1c30c043fd03c1831610e08f5eec5ef2b6b67a1f


Zero‑Dwell Threat Intelligence Report

A narrative, executive‑ready view into the malware’s behavior, exposure, and reliable defenses.
Generated: 2025-09-26 07:45:23 UTC

Executive Overview — What We’re Dealing With

This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.

File
1c30c043fd03c1831610e08f5eec5ef2b6b67a1f
Type
UPX compressed Win32 Executable
SHA‑1
1c30c043fd03c1831610e08f5eec5ef2b6b67a1f
MD5
faafaa0250c745e97e58038d78ae7cb7
First Seen
2025-09-05 07:17:20.507028
Last Analysis
2025-09-05 10:06:39.613626
Dwell Time
0 days, 7 hours, 33 minutes

Extended Dwell Time Impact

For 2+ hours, this malware remained undetected — a limited but sufficient window for the adversary to complete initial execution and establish basic system access.

Comparative Context

Industry studies report a median dwell time closer to 21–24 days. This case represents rapid detection and containment within hours rather than days.

Timeline

Time (UTC) Event Elapsed
2025-08-25 20:17:11 UTC First VirusTotal submission —
2025-09-09 07:33:46 UTC Latest analysis snapshot 14 days, 11 hours, 16 minutes
2025-09-26 07:45:23 UTC Report generation time 31 days, 11 hours, 28 minutes

Why It Matters

Every additional day of dwell time is not just an abstract number — it is attacker opportunity. Each day equates to more time for lateral movement, stealth persistence, and intelligence gathering.

Global Detection Posture — Who Caught It, Who Missed It

VirusTotal engines: 73. Detected as malicious: 49. Missed: 24. Coverage: 67.1%.

Detected Vendors

  • Xcitium
  • +48 additional vendors (names not provided)

List includes Xcitium plus an additional 48 vendors per the provided summary.

Missed Vendors

  • Acronis
  • Antiy-AVL
  • APEX
  • Baidu
  • Bkav
  • ClamAV
  • CMC
  • Cynet
  • Elastic
  • Jiangmin
  • MaxSecure
  • SentinelOne
  • SUPERAntiSpyware
  • TACHYON
  • tehtris
  • Trapmine
  • TrendMicro
  • TrendMicro-HouseCall
  • Varist
  • VirIT
  • Webroot
  • Yandex
  • ZoneAlarm
  • Zoner

Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.

Behavioral Storyline — How the Malware Operates

Dominant system-level operations (90.82% of behavior) suggest this malware performs deep system reconnaissance, privilege escalation, or core OS manipulation. It’s actively probing system defenses and attempting to gain administrative control.

Behavior Categories (weighted)

Weight values represent the frequency and intensity of malware interactions with specific system components. Higher weights indicate more aggressive targeting of that category. Each operation (registry access, file modification, network connection, etc.) contributes to the category’s total weight, providing a quantitative measure of the malware’s behavioral focus.

Category Weight Percentage
System 1247 90.82%
Network 50 3.64%
Process 30 2.18%
File System 29 2.11%
Registry 9 0.66%
Misc 4 0.29%
Threading 3 0.22%
Hooking 1 0.07%

MITRE ATT&CK Mapping

  • T1027.002 – packed with generic packer
  • T1027.002 – packed with UPX

Following the Trail — Network & DNS Activity

Outbound activity leans on reputable infrastructure (e.g., CDNs, cloud endpoints) to blend in. TLS sessions and
HTTP calls show routine beaconing and IP‑lookup behavior that can masquerade as normal browsing.

Contacted Domains

Domain IP Country ASN/Org
globalaccelerator.aws-edge.org 27.124.38.6 India CTG Server Ltd
www.aieov.com 76.223.54.146 United States Amazon.com, Inc.

Observed IPs

IP Country ASN/Org
224.0.0.252 — —
8.8.4.4 United States Google LLC
8.8.8.8 United States Google LLC

DNS Queries

Request Type
globalaccelerator.aws-edge.org A
5isohu.com A
www.aieov.com A

Contacted IPs

IP Country ASN/Org
224.0.0.252 — —
8.8.4.4 United States Google LLC
8.8.8.8 United States Google LLC

Port Distribution

Port Count Protocols
137 1 udp
5355 4 udp
53 62 udp

UDP Packets

Source IP Dest IP Sport Dport Time Proto
192.168.56.14 192.168.56.255 137 137 3.078840970993042 udp
192.168.56.14 224.0.0.252 51209 5355 3.0088050365448 udp
192.168.56.14 224.0.0.252 53401 5355 4.733093976974487 udp
192.168.56.14 224.0.0.252 55094 5355 5.563401937484741 udp
192.168.56.14 224.0.0.252 55848 5355 3.009005069732666 udp
192.168.56.14 8.8.4.4 49916 53 43.125245094299316 udp
192.168.56.14 8.8.4.4 50180 53 65.9529869556427 udp
192.168.56.14 8.8.4.4 50710 53 31.12473702430725 udp
192.168.56.14 8.8.4.4 50870 53 139.1406490802765 udp
192.168.56.14 8.8.4.4 50914 53 103.14053297042847 udp
192.168.56.14 8.8.4.4 51262 53 127.28169202804565 udp
192.168.56.14 8.8.4.4 51614 53 174.25036811828613 udp
192.168.56.14 8.8.4.4 52556 53 163.14079689979553 udp
192.168.56.14 8.8.4.4 52815 53 6.137367010116577 udp
192.168.56.14 8.8.4.4 53449 53 151.14073300361633 udp
192.168.56.14 8.8.4.4 54579 53 22.65663504600525 udp
192.168.56.14 8.8.4.4 54683 53 80.31224513053894 udp
192.168.56.14 8.8.4.4 55827 53 112.92184209823608 udp
192.168.56.14 8.8.4.4 55914 53 55.12469005584717 udp
192.168.56.14 8.8.4.4 56399 53 79.14071393013 udp
192.168.56.14 8.8.4.4 56864 53 192.5004711151123 udp
192.168.56.14 8.8.4.4 57742 53 159.89067792892456 udp
192.168.56.14 8.8.4.4 59068 53 145.53158402442932 udp
192.168.56.14 8.8.4.4 59212 53 199.14068603515625 udp
192.168.56.14 8.8.4.4 60117 53 37.015401124954224 udp
192.168.56.14 8.8.4.4 60713 53 115.14066100120544 udp
192.168.56.14 8.8.4.4 62022 53 67.14046907424927 udp
192.168.56.14 8.8.4.4 62112 53 19.124794960021973 udp
192.168.56.14 8.8.4.4 62548 53 98.56266593933105 udp
192.168.56.14 8.8.4.4 62800 53 127.14064192771912 udp
192.168.56.14 8.8.4.4 63205 53 91.1404459476471 udp
192.168.56.14 8.8.4.4 64452 53 175.14046096801758 udp
192.168.56.14 8.8.4.4 64753 53 51.59366798400879 udp
192.168.56.14 8.8.4.4 65148 53 7.297112941741943 udp
192.168.56.14 8.8.4.4 65271 53 206.85983109474182 udp
192.168.56.14 8.8.4.4 65283 53 187.1405050754547 udp
192.168.56.14 8.8.8.8 49916 53 42.12519812583923 udp
192.168.56.14 8.8.8.8 50180 53 64.9532949924469 udp
192.168.56.14 8.8.8.8 50710 53 30.125373125076294 udp
192.168.56.14 8.8.8.8 50870 53 138.1409249305725 udp
192.168.56.14 8.8.8.8 50914 53 102.14089393615723 udp
192.168.56.14 8.8.8.8 51262 53 126.28159689903259 udp
192.168.56.14 8.8.8.8 51614 53 173.25055193901062 udp
192.168.56.14 8.8.8.8 52556 53 162.1411669254303 udp
192.168.56.14 8.8.8.8 52815 53 7.128716945648193 udp
192.168.56.14 8.8.8.8 53449 53 150.1409809589386 udp
192.168.56.14 8.8.8.8 54579 53 21.65646004676819 udp
192.168.56.14 8.8.8.8 54683 53 79.31278896331787 udp
192.168.56.14 8.8.8.8 55827 53 111.92251992225647 udp
192.168.56.14 8.8.8.8 55914 53 54.12514805793762 udp
192.168.56.14 8.8.8.8 56399 53 78.14117813110352 udp
192.168.56.14 8.8.8.8 56864 53 191.50204706192017 udp
192.168.56.14 8.8.8.8 57742 53 158.8907880783081 udp
192.168.56.14 8.8.8.8 59068 53 144.532133102417 udp
192.168.56.14 8.8.8.8 59212 53 198.14132690429688 udp
192.168.56.14 8.8.8.8 60117 53 36.01606106758118 udp
192.168.56.14 8.8.8.8 60713 53 114.14122295379639 udp
192.168.56.14 8.8.8.8 62022 53 66.15056610107422 udp
192.168.56.14 8.8.8.8 62112 53 18.125503063201904 udp
192.168.56.14 8.8.8.8 62548 53 97.56552290916443 udp
192.168.56.14 8.8.8.8 62800 53 126.14104008674622 udp
192.168.56.14 8.8.8.8 63205 53 90.14110398292542 udp
192.168.56.14 8.8.8.8 64452 53 174.14102792739868 udp
192.168.56.14 8.8.8.8 64753 53 50.594106912612915 udp
192.168.56.14 8.8.8.8 65148 53 8.297184944152832 udp
192.168.56.14 8.8.8.8 65271 53 205.86037802696228 udp
192.168.56.14 8.8.8.8 65283 53 186.14126110076904 udp

Hunting tip: alert on unknown binaries initiating TLS to IP‑lookup services or unusual CDN endpoints — especially early in execution.

Persistence & Policy — Registry and Services

Registry and service telemetry points to policy awareness and environment reconnaissance rather than noisy persistence. Below is a compact view of the most relevant keys and handles; expand to see the full lists where available.

Registry Opened

6

Registry Set

3

Services Started

0

Services Opened

0

Registry Opened (Top 25)

Key
HKEY_CURRENT_USER\Software\Microsoft\ActiveMovie\devenum
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\MediaResources\msvideo
HKEY_CURRENT_USER\DataEnc
HKEY_CURRENT_USER\Software\Microsoft\ActiveMovie
HKEY_CURRENT_USER\DataEnc\0
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\MediaResources
Show all (6 total)

Registry Set (Top 25)

Key Value
HKEY_CURRENT_USER\DataEnc\0\d33f351a4aeea5e608853d1a56661059 —
HKEY_CURRENT_USER\Software\Microsoft\ActiveMovie\devenum\Version 7
HKEY_LOCAL_MACHINE\SOFTWARE\UserInfo —

Services Started (Top 15)

Services Opened (Top 15)

What To Do Now — Practical Defense Playbook

  • Contain unknowns: block first‑run binaries by default — signatures catch up, containment works now.
  • EDR controls: alert on keyboard hooks, screen capture APIs, VM/sandbox checks, and command‑shell launches.
  • Registry watch: flag queries/sets under policy paths (e.g., …\FipsAlgorithmPolicy\*).
  • Network rules: inspect outbound TLS to IP‑lookup services and unexpected CDN endpoints.
  • Hunt broadly: sweep endpoints for the indicators above and quarantine positives immediately.

Dwell time equals attacker opportunity. Reducing execution privileges and egress shrinks that window even when vendors disagree.

Scroll to Top