Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
08/11/2026, 03:27
General
- Target 4249af3e97272e1facb33c9dd700adceaa518656946d9056ebb1277364b9363a.exe
- Size 1.5MB
- Sample261108-dz7hvsxtcv
- SHA256 4249af3e97272e1facb33c9dd700adceaa518656946d9056ebb1277364b9363a
Malware Config
Signatures
- UAC bypass 3 TTPs 4 IoCs
- Downloads MZ/PE file 12 IoCs
- Executes dropped EXE 5 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 13 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- UPX packed file 14 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 3 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 27 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- System policy modification 1 TTPs 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4249af3e97272e1facb33c9dd700adceaa518656946d9056ebb1277364b9363a.exe"C:\Users\Admin\AppData\Local\Temp\4249af3e97272e1facb33c9dd700adceaa518656946d9056ebb1277364b9363a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4249af3e97272e1facb33c9dd700adceaa518656946d9056ebb1277364b9363a.exe"C:\Users\Admin\AppData\Local\Temp\4249af3e97272e1facb33c9dd700adceaa518656946d9056ebb1277364b9363a.exe"2⤵
-
-
C:\Windows\SYSTEM32\citool.exe"citool.exe" -r2⤵
-
-
C:\ProgramData\Virtual_Windows\WinComboExt.exe"C:\ProgramData\Virtual_Windows\WinComboExt.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\ProgramData\Virtual_Windows\WinComboExt.exe"C:\ProgramData\Virtual_Windows\WinComboExt.exe"3⤵
- Executes dropped EXE
-
-
-
C:\ProgramData\Virtual_Windows\Security_Module.datC:\ProgramData\Virtual_Windows\Security_Module.dat1⤵
- Executes dropped EXE
-
C:\ProgramData\Virtual_Windows\WinComboExt.exe"C:\ProgramData\Virtual_Windows\WinComboExt.exe"1⤵
- UAC bypass
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\ProgramData\Virtual_Windows\WinComboExt.exe"C:\ProgramData\Virtual_Windows\WinComboExt.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
2D8C92D0.dat
692FE6C1.exe
692FE6C1.vbs
goufu.txt
libluajit.dll
vcruntime140.dll
Security_Module.dat
WinComboExt.exe
h_x64_4B02AE74F25A4AEB8C8938E23759EC10_0.dat
s_x64_4B02AE74F25A4AEB8C8938E23759EC10_0.dat
memory/992-2-0x0000000140000000-0x000000014002C000-memory.dmp
memory/992-0-0x0000000140000000-0x000000014002C000-memory.dmp
memory/992-1-0x0000000140000000-0x000000014002C000-memory.dmp
memory/992-5-0x000002B88E2E0000-0x000002B88E305000-memory.dmp
memory/992-3-0x0000000140000000-0x000000014002C000-memory.dmp
memory/992-6-0x000002B88FDF0000-0x000002B88FDF1000-memory.dmp
memory/992-7-0x0000000140000000-0x000000014002C000-memory.dmp
memory/992-4-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4336-25-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4336-24-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4336-23-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4336-22-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4824-113-0x000001D1CA640000-0x000001D1CA6DE000-memory.dmp
memory/4824-124-0x000001D1CA6E0000-0x000001D1CA73C000-memory.dmp
memory/4824-59-0x000001D1CA640000-0x000001D1CA6DE000-memory.dmp
memory/4824-66-0x000001D1CA640000-0x000001D1CA6DE000-memory.dmp
memory/4824-65-0x000001D1CA640000-0x000001D1CA6DE000-memory.dmp
memory/4824-116-0x000001D1CA640000-0x000001D1CA6DE000-memory.dmp
memory/4824-112-0x000001D1CA640000-0x000001D1CA6DE000-memory.dmp
memory/4824-64-0x000001D1CA640000-0x000001D1CA6DE000-memory.dmp
memory/4824-131-0x000001D1CA6E0000-0x000001D1CA73C000-memory.dmp
memory/4824-132-0x000001D1CA6E0000-0x000001D1CA73C000-memory.dmp
memory/4824-133-0x000001D1CA6E0000-0x000001D1CA73C000-memory.dmp
memory/4824-134-0x000001D1CA6E0000-0x000001D1CA73C000-memory.dmp
memory/4824-130-0x000001D1CA6E0000-0x000001D1CA73C000-memory.dmp
memory/4824-129-0x000001D1CA6E0000-0x000001D1CA73C000-memory.dmp
memory/4824-126-0x000001D1CA6E0000-0x000001D1CA73C000-memory.dmp
memory/4824-43-0x000001D1CA640000-0x000001D1CA6DE000-memory.dmp
memory/4824-117-0x000001D1CA6E0000-0x000001D1CA73C000-memory.dmp
memory/4824-52-0x00007FFD6BFC0000-0x00007FFD6C223000-memory.dmp
memory/4824-123-0x00007FFD6BFC0000-0x00007FFD6C223000-memory.dmp
memory/4824-125-0x000001D1CA6E0000-0x000001D1CA73C000-memory.dmp
memory/4824-127-0x000001D1CA6E0000-0x000001D1CA73C000-memory.dmp
memory/4824-29-0x0000000180000000-0x000000018003A000-memory.dmp
memory/4824-63-0x000001D1CA640000-0x000001D1CA6DE000-memory.dmp
memory/4824-62-0x000001D1CA640000-0x000001D1CA6DE000-memory.dmp
memory/4824-61-0x000001D1CA640000-0x000001D1CA6DE000-memory.dmp
memory/4824-60-0x000001D1CA640000-0x000001D1CA6DE000-memory.dmp
memory/4824-58-0x000001D1CA640000-0x000001D1CA6DE000-memory.dmp
memory/4824-57-0x000001D1CA640000-0x000001D1CA6DE000-memory.dmp
memory/4824-56-0x000001D1CA640000-0x000001D1CA6DE000-memory.dmp
memory/4824-55-0x000001D1CA640000-0x000001D1CA6DE000-memory.dmp
memory/4824-54-0x000001D1CA640000-0x000001D1CA6DE000-memory.dmp
memory/4824-53-0x000001D1CA640000-0x000001D1CA6DE000-memory.dmp
memory/4824-40-0x00007FFD2C030000-0x00007FFD2C040000-memory.dmp
memory/4936-99-0x000001F8E3200000-0x000001F8E329E000-memory.dmp
memory/4936-115-0x00007FFD6BFC0000-0x00007FFD6C223000-memory.dmp
memory/4936-114-0x000001F8E3200000-0x000001F8E329E000-memory.dmp
memory/4936-85-0x000001F8E3200000-0x000001F8E329E000-memory.dmp
memory/4936-95-0x000001F8E3200000-0x000001F8E329E000-memory.dmp
memory/4936-96-0x000001F8E3200000-0x000001F8E329E000-memory.dmp
memory/4936-97-0x000001F8E3200000-0x000001F8E329E000-memory.dmp
memory/4936-98-0x000001F8E3200000-0x000001F8E329E000-memory.dmp
memory/4936-101-0x000001F8E3200000-0x000001F8E329E000-memory.dmp
memory/4936-102-0x000001F8E3200000-0x000001F8E329E000-memory.dmp
memory/4936-103-0x000001F8E3200000-0x000001F8E329E000-memory.dmp
memory/4936-104-0x000001F8E3200000-0x000001F8E329E000-memory.dmp
memory/4936-107-0x000001F8E3200000-0x000001F8E329E000-memory.dmp
memory/4936-106-0x000001F8E3200000-0x000001F8E329E000-memory.dmp
memory/4936-100-0x000001F8E3200000-0x000001F8E329E000-memory.dmp
memory/4936-105-0x000001F8E3200000-0x000001F8E329E000-memory.dmp
memory/4936-108-0x000001F8E3200000-0x000001F8E329E000-memory.dmp
memory/4936-94-0x00007FFD6BFC0000-0x00007FFD6C223000-memory.dmp
memory/5964-12-0x0000000140000000-0x000000014002C000-memory.dmp
memory/5964-13-0x0000000140000000-0x000000014002C000-memory.dmp
memory/5964-14-0x0000000140000000-0x000000014002C000-memory.dmp
memory/5964-15-0x0000000140000000-0x000000014002C000-memory.dmp