) 4 TTPs
- Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\system32\wbem\repository svchost.exe File opened for modification C:\Windows\system32\wbem\repository\WRITABLE.TST svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING1.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING2.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING3.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\OBJECTS.DATA svchost.exe File opened for modification C:\Windows\system32\wbem\repository\INDEX.BTR svchost.exe - Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 6004 sc.exe 3168 sc.exe 3900 sc.exe 6092 sc.exe 1104 sc.exe - Executes a command shell one-liner 1 TTPs 14 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2992 cmd.exe 3260 cmd.exe 4704 cmd.exe 3628 cmd.exe 5428 cmd.exe 3024 cmd.exe 1584 cmd.exe 5620 cmd.exe 3848 cmd.exe 3764 cmd.exe 5980 cmd.exe 6140 cmd.exe 5748 cmd.exe 1660 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe - Kills process with taskkill 4 IoCs
pid Process 5376 taskkill.exe 2064 taskkill.exe 5148 taskkill.exe 2356 taskkill.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\APPID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} WmiPrvSE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\APPID WmiPrvSE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} WmiPrvSE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\APPID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2} WmiPrvSE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2} WmiPrvSE.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2400 WMIC.exe 2400 WMIC.exe 2400 WMIC.exe 2400 WMIC.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 832 Process not Found 832 Process not Found 832 Process not Found 832 Process not Found 832 Process not Found 832 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5376 taskkill.exe Token: SeDebugPrivilege 2064 taskkill.exe Token: SeDebugPrivilege 5148 taskkill.exe Token: SeAssignPrimaryTokenPrivilege 4808 svchost.exe Token: SeIncreaseQuotaPrivilege 4808 svchost.exe Token: SeSecurityPrivilege 4808 svchost.exe Token: SeTakeOwnershipPrivilege 4808 svchost.exe Token: SeLoadDriverPrivilege 4808 svchost.exe Token: SeSystemtimePrivilege 4808 svchost.exe Token: SeBackupPrivilege 4808 svchost.exe Token: SeRestorePrivilege 4808 svchost.exe Token: SeShutdownPrivilege 4808 svchost.exe Token: SeSystemEnvironmentPrivilege 4808 svchost.exe Token: SeUndockPrivilege 4808 svchost.exe Token: SeManageVolumePrivilege 4808 svchost.exe Token: SeAssignPrimaryTokenPrivilege 4808 svchost.exe Token: SeIncreaseQuotaPrivilege 4808 svchost.exe Token: SeSecurityPrivilege 4808 svchost.exe Token: SeTakeOwnershipPrivilege 4808 svchost.exe Token: SeLoadDriverPrivilege 4808 svchost.exe Token: SeSystemtimePrivilege 4808 svchost.exe Token: SeBackupPrivilege 4808 svchost.exe Token: SeRestorePrivilege 4808 svchost.exe Token: SeShutdownPrivilege 4808 svchost.exe Token: SeSystemEnvironmentPrivilege 4808 svchost.exe Token: SeUndockPrivilege 4808 svchost.exe Token: SeManageVolumePrivilege 4808 svchost.exe Token: SeAssignPrimaryTokenPrivilege 4808 svchost.exe Token: SeIncreaseQuotaPrivilege 4808 svchost.exe Token: SeSecurityPrivilege 4808 svchost.exe Token: SeTakeOwnershipPrivilege 4808 svchost.exe Token: SeLoadDriverPrivilege 4808 svchost.exe Token: SeSystemtimePrivilege 4808 svchost.exe Token: SeBackupPrivilege 4808 svchost.exe Token: SeRestorePrivilege 4808 svchost.exe Token: SeShutdownPrivilege 4808 svchost.exe Token: SeSystemEnvironmentPrivilege 4808 svchost.exe Token: SeUndockPrivilege 4808 svchost.exe Token: SeManageVolumePrivilege 4808 svchost.exe Token: SeAssignPrimaryTokenPrivilege 4808 svchost.exe Token: SeIncreaseQuotaPrivilege 4808 svchost.exe Token: SeSecurityPrivilege 4808 svchost.exe Token: SeTakeOwnershipPrivilege 4808 svchost.exe Token: SeLoadDriverPrivilege 4808 svchost.exe Token: SeSystemtimePrivilege 4808 svchost.exe Token: SeBackupPrivilege 4808 svchost.exe Token: SeRestorePrivilege 4808 svchost.exe Token: SeShutdownPrivilege 4808 svchost.exe Token: SeSystemEnvironmentPrivilege 4808 svchost.exe Token: SeUndockPrivilege 4808 svchost.exe Token: SeManageVolumePrivilege 4808 svchost.exe Token: SeAssignPrimaryTokenPrivilege 4808 svchost.exe Token: SeIncreaseQuotaPrivilege 4808 svchost.exe Token: SeSecurityPrivilege 4808 svchost.exe Token: SeTakeOwnershipPrivilege 4808 svchost.exe Token: SeLoadDriverPrivilege 4808 svchost.exe Token: SeSystemtimePrivilege 4808 svchost.exe Token: SeBackupPrivilege 4808 svchost.exe Token: SeRestorePrivilege 4808 svchost.exe Token: SeShutdownPrivilege 4808 svchost.exe Token: SeSystemEnvironmentPrivilege 4808 svchost.exe Token: SeUndockPrivilege 4808 svchost.exe Token: SeManageVolumePrivilege 4808 svchost.exe Token: SeAssignPrimaryTokenPrivilege 4808 svchost.exe - Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 5620 wrote to memory of 3888 5620 cmd.exe 89 PID 3888 wrote to memory of 3848 3888 PSWOA.exe 90 PID 3848 wrote to memory of 5376 3848 cmd.exe 91 PID 3888 wrote to memory of 3764 3888 PSWOA.exe 93 PID 3764 wrote to memory of 1104 3764 cmd.exe 94 PID 3888 wrote to memory of 1660 3888 PSWOA.exe 95 PID 1660 wrote to memory of 3308 1660 cmd.exe 96 PID 3308 wrote to memory of 4632 3308 net.exe 97 PID 3888 wrote to memory of 2992 3888 PSWOA.exe 98 PID 2992 wrote to memory of 2064 2992 cmd.exe 99 PID 3888 wrote to memory of 5980 3888 PSWOA.exe 100 PID 3888 wrote to memory of 6140 3888 PSWOA.exe 101 PID 6140 wrote to memory of 4136 6140 cmd.exe 102 PID 3888 wrote to memory of 3260 3888 PSWOA.exe 103 PID 3260 wrote to memory of 6004 3260 cmd.exe 104 PID 3888 wrote to memory of 4704 3888 PSWOA.exe 105 PID 4704 wrote to memory of 3168 4704 cmd.exe 106 PID 3888 wrote to memory of 3628 3888 PSWOA.exe 108 PID 3628 wrote to memory of 3900 3628 cmd.exe 109 PID 3888 wrote to memory of 5428 3888 PSWOA.exe 110 PID 5428 wrote to memory of 5148 5428 cmd.exe 111 PID 3888 wrote to memory of 5748 3888 PSWOA.exe 114 PID 5748 wrote to memory of 6092 5748 cmd.exe 115 PID 3888 wrote to memory of 3024 3888 PSWOA.exe 116 PID 3024 wrote to memory of 2356 3024 cmd.exe 117 PID 3888 wrote to memory of 1584 3888 PSWOA.exe 119 PID 1584 wrote to memory of 2400 1584 cmd.exe 120 PID 3888 wrote to memory of 3248 3888 PSWOA.exe 122 PID 3888 wrote to memory of 3300 3888 PSWOA.exe 124 PID 3888 wrote to memory of 4224 3888 PSWOA.exe 126 PID 3888 wrote to memory of 5240 3888 PSWOA.exe 128 PID 3888 wrote to memory of 5892 3888 PSWOA.exe 130 PID 3888 wrote to memory of 4912 3888 PSWOA.exe 132
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RUN AS ADMIN TO SPOOF.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Users\Admin\AppData\Local\Temp\deps\PSWOA.exePSWOA.exe2⤵
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\system32\taskkill.exetaskkill /im wmi* /f /t4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5376
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc config winmgmt start=disabled 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\system32\sc.exesc config winmgmt start=disabled4⤵
- Launches sc.exe
PID:1104
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop winmgmt /y 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\system32\net.exenet stop winmgmt /y4⤵
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop winmgmt /y5⤵PID:4632
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\system32\taskkill.exetaskkill /im wmi* /f /t4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2064
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cd %windir%\system32\wbem3⤵
- Executes a command shell one-liner
PID:5980
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmiprvse /regserver 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Windows\System32\Wbem\WmiPrvSE.exewmiprvse /regserver4⤵
- Modifies registry class
PID:4136
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc config winmgmt start= auto 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\system32\sc.exesc config winmgmt start= auto4⤵
- Launches sc.exe
PID:6004
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc start winmgmt 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\system32\sc.exesc start winmgmt4⤵
- Launches sc.exe
PID:3168
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop winmgmt 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\system32\sc.exesc stop winmgmt4⤵
- Launches sc.exe
PID:3900
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Windows\system32\taskkill.exetaskkill /im wmi* /f /t4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5148
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc start winmgmt 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Windows\system32\sc.exesc start winmgmt4⤵
- Launches sc.exe
PID:6092
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\system32\taskkill.exetaskkill /im wmi* /f /t4⤵
- Kills process with taskkill
PID:2356
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic baseboard get cat 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get cat4⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:2400
-
-
-
C:\Users\Admin\AppData\Local\Temp\deps\amidewinx64.exeamidewinx64.exe /BM3⤵PID:3248
-
-
C:\Users\Admin\AppData\Local\Temp\deps\amidewinx64.exeamidewinx64.exe /SS3⤵PID:3300
-
-
C:\Users\Admin\AppData\Local\Temp\deps\amidewinx64.exeamidewinx64.exe /BS3⤵PID:4224
-
-
C:\Users\Admin\AppData\Local\Temp\deps\amidewinx64.exeamidewinx64.exe /CS3⤵PID:5240
-
-
C:\Users\Admin\AppData\Local\Temp\deps\amidewinx64.exeamidewinx64.exe /PSN3⤵PID:5892
-
-
C:\Users\Admin\AppData\Local\Temp\deps\amidewinx64.exeamidewinx64.exe /PPN3⤵PID:4912
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2816
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4808
-
C:\Users\Admin\AppData\Local\Temp\deps\amigendrv64.sysC:\Users\Admin\AppData\Local\Temp\deps\amigendrv64.sys1⤵PID:5264