Executive Overview — What We’re Dealing With

This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.

Extended Dwell Time Impact

For 1+ days, this malware remained undetected — a brief but concerning window that permitted the adversary to establish initial foothold, perform basic system enumeration, and potentially access immediate system resources.

Global Detection Posture — Who Caught It, Who Missed It

VirusTotal engines: 73. Detected as malicious: 63. Missed: 10. Coverage: 86.3%.

Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.

Behavioral Storyline — How the Malware Operates

Intensive file system activity (47.84% of behavior) indicates data harvesting, file encryption, or dropper behavior. The threat is actively searching for and manipulating files across the system.

MITRE ATT&CK Mapping

• T1007 – enumerate services
• T1134 – modify access privileges
• T1614.001 – identify system language via API
• T1027 – reference AES constants
• T1129 – parse PE header
• T1012 – query or enumerate registry value
• T1222 – set file attributes
• T1083 – enumerate files recursively
• T1082 – enumerate disk volumes
• T1083 – get common file path
• T1135 – enumerate network shares
• T1083 – check if file exists
• T1083 – get file size
• T1057 – get process heap flags
• T1027 – encrypt data using AES
• T1027 – encode data using XOR
• T1129 – link function at runtime on Windows
• T1082 – get disk information
• T1057 – enumerate processes
• T1518 – enumerate processes
• T1057 – get process heap force flags
• T1083 – enumerate files on Windows
• T1059 – accept command line arguments
• T1497.001 – reference anti-VM strings targeting VMWare
• T1564.003 – hide graphical window
• T1016 – get socket status
• T1027 – encrypt data using AES via x86 extensions
• T1082 – get disk size
• T1129 – access PEB ldr_data
• T1082 – get system information on Windows
• T1129 – link many functions at runtime
• T1033 – get token membership
• T1016 – get local IPv4 addresses
• T1112 – delete registry value
• T1543.003 – stop service
• T1489 – stop service
• T1129 – get kernel32 base address
• T1007 – query service status
• T1027.005 – contain obfuscated stackstrings
• T1543 – Attempts to stop active services
• T1547 – Installs itself for autorun at Windows startup
• T1543.003 – Attempts to stop active services
• T1547.001 – Installs itself for autorun at Windows startup
• T1539 – Touches a file containing cookies, possibly for information gathering
• T1202 – Uses suspicious command line tools or Windows utilities
• T1202 – Uses Windows utilities for basic functionality
• T1562 – Attempts to stop active services
• T1112 – Installs itself for autorun at Windows startup
• T1070 – Clears Windows events or logs
• T1562.001 – Attempts to stop active services
• T1027 – The binary contains an unknown PE section name indicative of packing
• T1027.002 – The binary contains an unknown PE section name indicative of packing
• T1489 – Attempts to stop active services
• T1486 – Appends a known LockBit ransomware file extension to files that have been encrypted
• T1486 – Exhibits possible ransomware or wiper file modification behavior: mass_file_deletion overwrites_existing_files
• T1486 – Creates a known LockBit ransomware decryption instruction / key file.
• T1485 – Clears Windows events or logs
• T1490 – Modifies boot configuration settings
• T1082 – Checks available memory
• T1057 – Expresses interest in specific running processes
• T1057 – Enumerates running processes
• T1071 – Dynamic (imported) function loading detected
• T1071 – Attempts to connect to a dead IP:Port
• T1071 – The PE file contains an overlay
• T1071 – Likely virus infection of existing binary
• T1071 – Yara detections observed in process dumps, payloads or dropped files
• T1071 – Binary file triggered multiple YARA rules
• T1059 – Modifies boot configuration settings
• T1074 – Manipulates data from or to the Recycle Bin
• T1091 – Checks for available system drives (often done to infect USB drives)
• T1547.001 – Creates an autostart registry key pointing to binary in C:\Windows
• T1547.001 – Creates an autostart registry key
• T1497 – May sleep (evasive loops) to hinder dynamic analysis
• T1070.004 – May delete shadow drive data (may be related to ransomware)
• T1135 – Connects to many different private IPs via SMB (likely to spread or exploit)
• T1057 – Queries a list of all running processes
• T1120 – Checks for available system drives (often done to infect USB drives)
• T1120 – Sample is looking for USB drives. Launch the sample with the USB Fake Disk cookbook
• T1083 – Reads ini files
• T1083 – Writes ini files
• T1082 – Checks the free space of harddrives
• T1080 – Spreads via windows shares (copies executable files to share folders)
• T1090 – Found Tor onion address
• T1486 – Modifies user documents (likely ransomware behavior)
• T1486 – Writes a notice file (html or txt) to demand a ransom
• T1490 – Uses bcdedit to modify the Windows boot settings

Following the Trail — Network & DNS Activity

Outbound activity leans on reputable infrastructure (e.g., CDNs, cloud endpoints) to blend in. TLS sessions and
HTTP calls show routine beaconing and IP‑lookup behavior that can masquerade as normal browsing.

Hunting tip: alert on unknown binaries initiating TLS to IP‑lookup services or unusual CDN endpoints — especially early in execution.