Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/11/2026, 19:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VixenCleanerV3.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
VixenCleanerV3.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target VixenCleanerV3.exe
- Size 1.1MB
- Sample261104-ynbl9sft8l
- SHA256 f514040f57487de6eb6a06d42f860ceacc63b43fea4433313b478df1ca5892ba
- MD5 c65c4fe88aad8013b04af1b781eaed01
- SHA1 b1b639f44c7ad1aa7e56be9f95bd0cede6e0fe14
- SHA512 b3e817c83247cc4d12d2acf027f673daa9269f720026b8eb4295ccbe5cafd7bda33003caa7a0f723cc58bb285f811f64f934044cb16733ca9878539ef654fcef
- SSDEEP 12288:fK0jHoKBnXQ+ckNS8liXV57kIU5x4znRulqfa+JHnr6l52Al:fjHxN5QY4znRulqfBJHne7
- TLSH T17C356B0AB7A902E5D077D0B9C9925A19FAB1789A4330A7C747E09B5B1F277F05E3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Manipulates Digital Signatures 1 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File opened for modification C:\Windows\System32\wintrust.dll VixenCleanerV3.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 VixenCleanerV3.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\appidcertstorecheck.exe VixenCleanerV3.exe File opened for modification C:\Windows\System32\bridgeres.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\C_1253.NLS VixenCleanerV3.exe File opened for modification C:\Windows\System32\gpscript.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\inetcpl.cpl VixenCleanerV3.exe File opened for modification C:\Windows\System32\rgb9rast.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\InputController.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\KBDSORS1.DLL VixenCleanerV3.exe File opened for modification C:\Windows\System32\webcheck.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\wlgpclnt.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\@WindowsUpdateToastIcon.contrast-white.png VixenCleanerV3.exe File opened for modification C:\Windows\System32\CloudExperienceHostRedirection.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\C_20833.NLS VixenCleanerV3.exe File opened for modification C:\Windows\System32\lpk.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\shellstyle.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\Windows.UI.NetworkUXController.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\wintrust.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\coredpussvr.exe VixenCleanerV3.exe File opened for modification C:\Windows\System32\DafGip.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\kd_02_1af4.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\Windows.UI.FileExplorer.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\ddodiag.exe VixenCleanerV3.exe File opened for modification C:\Windows\System32\dsrole.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\mfsvr.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\upnpcont.exe VixenCleanerV3.exe File opened for modification C:\Windows\System32\urlmon.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\LockScreenContentServer.exe VixenCleanerV3.exe File opened for modification C:\Windows\System32\SettingsHandlers_BackgroundApps.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\dbgeng.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\fsutilext.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\ipnathlp.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\NgcCtnrGidsHandler.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\NetEvtFwdr.exe VixenCleanerV3.exe File opened for modification C:\Windows\System32\xwtpdui.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\mcupdate_GenuineIntel.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\settings.dat VixenCleanerV3.exe File opened for modification C:\Windows\System32\CompMgmtLauncher.exe VixenCleanerV3.exe File opened for modification C:\Windows\System32\mfperfhelper.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\RMSRoamingSecurity.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\CertEnrollUI.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\certmgr.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\dafWCN.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\NetHost.exe VixenCleanerV3.exe File opened for modification C:\Windows\System32\riched32.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\bdesvc.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\CoreUIComponents.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\ETWCoreUIComponentsResources.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\keepaliveprovider.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\msafd.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\NDKPerfCmd.exe VixenCleanerV3.exe File opened for modification C:\Windows\System32\scrnsave.scr VixenCleanerV3.exe File opened for modification C:\Windows\System32\SortWindows63.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\Windows.UI.Xaml.Resources.rs3.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\naw-wo.exe VixenCleanerV3.exe File opened for modification C:\Windows\System32\opengl32.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\pautoenr.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\smartscreen.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\@VpnToastIcon.png VixenCleanerV3.exe File opened for modification C:\Windows\System32\bopomofo.uce VixenCleanerV3.exe File opened for modification C:\Windows\System32\ContactHarvesterDS.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\elshyph.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\KBDHE220.DLL VixenCleanerV3.exe File opened for modification C:\Windows\System32\mimofcodec.dll VixenCleanerV3.exe File opened for modification C:\Windows\System32\ProximityService.dll VixenCleanerV3.exe - Modifies termsrv.dll 1 TTPs 1 IoCs
Commonly used to allow simultaneous RDP sessions.
description ioc Process File opened for modification C:\Windows\System32\termsrv.dll VixenCleanerV3.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\INF\netvf63a.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\pmem.PNF VixenCleanerV3.exe File opened for modification C:\Windows\INF\acpipagr.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\c_fsreplication.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\c_fssystemrecovery.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\c_linedisplay.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\c_netdriver.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\c_swcomponent.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\digitalmediadevice.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\hidspi_km.PNF VixenCleanerV3.exe File opened for modification C:\Windows\INF\intelpep.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\mdmboca.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\mdmhayes.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\mdmtdk.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\miradisp.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\mshidkmdf.PNF VixenCleanerV3.exe File opened for modification C:\Windows\INF\netrtl64.PNF VixenCleanerV3.exe File opened for modification C:\Windows\INF\netserv.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\mdmtdkj6.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\microsoft_bluetooth_avrcptransport.PNF VixenCleanerV3.exe File opened for modification C:\Windows\INF\netrtwlane01.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\networkprivacypolicy.PNF VixenCleanerV3.exe File opened for modification C:\Windows\INF\usb4p2pnetadapter.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\wvmbushid.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\wvmbusvideo.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\wvmic_vss.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\mdmdcm5.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\mdmgcs.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\mdmpin.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\monitor.PNF VixenCleanerV3.exe File opened for modification C:\Windows\INF\netwtw02.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\PlutonHsp2.PNF VixenCleanerV3.exe File opened for modification C:\Windows\INF\usbhub3.PNF VixenCleanerV3.exe File opened for modification C:\Windows\INF\bthspp.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\ialpss2i_gpio2_glk.PNF VixenCleanerV3.exe File opened for modification C:\Windows\INF\netvwifibus.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\nvmedisk.PNF VixenCleanerV3.exe File opened for modification C:\Windows\INF\spaceport.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\volmgr.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\wnetvsc.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\wpdfs.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\defltrdsh.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\displayoverride.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\netr28x.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\netrtl64.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\swenum.PNF VixenCleanerV3.exe File opened for modification C:\Windows\INF\ucmucsiacpiclient.PNF VixenCleanerV3.exe File opened for modification C:\Windows\INF\wudfrd.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\devmap.PNF VixenCleanerV3.exe File opened for modification C:\Windows\INF\ialpss2i_i2c_skl.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\netl160a.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\virtdisk.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\1394.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\c_battery.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\intelpmax.PNF VixenCleanerV3.exe File opened for modification C:\Windows\INF\microsoft_bluetooth_a2dp.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\acpitime.PNF VixenCleanerV3.exe File opened for modification C:\Windows\INF\cdrom.PNF VixenCleanerV3.exe File opened for modification C:\Windows\INF\itsas35i.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\mdmaiwat.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\msgpiowin32.PNF VixenCleanerV3.exe File opened for modification C:\Windows\INF\netevbd0a.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\c_i3c.inf VixenCleanerV3.exe File opened for modification C:\Windows\INF\mdmsupra.inf VixenCleanerV3.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\NV Hostname = "DESKTOP-0DWLX2G" VixenCleanerV3.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname = "DESKTOP-0DWLX2G" VixenCleanerV3.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2456 VixenCleanerV3.exe 2456 VixenCleanerV3.exe 2456 VixenCleanerV3.exe 2456 VixenCleanerV3.exe 2456 VixenCleanerV3.exe 2456 VixenCleanerV3.exe 2456 VixenCleanerV3.exe 2456 VixenCleanerV3.exe 2456 VixenCleanerV3.exe 2456 VixenCleanerV3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\VixenCleanerV3.exe"C:\Users\Admin\AppData\Local\Temp\VixenCleanerV3.exe"1⤵
- Manipulates Digital Signatures
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Modifies termsrv.dll
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:2456