Overview

overview

8

Static

static

3

dropper_clean.exe

windows10-2004-x64

8

dropper_clean.exe

windows11-ltsc_2024-x64

8

Resubmissions

29/10/2026, 17:35

261029-v551na1wdv8

29/10/2026, 17:32

261029-v4kckadt6w8

29/10/2026, 17:11

261029-vqdmvsds8s8

Analysis

  • max time kernel
    777s
  • max time network
    440s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/10/2026, 17:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    dropper_clean.exe
  • Size 18KB
  • Sample261029-vqdmvsds8s
  • SHA256 32972ff3a1f98ca5672e44c127650b53be4bd819f4fb420077da6ace5325b74a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
persistence

Malware Config

Signatures

  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Executes dropped EXE 2 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dropper_clean.exe
    "C:\Users\Admin\AppData\Local\Temp\dropper_clean.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2928
    • C:\Users\Admin\AppData\Local\Temp\sys_upd.exe
      "C:\Users\Admin\AppData\Local\Temp\sys_upd.exe" -chain -item "4|HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" -item "4|HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" -trigger now
      2⤵
      • Sets service image path in registry
      • Executes dropped EXE
      • NTFS ADS
      • Suspicious behavior: LoadsDriver
      • Suspicious use of AdjustPrivilegeToken
      PID:6004
    • C:\Users\Admin\AppData\Local\Temp\sys_task.exe
      "C:\Users\Admin\AppData\Local\Temp\sys_task.exe" -k MsMpEng.exe
      2⤵
      • Executes dropped EXE
      PID:1516
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:2736
    • C:\Windows\System32\SecurityHealthHost.exe
      \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
      1⤵
        PID:3752

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            sys_task.exe
            • Path C:\Users\Admin\AppData\Local\Temp\sys_task.exe
            • Size 202KB
            • SHA256 91717c637a4197d965f00404e3b354a9363d560ede5ceaff50b62bbfa11e5bfe
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sys_upd.exe
            • Path C:\Users\Admin\AppData\Local\Temp\sys_upd.exe
            • Size 382KB
            • SHA256 a1fd881b1f4deb168570f8d86cde628ae683390feaa817e1286d0d4404e61bfe
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/2928-10-0x0000024A36040000-0x0000024A367EC000-memory.dmp
            Download