Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
07/11/2026, 13:46
General
- Target fd84b8da6b82e4d566f293944403a5635cd531ad7b2eeb825b6d99bdfc0a356d.exe
- Size 689KB
- Sample261107-q3engafa92
- SHA256 fd84b8da6b82e4d566f293944403a5635cd531ad7b2eeb825b6d99bdfc0a356d
Malware Config
Signatures
- Downloads MZ/PE file 15 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 16 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd84b8da6b82e4d566f293944403a5635cd531ad7b2eeb825b6d99bdfc0a356d.exe"C:\Users\Admin\AppData\Local\Temp\fd84b8da6b82e4d566f293944403a5635cd531ad7b2eeb825b6d99bdfc0a356d.exe"1⤵
- Downloads MZ/PE file
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fd84b8da6b82e4d566f293944403a5635cd531ad7b2eeb825b6d99bdfc0a356d.exe"C:\Users\Admin\AppData\Local\Temp\fd84b8da6b82e4d566f293944403a5635cd531ad7b2eeb825b6d99bdfc0a356d.exe"2⤵
-
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2D8C92D0.dat
692FE6C1.exe
692FE6C1.vbs
goufu.txt
libluajit.dll
vcruntime140.dll
memory/2760-76-0x000001D92BBD0000-0x000001D92BC2C000-memory.dmp
memory/2760-84-0x000001D929DC0000-0x000001D929EC0000-memory.dmp
memory/2760-36-0x00007FFDF0460000-0x00007FFDF06C3000-memory.dmp
memory/2760-50-0x000001D92BB30000-0x000001D92BBCE000-memory.dmp
memory/2760-49-0x000001D92BB30000-0x000001D92BBCE000-memory.dmp
memory/2760-48-0x000001D92BB30000-0x000001D92BBCE000-memory.dmp
memory/2760-73-0x000001D92BBD0000-0x000001D92BC2C000-memory.dmp
memory/2760-44-0x000001D92BB30000-0x000001D92BBCE000-memory.dmp
memory/2760-43-0x000001D92BB30000-0x000001D92BBCE000-memory.dmp
memory/2760-70-0x000001D92BBD0000-0x000001D92BC2C000-memory.dmp
memory/2760-41-0x000001D92BB30000-0x000001D92BBCE000-memory.dmp
memory/2760-40-0x000001D92BB30000-0x000001D92BBCE000-memory.dmp
memory/2760-39-0x000001D92BB30000-0x000001D92BBCE000-memory.dmp
memory/2760-38-0x000001D92BB30000-0x000001D92BBCE000-memory.dmp
memory/2760-37-0x000001D92BB30000-0x000001D92BBCE000-memory.dmp
memory/2760-27-0x000001D92BB30000-0x000001D92BBCE000-memory.dmp
memory/2760-46-0x000001D92BB30000-0x000001D92BBCE000-memory.dmp
memory/2760-54-0x000001D92BB30000-0x000001D92BBCE000-memory.dmp
memory/2760-55-0x000001D92BB30000-0x000001D92BBCE000-memory.dmp
memory/2760-56-0x000001D92BB30000-0x000001D92BBCE000-memory.dmp
memory/2760-57-0x000001D92BBD0000-0x000001D92BC2C000-memory.dmp
memory/2760-67-0x000001D92BBD0000-0x000001D92BC2C000-memory.dmp
memory/2760-66-0x000001D92BBD0000-0x000001D92BC2C000-memory.dmp
memory/2760-65-0x000001D92BBD0000-0x000001D92BC2C000-memory.dmp
memory/2760-64-0x000001D92BBD0000-0x000001D92BC2C000-memory.dmp
memory/2760-63-0x00007FFDF0460000-0x00007FFDF06C3000-memory.dmp
memory/2760-69-0x000001D92BBD0000-0x000001D92BC2C000-memory.dmp
memory/2760-72-0x000001D92BBD0000-0x000001D92BC2C000-memory.dmp
memory/2760-79-0x000001D92BBD0000-0x000001D92BC2C000-memory.dmp
memory/2760-78-0x000001D92BBD0000-0x000001D92BC2C000-memory.dmp
memory/2760-77-0x000001D92BBD0000-0x000001D92BC2C000-memory.dmp
memory/2760-9-0x000001D929DC0000-0x000001D929EC0000-memory.dmp
memory/2760-75-0x000001D92BBD0000-0x000001D92BC2C000-memory.dmp
memory/2760-74-0x000001D92BBD0000-0x000001D92BC2C000-memory.dmp
memory/2760-47-0x000001D92BB30000-0x000001D92BBCE000-memory.dmp
memory/2760-12-0x0000000180000000-0x000000018003A000-memory.dmp
memory/2760-42-0x000001D92BB30000-0x000001D92BBCE000-memory.dmp
memory/2760-80-0x000001D92BB30000-0x000001D92BBCE000-memory.dmp
memory/2760-81-0x000001D92BB30000-0x000001D92BBCE000-memory.dmp
memory/2760-82-0x000001D92BBD0000-0x000001D92BC2C000-memory.dmp
memory/2760-71-0x000001D92BBD0000-0x000001D92BC2C000-memory.dmp
memory/2760-85-0x000001D92BB30000-0x000001D92BBCE000-memory.dmp
memory/2760-86-0x000001D92BBD0000-0x000001D92BC2C000-memory.dmp
memory/2760-87-0x000001D92BB30000-0x000001D92BBCE000-memory.dmp
memory/2760-88-0x000001D92BB30000-0x000001D92BBCE000-memory.dmp
memory/2760-89-0x000001D92BBD0000-0x000001D92BC2C000-memory.dmp
memory/2760-90-0x000001D92BB30000-0x000001D92BBCE000-memory.dmp
memory/2760-91-0x000001D92BB30000-0x000001D92BBCE000-memory.dmp
memory/2760-92-0x000001D92BBD0000-0x000001D92BC2C000-memory.dmp
memory/2760-100-0x000001D92CF00000-0x000001D92D03D000-memory.dmp
memory/2760-93-0x000001D92CF00000-0x000001D92D03D000-memory.dmp
memory/2760-107-0x000001D92CF00000-0x000001D92D03D000-memory.dmp
memory/2760-106-0x000001D92CF00000-0x000001D92D03D000-memory.dmp
memory/2760-105-0x000001D92CF00000-0x000001D92D03D000-memory.dmp
memory/2760-104-0x000001D92CF00000-0x000001D92D03D000-memory.dmp
memory/2760-103-0x000001D92CF00000-0x000001D92D03D000-memory.dmp
memory/2760-102-0x000001D92CF00000-0x000001D92D03D000-memory.dmp
memory/2760-101-0x000001D92CF00000-0x000001D92D03D000-memory.dmp
memory/2760-99-0x00007FFDF0460000-0x00007FFDF06C3000-memory.dmp
memory/2760-26-0x000001D92BA60000-0x000001D92BB2D000-memory.dmp
memory/2760-23-0x00007FFDB04D0000-0x00007FFDB04E0000-memory.dmp
memory/2760-45-0x000001D92BB30000-0x000001D92BBCE000-memory.dmp
memory/4100-7-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4100-6-0x0000028279CC0000-0x0000028279CC1000-memory.dmp
memory/4100-5-0x0000028279B90000-0x0000028279BB5000-memory.dmp
memory/4100-4-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4100-2-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4100-1-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4100-3-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4100-0-0x0000000140000000-0x000000014002C000-memory.dmp