Executive Overview — What We’re Dealing With

This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.

Extended Dwell Time Impact

For 2+ hours, this malware remained undetected — a limited but sufficient window for the adversary to complete initial execution and establish basic system access.

Global Detection Posture — Who Caught It, Who Missed It

VirusTotal engines: 73. Detected as malicious: 59. Missed: 14. Coverage: 80.8%.

Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.

Behavioral Storyline — How the Malware Operates

Heavy cryptographic operations (37.81% of behavior) indicate potential ransomware, data encryption for exfiltration, or secure C2 communications. The malware is actively encrypting or decrypting sensitive data.

MITRE ATT&CK Mapping

• T1047 – access WMI data in .NET
• T1057 – enumerate processes
• T1518 – enumerate processes
• T1012 – query or enumerate registry key
• T1082 – get OS version in .NET
• T1012 – query or enumerate registry value
• T1033 – get session integrity level
• T1083 – check if directory exists
• T1560.002 – compress data using GZip in .NET
• T1053.005 – schedule task via schtasks
• T1082 – get hostname
• T1016.001 – check Internet connectivity via WinINet
• T1082 – get number of processors
• T1620 – load .NET assembly
• T1053.002 – schedule task via at
• T1140 – decode data using Base64 in .NET
• T1105 – download and write a file
• T1082 – get disk size
• T1033 – get session user name
• T1087 – get session user name
• T1083 – get common file path
• T1070.004 – self delete
• T1027 – decrypt data using AES via .NET
• T1083 – check if file exists
• T1222 – set file attributes
• T1539 – Touches a file containing cookies, possibly for information gathering
• T1547 – Installs itself for autorun at Windows startup
• T1053 – Installs itself for autorun at Windows startup
• T1547.001 – Installs itself for autorun at Windows startup
• T1564 – A process created a hidden window
• T1202 – Uses Windows utilities for basic functionality
• T1202 – Uses suspicious command line tools or Windows utilities
• T1562 – Creates a registry key or value with NUL characters to avoid detection with regedit
• T1562 – Attempts to modify Windows Defender using PowerShell
• T1112 – Installs itself for autorun at Windows startup
• T1112 – Installs itself for autorun at Windows startup
• T1112 – Creates a registry key or value with NUL characters to avoid detection with regedit
• T1562.006 – Creates a registry key or value with NUL characters to avoid detection with regedit
• T1064 – A scripting utility was executed
• T1562.001 – Attempts to modify Windows Defender using PowerShell
• T1564.003 – A process created a hidden window
• T1082 – Checks available memory
• T1071 – Reads from the memory of another process
• T1071 – Reads data out of its own binary image
• T1071 – Dynamic (imported) function loading detected
• T1071 – Attempts to connect to a dead IP:Port
• T1071 – At least one IP Address, Domain, or File Name was found in a crypto call
• T1573 – Establishes an encrypted HTTPS connection
• T1106 – Guard pages use detected – possible anti-debugging.
• T1106 – Created a process from a suspicious location
• T1059 – A scripting utility was executed
• T1059 – Attempts to modify Windows Defender using PowerShell
• T1045 – Manalize Local SandBox Packer Harvesting
• T1053 – .NET source code contains functionality to register a task
• T1543.003 – Modifies existing windows services
• T1497 – Allocates memory with a write watch (potentially for evading sandboxes)
• T1562.001 – Creates guard pages, often used to prevent reverse engineering and debugging
• T1027 – .NET source code contains long base64-encoded strings
• T1082 – Queries the volume information (name, serial number etc) of a device
• T1082 – Queries the cryptographic machine GUID

Following the Trail — Network & DNS Activity

Outbound activity leans on reputable infrastructure (e.g., CDNs, cloud endpoints) to blend in. TLS sessions and
HTTP calls show routine beaconing and IP‑lookup behavior that can masquerade as normal browsing.

Hunting tip: alert on unknown binaries initiating TLS to IP‑lookup services or unusual CDN endpoints — especially early in execution.