Executive Overview — What We’re Dealing With

This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.

Extended Dwell Time Impact

For 0+ minutes, this malware was rapidly detected — demonstrating excellent security controls that intercepted the threat during initial execution phases, severely limiting adversary capabilities.

Global Detection Posture — Who Caught It, Who Missed It

VirusTotal engines: 72. Detected as malicious: 54. Missed: 18. Coverage: 75.0%.

Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.

Behavioral Storyline — How the Malware Operates

Dominant system-level operations (38.66% of behavior) suggest this malware performs deep system reconnaissance, privilege escalation, or core OS manipulation. It’s actively probing system defenses and attempting to gain administrative control.

MITRE ATT&CK Mapping

• T1055 – write process memory
• T1083 – check if file exists
• T1027 – encode data using Base64
• T1620 – load .NET assembly
• T1083 – check if directory exists
• T1027 – encrypt data using AES via .NET
• T1140 – decode data using Base64 in .NET
• T1129 – link function at runtime on Windows
• T1055.004 – inject other processes with apc
• T1016 – collect network adapter information
• T1082 – collect system hardware fingerprint info
• T1010 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
• T1056.001 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
• T1082 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
• T1083 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
• T1012 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
• T1095 – Unsuccessful connections attempts were detected (with 1 different IP:Port)
• T1129 – The process attempted to dynamically load a malicious function
• T1140 – Detected an attempt to pull out some data from the binary image
• T1057 – The process has tried to detect the debugger probing the use of page guards.
• T1129 – The process tried to load dynamically one or more functions.
• T1045 – Manalize Local SandBox Packer Harvesting
• T1140 – decode data using Base64 in .NET
• T1055 – write process memory
• T1129 – link function at runtime on Windows
• T1083 – check if file exists
• T1027 – encode data using Base64
• T1620 – load .NET assembly
• T1083 – check if directory exists
• T1027 – encrypt data using AES via .NET
• T1057 – The process attempted to detect a running debugger using common APIs
• T1010 – A process attempted to delay the analysis task by a long amount of time.
• T1056.001 – A process attempted to delay the analysis task by a long amount of time.
• T1082 – A process attempted to delay the analysis task by a long amount of time.
• T1083 – A process attempted to delay the analysis task by a long amount of time.
• T1012 – A process attempted to delay the analysis task by a long amount of time.
• T1010 – Manalize Local SandBox Find Crypto
• T1056.001 – Manalize Local SandBox Find Crypto
• T1082 – Manalize Local SandBox Find Crypto
• T1083 – Manalize Local SandBox Find Crypto
• T1012 – Manalize Local SandBox Find Crypto
• T1027.009 – Drops interesting files and uses them
• T1106 – .NET source code references suspicious native API functions
• T1574.002 – Tries to load missing DLLs
• T1036 – Creates files inside the user directory
• T1562.001 – Creates guard pages, often used to prevent reverse engineering and debugging
• T1497 – Contains long sleeps (>= 3 min)
• T1497 – May sleep (evasive loops) to hinder dynamic analysis
• T1140 – .NET source code contains calls to encryption/decryption functions
• T1027 – Binary may include packed or crypted data
• T1027.002 – Binary may include packed or crypted data
• T1027.002 – PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)
• T1027.002 – .NET source code contains method to dynamically call methods (often used by packers)
• T1027.002 – .NET source code contains potential unpacker
• T1010 – Sample monitors Window changes (e.g. starting applications), analyze the sample with the simulation cookbook
• T1018 – Reads the hosts file
• T1082 – Queries the volume information (name, serial number etc) of a device
• T1082 – Queries the cryptographic machine GUID
• T1082 – Reads software policies
• T1560 – .NET source code contains calls to encryption/decryption functions
• T1571 – Detected TCP or UDP traffic on non-standard ports
• T1095 – Performs DNS lookups
• T1071 – Uses dynamic DNS services
• T1071 – Performs DNS lookups

Following the Trail — Network & DNS Activity

Outbound activity leans on reputable infrastructure (e.g., CDNs, cloud endpoints) to blend in. TLS sessions and
HTTP calls show routine beaconing and IP‑lookup behavior that can masquerade as normal browsing.

Hunting tip: alert on unknown binaries initiating TLS to IP‑lookup services or unusual CDN endpoints — especially early in execution.