Executive Overview — What We’re Dealing With

This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.

Extended Dwell Time Impact

For 2+ hours, this malware remained undetected — a limited but sufficient window for the adversary to complete initial execution and establish basic system access.

Global Detection Posture — Who Caught It, Who Missed It

VirusTotal engines: 72. Detected as malicious: 52. Missed: 20. Coverage: 72.2%.

Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.

Behavioral Storyline — How the Malware Operates

Dominant system-level operations (29.02% of behavior) suggest this malware performs deep system reconnaissance, privilege escalation, or core OS manipulation. It’s actively probing system defenses and attempting to gain administrative control.

MITRE ATT&CK Mapping

• T1083 – get common file path
• T1033 – get session user name
• T1087 – get session user name
• T1222 – set file attributes
• T1033 – get session integrity level
• T1129 – Drops a binary and executes it
• T1053 – Installs itself for autorun at Windows startup
• T1106 – Guard pages use detected – possible anti-debugging.
• T1059 – Attempts to execute suspicious powershell command arguments
• T1059 – A scripting utility was executed
• T1064 – Attempts to execute suspicious powershell command arguments
• T1064 – A scripting utility was executed
• T1059.001 – Attempts to execute suspicious powershell command arguments
• T1202 – Uses Windows utilities for basic functionality
• T1202 – Uses suspicious command line tools or Windows utilities
• T1562 – Attempts to stop active services
• T1112 – Installs itself for autorun at Windows startup
• T1112 – Installs itself for autorun at Windows startup
• T1070 – Deletes executed files from disk
• T1562.001 – Attempts to stop active services
• T1027 – The binary likely contains encrypted or compressed data
• T1027.002 – The binary likely contains encrypted or compressed data
• T1543 – Attempts to stop active services
• T1547 – Installs itself for autorun at Windows startup
• T1543.003 – Attempts to stop active services
• T1547.001 – Installs itself for autorun at Windows startup
• T1489 – Attempts to stop active services
• T1082 – Checks available memory
• T1082 – Access the NetLogon registry key, potentially used for discovery or tampering
• T1012 – Access the NetLogon registry key, potentially used for discovery or tampering
• T1071 – Makes a suspicious HTTP request to a commonly exploitable directory with questionable file ext
• T1071 – At least one IP Address, Domain, or File Name was found in a crypto call
• T1071 – HTTP traffic contains suspicious features which may be indicative of malware related traffic
• T1071 – Executable is attempted to be downloaded from an IP
• T1071 – Yara detections observed in process dumps, payloads or dropped files
• T1071 – Resolves a suspicious Top Level Domain (TLD)
• T1053 – Uses schtasks.exe or at.exe to add and modify task schedules
• T1059.001 – Bypasses PowerShell execution policy
• T1543.003 – Creates or modifies windows services
• T1574.010 – Uses cacls to modify the permissions of files
• T1036 – Creates files inside the system directory
• T1036 – Creates files inside the user directory
• T1036 – Drops PE files to the windows directory (C:\\Windows)
• T1036 – Drops a PE files to the windows directory (C:\\Windows) and starts it
• T1562.001 – Creates guard pages, often used to prevent reverse engineering and debugging
• T1497 – Checks if the current process is being debugged
• T1497 – Allocates memory with a write watch (potentially for evading sandboxes)
• T1497 – May sleep (evasive loops) to hinder dynamic analysis
• T1518.001 – Checks if the current process is being debugged
• T1057 – Queries a list of all running processes
• T1082 – Queries the volume information (name, serial number etc) of a device
• T1021.001 – Contains functionality to start a terminal service

Following the Trail — Network & DNS Activity

Outbound activity leans on reputable infrastructure (e.g., CDNs, cloud endpoints) to blend in. TLS sessions and
HTTP calls show routine beaconing and IP‑lookup behavior that can masquerade as normal browsing.

Hunting tip: alert on unknown binaries initiating TLS to IP‑lookup services or unusual CDN endpoints — especially early in execution.