f89f63bf4ab4b6cc6259a242b9d2b064925b8c9ff3bf6d7c933c9da9dd5c425e

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wraith_ikhvapokav.exe
Size 3.5MB
Sample261107-txe9lads4v
SHA256 f89f63bf4ab4b6cc6259a242b9d2b064925b8c9ff3bf6d7c933c9da9dd5c425e
MD5 6fc714908e1aa5c3fbb66d1ef381ad4e
SHA1 38c28cfb544473d938885bf803568c20ba42031b
SHA512 e2236e9f7e973c36f5ba5c5377f9f03122e0c8a2e2882c872622ea3665db430b9a753d346ab1658d5905ed4ef5c6d71179fe05304786ae3993dcdc382553cbab
SSDEEP 49152:cPkhgKEBl4HtB9adpLjQCYuvK5AOY8d06y83dSVIk2L39KVBtw2dSJgHY7vMHPSG:VeuvBdS6k4OdMgHpH1Gn+7
TLSH
T199069E43FAA581E8C09EC178C7179233EB72BC8D5A20A79B27D45A113F63B625F9D314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Looks for VirtualBox drivers on disk 2 TTPs 1 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	wraith_ikhvapokav.exe

Looks for VMWare drivers on disk 2 TTPs 3 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	wraith_ikhvapokav.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	wraith_ikhvapokav.exe
File opened (read-only)	C:\Windows\System32\drivers\vmusbmouse.sys	wraith_ikhvapokav.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wraith_ikhvapokav.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4900	wraith_ikhvapokav.exe
4900	wraith_ikhvapokav.exe

C:\Users\Admin\AppData\Local\Temp\wraith_ikhvapokav.exe
"C:\Users\Admin\AppData\Local\Temp\wraith_ikhvapokav.exe"
1⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

File and Directory Discovery

T1083

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads