045277bc748b5c4985c3040169b9c0b7dc2e5da060200d2e62690c06129e3462

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ultradpi.exe
Size 3.4MB
Sample261027-we3y2seb85
SHA256 045277bc748b5c4985c3040169b9c0b7dc2e5da060200d2e62690c06129e3462
MD5 bcb4b11d8704b342b13c8a7a97a200aa
SHA1 a2908e9713e03c3926e66bf9b25230cd7a999b4f
SHA512 8626bb74565062c89e84f62e64821c41ef68ad425bc2174ea0b33ebd6cad66d5d7f6881e86f6834cd77704492cba5d1fbe1bfe211c203d70acaaebe292884606
SSDEEP 98304:13MniGRcsVJqCmB5RMiCwDIS4TBrppUy1u7MH:uR3JqlMiCwM
TLSH
T14CF56C06F3A350ECC967C138826BA372BA32B86452347F6F2658CB741F71F50666DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4656	winws.exe
2312	WinDivert64.sys

Loads dropped DLL 2 IoCs

pid	Process
4656	winws.exe
4656	winws.exe

Runs net.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
816	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	4656	winws.exe
Token: SeBackupPrivilege	4656	winws.exe
Token: SeDebugPrivilege	4656	winws.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 464	5060	ultradpi.exe	90
PID 464 wrote to memory of 4468	464	net.exe	91
PID 5060 wrote to memory of 4656	5060	ultradpi.exe	92

C:\Users\Admin\AppData\Local\Temp\ultradpi.exe
"C:\Users\Admin\AppData\Local\Temp\ultradpi.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Windows\system32\net.exe
  "net" session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4468
- C:\Users\Admin\AppData\Local\Temp\ultradpi_core\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\ultradpi_core\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,25200-25300 --wf-udp=443,19294-19344,50000-65535 --filter-udp=443 --hostlist=C:\Users\Admin\AppData\Local\Temp\ultradpi_core\lists\list-general.txt --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic=C:\Users\Admin\AppData\Local\Temp\ultradpi_core\quic_initial_www_google_com.bin --new --filter-udp=19294-19344,50000-65535 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord=C:\Users\Admin\AppData\Local\Temp\ultradpi_core\quic_initial_dbankcloud_ru.bin --dpi-desync-fake-stun=C:\Users\Admin\AppData\Local\Temp\ultradpi_core\quic_initial_dbankcloud_ru.bin --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,multidisorder --dpi-desync-split-pos=1,midsld --dpi-desync-repeats=11 --dpi-desync-fooling=badseq --dpi-desync-fake-tls=0x00000000 --dpi-desync-fake-tls=! --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --new --filter-tcp=443 --hostlist=C:\Users\Admin\AppData\Local\Temp\ultradpi_core\lists\list-google.txt --ip-id=zero --dpi-desync=fake,multidisorder --dpi-desync-split-pos=1,midsld --dpi-desync-repeats=11 --dpi-desync-fooling=badseq --dpi-desync-fake-tls=0x00000000 --dpi-desync-fake-tls=! --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --new --filter-tcp=80,443 --hostlist=C:\Users\Admin\AppData\Local\Temp\ultradpi_core\lists\list-general.txt --dpi-desync=fake,multidisorder --dpi-desync-split-pos=1,midsld --dpi-desync-repeats=11 --dpi-desync-fooling=badseq --dpi-desync-fake-tls=0x00000000 --dpi-desync-fake-tls=! --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http=C:\Users\Admin\AppData\Local\Temp\ultradpi_core\tls_clienthello_max_ru.bin --new --filter-tcp=80,443,8443,25200-25300 --dpi-desync=fake,multidisorder --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-split-pos=1,midsld --dpi-desync-repeats=11 --dpi-desync-fooling=badseq --dpi-desync-fake-tls=0x00000000 --dpi-desync-fake-tls=! --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http=C:\Users\Admin\AppData\Local\Temp\ultradpi_core\tls_clienthello_max_ru.bin --new --filter-udp=50000-65535,25200-25300 --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp=C:\Users\Admin\AppData\Local\Temp\ultradpi_core\quic_initial_dbankcloud_ru.bin --dpi-desync-cutoff=n2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:4656

C:\Users\Admin\AppData\Local\Temp\ultradpi_core\WinDivert64.sys
C:\Users\Admin\AppData\Local\Temp\ultradpi_core\WinDivert64.sys
1⤵
- Executes dropped EXE
PID:2312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

WinDivert.dll

Path C:\Users\Admin\AppData\Local\Temp\ultradpi_core\WinDivert.dll
Size 46KB
SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
MD5 b2014d33ee645112d5dc16fe9d9fcbff
SHA1 aa69498562d350f2de06954b133e59fac1e57002
SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
TLSH
T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinDivert64.sys

Path C:\Users\Admin\AppData\Local\Temp\ultradpi_core\WinDivert64.sys
Size 91KB
SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
MD5 89ed5be7ea83c01d0de33d3519944aa5
SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
TLSH
T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cygwin1.dll

Path C:\Users\Admin\AppData\Local\Temp\ultradpi_core\cygwin1.dll
Size 2.8MB
SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
MD5 a1c82ed072dc079dd7851f82d9aa7678
SHA1 52f26fa1aee39476f1c13438aec8bf969c78da45
SHA512 22993e7cee1e7aa69ffe45adf3a329abced7e53d54ffea96dab42fe273c81522252c7b7e98e5af36d2fdec0346c51540e977c6e56b8c08835bac86fa6d04ca59
SSDEEP 49152:hGniafRcs02/oSqCmB5RMiCwDjUZQjuhKv+TLRlURxKc+tKaZrpu8dhcy1u7MHz:YniGRcsVJqCmB5RMiCwDIS4TBrppUy1J
TLSH
T165D55C1BF3A350ECC967C138466BA372BA32B82441347F6E2958CB701F72F51666DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

list-general.txt

Path C:\Users\Admin\AppData\Local\Temp\ultradpi_core\lists\list-general.txt
Size 852B
SHA256 9c170acdf7cf3c5dc51bf408c62cea1b630ddc6ccb25ca12f8590e241f454725
MD5 acab4b639ca57188ee6f2242b3cf6144
SHA1 e9d29b9d58e0a6c214c6d5f568a37dea2b0e7429
SHA512 e51998f8861db35f704a603525bf0925a23733886317e98ae916adc9f2544ed1c5988e2ec486465d1e3eb4793c18f1f0eae5b70856e50a33cd0058e3363d4ca1
TLSH
T16C010053A4A8A761271600F8599423A0239454D0044FF6E3AAAFB19F01097FFB390EB7
MD5 SHA1 SHA512 TLSH

Submit Download

list-google.txt

Path C:\Users\Admin\AppData\Local\Temp\ultradpi_core\lists\list-google.txt
Size 394B
SHA256 2ba93d814dca7b55e69ab88b33ba36b6e9930596af2add4fa2fdb98ba0cac7f4
MD5 6bded7260b91a272494ca95bb6f6461c
SHA1 86efa4aee9cf93a9b357416554eacd665bdd7c57
SHA512 07468f331db4e9a338d41422010b4e19072658863ed1947eff67e9372484cab9610d6371dbaa4025262099621d8bf8fd59c771ea540cb18f6479b7b378752093
TLSH
T1D9E01A83780A918B9202ECB858C0654D77209F05869DFAF4D972F02A60ADB563441CF2
MD5 SHA1 SHA512 TLSH

Submit Download

quic_initial_dbankcloud_ru.bin

Path C:\Users\Admin\AppData\Local\Temp\ultradpi_core\quic_initial_dbankcloud_ru.bin
Size 1KB
SHA256 f7a1c1cffc8f65bd47412b7ca5588653d21eec916bb79203c9914890a62874df
MD5 5e594564fd03d52d6257356dcd25909e
SHA1 f6d8770f529cf1a902ff127e3ada2ade2a205e4e
SHA512 c64e87c746cd7d5a3f135ac5a2a09f01adee313ec8f25691fb3cfc477f7fc02b1de41e9fb18bfdaf150777370c419913511d7ac99c5ef6642b97129626e99e3b
TLSH
T109212675B24108D4F045B3B07F8B31BCF47C4AED5D51C170825C8395F8060187715375
MD5 SHA1 SHA512 TLSH

Submit Download

quic_initial_www_google_com.bin

Path C:\Users\Admin\AppData\Local\Temp\ultradpi_core\quic_initial_www_google_com.bin
Size 1KB
SHA256 f4589c57749f956bb30538197a521d7005f8b0a8723b4707e72405e51ddac50a
MD5 312526d39958d89b1f8ab67789ab985f
SHA1 49a06ceebb13807faaf2a935a716127faff9864d
SHA512 472e88fdd60f9c67f784514a6b699bbefac257657f53a9682a864c0ced474b33f89cf14eb112226ebc9b2c6b07a8f2ec9b25010ccdf98c13370c5c9c6dc2b893
TLSH
T16C21E766D88023896108F64536222E5009B3A4471621258F07292781C83EFEEC1EC0C6
MD5 SHA1 SHA512 TLSH

Submit Download

tls_clienthello_max_ru.bin

Path C:\Users\Admin\AppData\Local\Temp\ultradpi_core\tls_clienthello_max_ru.bin
Size 664B
SHA256 4ee0870abe0a0128600b0095189987ba1d210dae8bf963bc725aff49cf922624
MD5 b2b3e684ce449b60f0bc5a9028221a08
SHA1 32538a43ec8502f0146cd59456646bce7aedd29c
SHA512 19963986a6c0f7265456aeaa4622fd4f8061dc81d1b722fb62f61574f6d96e4b55cfcd256dcfc555bec11ae458ddebb943de25dc1df102dafe99a2b4174b5b38
TLSH
T1CF0128771655D117A54D1F1650E150418585EF447302C7EF3B74D974CAD68C34E75345
MD5 SHA1 SHA512 TLSH

Submit Download

winws.exe

Path C:\Users\Admin\AppData\Local\Temp\ultradpi_core\winws.exe
Size 199KB
SHA256 affb4f69d2ea302a7abccd5325d81826e140ddae014f1e070bc4a6c0dd555188
MD5 d498e19bc7a79dd1efcb6b928cbe9909
SHA1 e660246d9b5de531d8c6ed563919d2690f47d209
SHA512 03fa6ccc762999e4b5e3c7ed4f4a269d5e7114af52c833842f94fcbca19c3b2edd3c218df247d7616a54d25262f2dc14762a958c620433589ac3c1efa14b379a
SSDEEP 3072:llblEpda/1ZqNUckRoAHzGDIAaSLECf6CuWhs/JSDxIcdDFth2zp:l/TY5czliX5mhYIcdptyp
TLSH
T145145B17F39588F9C462C17896AB5333E932FC452134FA4B9FA4DB212F65E10B12E798
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4656-24-0x00007FFA376E0000-0x00007FFA379E2000-memory.dmp

Download

memory/4656-22-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/4656-21-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/4656-15-0x00007FFA376E0000-0x00007FFA379E2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads