Executive Overview — What We’re Dealing With

This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.

Extended Dwell Time Impact

For 2+ hours, this malware remained undetected — a limited but sufficient window for the adversary to complete initial execution and establish basic system access.

Global Detection Posture — Who Caught It, Who Missed It

VirusTotal engines: 73. Detected as malicious: 51. Missed: 22. Coverage: 69.9%.

Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.

Behavioral Storyline — How the Malware Operates

Intensive file system activity (33.81% of behavior) indicates data harvesting, file encryption, or dropper behavior. The threat is actively searching for and manipulating files across the system.

MITRE ATT&CK Mapping

• T1134.001 – impersonate user
• T1083 – get common file path
• T1129 – parse PE header
• T1082 – get disk size
• T1113 – capture screenshot
• T1129 – link function at runtime on Windows
• T1083 – enumerate files recursively
• T1547.009 – create shortcut via IShellLink
• T1529 – shutdown system
• T1033 – get token membership
• T1082 – get COMSPEC environment variable
• T1057 – enumerate processes
• T1518 – enumerate processes
• T1027 – encode data using Base64
• T1105 – download and write a file
• T1027 – encode data using XOR
• T1082 – get disk information
• T1083 – enumerate files on Windows
• T1115 – open clipboard
• T1497.002 – check for unmoving mouse cursor
• T1010 – find graphical window
• T1082 – query environment variable
• T1056.001 – log keystrokes
• T1112 – delete registry key
• T1012 – query or enumerate registry value
• T1134 – acquire debug privileges
• T1115 – list drag and drop files
• T1082 – get hostname
• T1564.003 – hide graphical window
• T1614.001 – get keyboard layout
• T1083 – get file version info
• T1059 – compiled with AutoIt
• T1012 – query or enumerate registry key
• T1134 – modify access privileges
• T1033 – get session user name
• T1087 – get session user name
• T1016 – get socket status
• T1115 – read clipboard data
• T1010 – enumerate gui resources
• T1056.001 – log keystrokes via polling
• T1083 – check if file exists
• T1082 – get memory capacity
• T1222 – set file attributes
• T1112 – delete registry value
• T1082 – get system information on Windows
• T1083 – get file size
• T1129 – Drops a binary and executes it
• T1106 – Guard pages use detected – possible anti-debugging.
• T1059 – Attempts to execute suspicious powershell command arguments
• T1059 – A document or script wrote an executable file to disk
• T1059 – Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• T1059 – A HTTP/S link was seen in a script or command line
• T1059 – A scripting utility was executed
• T1059 – PowerShell attempted to make a network connection
• T1059 – Executed a very long command line or script command which may be indicative of chained commands or obfuscation
• T1059 – Data downloaded by powershell script
• T1064 – A scripting utility was executed
• T1064 – PowerShell attempted to make a network connection
• T1064 – Data downloaded by powershell script
• T1064 – Attempts to execute suspicious powershell command arguments
• T1059.001 – PowerShell attempted to make a network connection
• T1059.001 – Data downloaded by powershell script
• T1059.001 – Attempts to execute suspicious powershell command arguments
• T1059.001 – Powershell is sending data to a remote host
• T1564 – A process created a hidden window
• T1202 – Uses suspicious command line tools or Windows utilities
• T1202 – Uses Windows utilities for basic functionality
• T1036 – Attempts to move, copy or rename a command line or scripting utility likely for evasion
• T1036 – A file was accessed within the Public folder.
• T1055 – Writes an executable to the memory of another process
• T1055 – Writes to the memory another process
• T1112 – Installs itself for autorun at Windows startup
• T1548 – A file was accessed within the Public folder.
• T1497 – Detects the presence of Windows Defender AV emulator via files
• T1564.003 – A process created a hidden window
• T1547 – Installs itself for autorun at Windows startup
• T1547.001 – Installs itself for autorun at Windows startup
• T1082 – Checks available memory
• T1083 – Detects the presence of Windows Defender AV emulator via files
• T1057 – Expresses interest in specific running processes
• T1057 – Detects the presence of Windows Defender AV emulator via files
• T1057 – Enumerates running processes
• T1518 – Detects the presence of Windows Defender AV emulator via files
• T1071 – Reads from the memory of another process
• T1071 – Attempts to connect to a dead IP:Port
• T1071 – Powershell is sending data to a remote host
• T1071 – At least one IP Address, Domain, or File Name was found in a crypto call
• T1071 – Binary file triggered YARA rule
• T1071 – HTTP traffic contains suspicious features which may be indicative of malware related traffic
• T1071 – A HTTP/S link was seen in a script or command line
• T1071 – Yara detections observed in process dumps, payloads or dropped files
• T1071 – PowerShell attempted to make a network connection
• T1071 – Reads data out of its own binary image
• T1129 – The process attempted to dynamically load a malicious function
• T1129 – The process tried to load dynamically one or more functions.
• T1057 – The process has tried to detect the debugger probing the use of page guards.
• T1057 – The process attempted to detect a running debugger using common APIs
• T1086 – Detected some PowerShell commands executions
• T1063 – It Tries to detect injection methods
• T1064 – Found WSH timer for Javascript or VBS script (likely evasive script)
• T1059 – Very long cmdline option found, this is very uncommon (may be encrypted or packed)
• T1059.001 – Bypasses PowerShell execution policy
• T1059.001 – Suspicious powershell command line found
• T1059.001 – Powershell drops PE file
• T1547.001 – Creates a start menu entry (Start Menu\\Programs\\Startup)
• T1547.001 – Stores files to the Windows startup directory
• T1055 – May try to detect the Windows Explorer process (often used for injection)
• T1036 – Drops PE files with a suspicious file extension
• T1036 – Drops PE files to the user root directory (C:\\Documents and Settings\\User or C:\\Users\\User)
• T1036 – Creates files inside the user directory
• T1036 – Drops PE files to the user directory
• T1497 – May sleep (evasive loops) to hinder dynamic analysis
• T1057 – Queries a list of all running processes
• T1057 – May try to detect the Windows Explorer process (often used for injection)
• T1083 – Reads ini files
• T1082 – Queries the volume information (name, serial number etc) of a device
• T1105 – Downloads executable code via HTTP
• T1105 – Downloads files from webservers via HTTP
• T1095 – Downloads files from webservers via HTTP
• T1071 – Uses a known web browser user agent for HTTP communication
• T1071 – Downloads executable code via HTTP
• T1071 – Downloads files from webservers via HTTP

Following the Trail — Network & DNS Activity

Outbound activity leans on reputable infrastructure (e.g., CDNs, cloud endpoints) to blend in. TLS sessions and
HTTP calls show routine beaconing and IP‑lookup behavior that can masquerade as normal browsing.

Hunting tip: alert on unknown binaries initiating TLS to IP‑lookup services or unusual CDN endpoints — especially early in execution.