Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
03/11/2026, 12:14
General
- Target client_n2rIKRZIbJfnYfFlM7YHPFcfYRJ2.exe
- Size 3.2MB
- Sample261103-pegbqahs9t
- SHA256 0299967697ccf07dce963fe375c2dc139a4d49f1ddfe5899aded270f9b434074
Malware Config
Signatures
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in Program Files directory 1 IoCs
- Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\client_n2rIKRZIbJfnYfFlM7YHPFcfYRJ2.exe"C:\Users\Admin\AppData\Local\Temp\client_n2rIKRZIbJfnYfFlM7YHPFcfYRJ2.exe"1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5652-1-0x00000000009D0000-0x0000000000A97000-memory.dmp
memory/5652-2-0x0000000000C00000-0x0000000000FA1000-memory.dmp
memory/5652-5-0x0000000001090000-0x00000000010BA000-memory.dmp
memory/5652-4-0x0000000001350000-0x0000000001513000-memory.dmp
memory/5652-3-0x00000000012D0000-0x0000000001344000-memory.dmp
memory/5652-6-0x0000000001580000-0x0000000001632000-memory.dmp
memory/5652-8-0x0000000001D40000-0x0000000001ED9000-memory.dmp
memory/5652-9-0x0000000001EE0000-0x0000000001FB6000-memory.dmp
memory/5652-7-0x0000000001640000-0x0000000001D36000-memory.dmp
memory/5652-10-0x0000000001FC0000-0x000000000201D000-memory.dmp
memory/5652-12-0x00000000021A0000-0x000000000221A000-memory.dmp
memory/5652-11-0x0000000002020000-0x0000000002196000-memory.dmp
memory/5652-15-0x00000000024F0000-0x00000000024FD000-memory.dmp
memory/5652-14-0x00000000024C0000-0x00000000024E6000-memory.dmp
memory/5652-13-0x0000000002220000-0x00000000024B0000-memory.dmp
memory/5652-17-0x0000000002750000-0x000000000275B000-memory.dmp
memory/5652-18-0x0000000002760000-0x000000000292A000-memory.dmp
memory/5652-21-0x0000000002A80000-0x0000000002BA1000-memory.dmp
memory/5652-25-0x0000000002DC0000-0x0000000002F0B000-memory.dmp
memory/5652-28-0x00000000032E0000-0x0000000003319000-memory.dmp
memory/5652-31-0x0000000004B90000-0x0000000004BAA000-memory.dmp
memory/5652-33-0x0000000004D30000-0x0000000004DDD000-memory.dmp
memory/5652-32-0x0000000004C90000-0x0000000004D29000-memory.dmp
memory/5652-26-0x0000000002F10000-0x000000000328C000-memory.dmp
memory/5652-38-0x00000000069E0000-0x0000000006A48000-memory.dmp
memory/5652-46-0x00000000069C0000-0x00000000069CC000-memory.dmp
memory/5652-51-0x000000000DA90000-0x000000000DB3C000-memory.dmp
memory/5652-54-0x000000000E6C0000-0x000000000E9A3000-memory.dmp
memory/5652-59-0x00000000062E0000-0x000000000650A000-memory.dmp
memory/5652-58-0x000000000EFD0000-0x000000000EFFD000-memory.dmp
memory/5652-34-0x0000000004F30000-0x000000000575A000-memory.dmp
memory/5652-57-0x000000000EF80000-0x000000000EFBF000-memory.dmp
memory/5652-56-0x000000000EF40000-0x000000000EF70000-memory.dmp
memory/5652-55-0x000000000E9B0000-0x000000000EB18000-memory.dmp
memory/5652-53-0x000000000DD90000-0x000000000DEB5000-memory.dmp
memory/5652-52-0x000000000DB40000-0x000000000DC84000-memory.dmp
memory/5652-50-0x000000000B4B0000-0x000000000B4BD000-memory.dmp
memory/5652-49-0x0000000006B80000-0x0000000006BA7000-memory.dmp
memory/5652-48-0x0000000007BE0000-0x0000000007CA4000-memory.dmp
memory/5652-47-0x0000000006B50000-0x0000000006B70000-memory.dmp
memory/5652-45-0x0000000006980000-0x00000000069B8000-memory.dmp
memory/5652-43-0x0000000006750000-0x00000000068A9000-memory.dmp
memory/5652-44-0x00000000068B0000-0x00000000068CC000-memory.dmp
memory/5652-42-0x0000000004F00000-0x0000000004F0B000-memory.dmp
memory/5652-41-0x0000000004EF0000-0x0000000004EFA000-memory.dmp
memory/5652-40-0x0000000006710000-0x0000000006742000-memory.dmp
memory/5652-39-0x00000000065E0000-0x0000000006700000-memory.dmp
memory/5652-36-0x0000000005CB0000-0x0000000005D58000-memory.dmp
memory/5652-37-0x0000000004EC0000-0x0000000004EDD000-memory.dmp
memory/5652-35-0x0000000004DE0000-0x0000000004EB3000-memory.dmp
memory/5652-27-0x0000000003290000-0x00000000032D8000-memory.dmp
memory/5652-30-0x0000000004B70000-0x0000000004B83000-memory.dmp
memory/5652-29-0x0000000003530000-0x000000000355F000-memory.dmp
memory/5652-19-0x0000000002930000-0x0000000002A46000-memory.dmp
memory/5652-24-0x0000000002D10000-0x0000000002DB3000-memory.dmp
memory/5652-22-0x0000000002BB0000-0x0000000002C59000-memory.dmp
memory/5652-23-0x0000000002C60000-0x0000000002D07000-memory.dmp
memory/5652-20-0x0000000002A50000-0x0000000002A77000-memory.dmp
memory/5652-16-0x0000000002500000-0x0000000002741000-memory.dmp