Analysis
- user interaction
yes - max time kernel
47s - max time network
73s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
27/10/2026, 03:01
General
- Target mikeyss.vmp.exe
- Size 24.2MB
- Sample261027-dh2ahsce67
- SHA256 1fc74c722d10b58abbd8051a2877c2a499070c62e9c26a7f9516ebd096962f84
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Direct Volume Access: Opens a physical disk for reading 1 TTPs 16 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\mikeyss.vmp.exe"C:\Users\Admin\AppData\Local\Temp\mikeyss.vmp.exe"1⤵
- Enumerates connected drives
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
memory/4396-0-0x00007FFC7EB50000-0x00007FFC7EB52000-memory.dmp
memory/4396-5-0x00007FFC7D220000-0x00007FFC7D222000-memory.dmp
memory/4396-2-0x00007FFC7EB60000-0x00007FFC7EB62000-memory.dmp
memory/4396-4-0x00007FFC7D210000-0x00007FFC7D212000-memory.dmp
memory/4396-3-0x00007FFC7EB70000-0x00007FFC7EB72000-memory.dmp
memory/4396-1-0x00007FF6B5A05000-0x00007FF6B65F5000-memory.dmp
memory/4396-7-0x00007FFC7D230000-0x00007FFC7D232000-memory.dmp
memory/4396-6-0x00007FFC7C7E0000-0x00007FFC7C7E2000-memory.dmp
memory/4396-12-0x00007FF6B4C40000-0x00007FF6B7E2C000-memory.dmp
memory/4396-15-0x00007FF6B4C40000-0x00007FF6B7E2C000-memory.dmp
memory/4396-16-0x00007FF6B5A05000-0x00007FF6B65F5000-memory.dmp
memory/4396-17-0x00007FF6B4C40000-0x00007FF6B7E2C000-memory.dmp
memory/4396-18-0x00007FF6B4C40000-0x00007FF6B7E2C000-memory.dmp
memory/4396-27-0x00007FF6B4C40000-0x00007FF6B7E2C000-memory.dmp
memory/4396-28-0x00007FF6B5A05000-0x00007FF6B65F5000-memory.dmp