Executive Overview — What We’re Dealing With

This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.

Extended Dwell Time Impact

For 17+ hours, this malware remained undetected — a half-day window that permitted the adversary to complete initial execution, establish basic persistence, and perform initial system enumeration.

Global Detection Posture — Who Caught It, Who Missed It

VirusTotal engines: 73. Detected as malicious: 61. Missed: 12. Coverage: 83.6%.

Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.

Behavioral Storyline — How the Malware Operates

Dominant system-level operations (52.74% of behavior) suggest this malware performs deep system reconnaissance, privilege escalation, or core OS manipulation. It’s actively probing system defenses and attempting to gain administrative control.

MITRE ATT&CK Mapping

• T1012 – query or enumerate registry value
• T1113 – capture screenshot
• T1083 – get common file path
• T1083 – check if file exists
• T1140 – decode data using Base64 in .NET
• T1082 – get OS version in .NET
• T1082 – get hostname
• T1213 – reference WMI statements
• T1070.004 – self delete
• T1056.001 – log keystrokes
• T1105 – download and write a file
• T1082 – get disk size
• T1047 – access WMI data in .NET
• T1620 – invoke .NET assembly method
• T1560.002 – compress data using GZip in .NET
• T1112 – delete registry key
• T1082 – get number of processors
• T1056.001 – log keystrokes via polling
• T1057 – find process by PID
• T1614.001 – get keyboard layout
• T1033 – get session integrity level
• T1027 – encode data using Base64
• T1057 – enumerate processes
• T1518 – enumerate processes
• T1620 – load .NET assembly
• T1033 – get session user name
• T1087 – get session user name
• T1082 – An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
• T1071 – Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic.
• T1568 – Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations.
• T1106 – Adversaries may interact with the native OS application programming interface (API) to execute behaviors.
• T1055 – Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges.
• T1056.001 – Monitors keyboard input
• T1056.004 – Monitors keyboard input
• T1057 – Enumerates running processes
• T1071.004 – Performs DNS request
• T1082 – Enumerates running processes
• T1134 – Enables process privileges
• T1568 – Performs DNS request for known DDNS domain
• T1129 – The process attempted to dynamically load a malicious function
• T1129 – The process tried to load dynamically one or more functions.
• T1057 – The process has tried to detect the debugger probing the use of page guards.
• T1082 – get OS version in .NET
• T1033 – get session integrity level
• T1082 – get hostname
• T1047 – access WMI data in .NET
• T1213 – reference WMI statements
• T1140 – decode data using Base64 in .NET
• T1083 – get common file path
• T1113 – capture screenshot
• T1105 – download and write a file
• T1112 – delete registry key
• T1027 – encode data using Base64
• T1620 – load .NET assembly
• T1083 – check if file exists
• T1056.001 – log keystrokes via polling
• T1056.001 – log keystrokes
• T1614.001 – get keyboard layout
• T1057 – find process by PID
• T1082 – get number of processors
• T1082 – get disk size
• T1012 – query or enumerate registry value
• T1560.002 – compress data using GZip in .NET
• T1057 – The process attempted to detect a running debugger using common APIs
• T1056 – The process behaves as a keylogger (keyboard capturing detected)
• T1179 – The process behaves as a keylogger (keyboard capturing detected)
• T1082 – Queries for the computername
• T1082 – The process tried to collect informations about the system reading some known registry keys
• T1012 – The process tried to collect informations about the system reading some known registry keys
• T1033 – get session user name
• T1087 – get session user name
• T1057 – enumerate processes
• T1518 – enumerate processes
• T1574.002 – Tries to load missing DLLs
• T1497 – Allocates memory with a write watch (potentially for evading sandboxes)
• T1497 – May sleep (evasive loops) to hinder dynamic analysis
• T1562.001 – Creates guard pages, often used to prevent reverse engineering and debugging
• T1140 – .NET source code contains calls to encryption/decryption functions
• T1027.002 – .NET source code contains method to dynamically call methods (often used by packers)
• T1027.002 – .NET source code contains potential unpacker
• T1518.001 – May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)
• T1057 – Queries a list of all running processes
• T1010 – Sample monitors Window changes (e.g. starting applications), analyze the sample with the simulation cookbook
• T1018 – Reads the hosts file
• T1082 – Queries the cryptographic machine GUID
• T1082 – Reads software policies
• T1082 – Queries the volume information (name, serial number etc) of a device
• T1082 – Checks the free space of harddrives
• T1560 – .NET source code contains calls to encryption/decryption functions
• T1571 – Detected TCP or UDP traffic on non-standard ports
• T1095 – Performs DNS lookups
• T1071 – Performs DNS lookups
• T1071 – C2 URLs / IPs found in malware configuration
• T1071 – Uses dynamic DNS services

Following the Trail — Network & DNS Activity

Outbound activity leans on reputable infrastructure (e.g., CDNs, cloud endpoints) to blend in. TLS sessions and
HTTP calls show routine beaconing and IP‑lookup behavior that can masquerade as normal browsing.

Hunting tip: alert on unknown binaries initiating TLS to IP‑lookup services or unusual CDN endpoints — especially early in execution.