Executive Overview — What We’re Dealing With

This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.

Extended Dwell Time Impact

For 2+ hours, this malware remained undetected — a limited but sufficient window for the adversary to complete initial execution and establish basic system access.

Global Detection Posture — Who Caught It, Who Missed It

VirusTotal engines: 73. Detected as malicious: 55. Missed: 18. Coverage: 75.3%.

Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.

Behavioral Storyline — How the Malware Operates

Intensive file system activity (48.91% of behavior) indicates data harvesting, file encryption, or dropper behavior. The threat is actively searching for and manipulating files across the system.

MITRE ATT&CK Mapping

• T1057 – find process by name
• T1010 – enumerate gui resources
• T1614 – get geographical location
• T1497.001 – reference anti-VM strings targeting Qemu
• T1082 – query environment variable
• T1055.012 – use process replacement
• T1620 – use process replacement
• T1082 – get number of processor cores
• T1083 – enumerate files in .NET
• T1057 – find process by PID
• T1083 – check if directory exists
• T1033 – get session user name
• T1087 – get session user name
• T1047 – access WMI data in .NET
• T1113 – capture screenshot
• T1012 – query or enumerate registry value
• T1105 – download and write a file
• T1497.001 – reference anti-VM strings targeting VirtualBox
• T1497.001 – reference anti-VM strings targeting VMWare
• T1016 – get networking interfaces
• T1213 – reference WMI statements
• T1082 – get CPU information
• T1012 – query or enumerate registry key
• T1546.011 – persist via application shimming
• T1083 – get common file path
• T1140 – decode data using Base64 in .NET
• T1082 – get OS version in .NET
• T1083 – get file size
• T1620 – load .NET assembly
• T1083 – check if file exists
• T1033 – get session integrity level
• T1497.001 – reference anti-VM strings
• T1027 – obfuscated with Yano
• T1222 – set file attributes
• T1082 – get hostname
• T1082 – get number of processors
• T1564 – A process created a hidden window
• T1202 – Uses Windows utilities for basic functionality
• T1055 – Writes to the memory another process
• T1055 – Writes an executable to the memory of another process
• T1070 – Deletes executed files from disk
• T1064 – Attempts to execute suspicious powershell command arguments
• T1064 – PowerShell attempted to make a network connection
• T1064 – A scripting utility was executed
• T1564.003 – A process created a hidden window
• T1082 – Checks available memory
• T1057 – Enumerates running processes
• T1071 – Yara detections observed in process dumps, payloads or dropped files
• T1071 – Terminates another process
• T1071 – At least one IP Address, Domain, or File Name was found in a crypto call
• T1071 – Reads from the memory of another process
• T1071 – PowerShell attempted to make a network connection
• T1071 – Attempts to connect to a dead IP:Port
• T1071 – Binary file triggered multiple YARA rules
• T1106 – Guard pages use detected – possible anti-debugging.
• T1059 – Attempts to execute suspicious powershell command arguments
• T1059 – PowerShell attempted to make a network connection
• T1059 – A scripting utility was executed
• T1059.001 – Attempts to execute suspicious powershell command arguments
• T1059.001 – PowerShell attempted to make a network connection
• T1485 – Anomalous file deletion behavior detected (10+)
• T1005 – Searches for sensitive browser data
• T1005 – Reads sensitive browser data
• T1012 – Query OS Information
• T1012 – Reads system data
• T1012 – Searches for sensitive browser data
• T1027.002 – Creates a page with write and execute permissions
• T1027.002 – Resolves API functions dynamically
• T1047 – Queries OS version via WMI
• T1047 – Collects hardware properties
• T1047 – Tries to detect the presence of antivirus software
• T1055 – Writes into the memory of another process
• T1055 – Modifies control flow of another process
• T1055.012 – Process Hollowing
• T1056 – Combination of other detections shows multiple input capture behaviors
• T1057 – Enumerates running processes
• T1059.001 – Bypasses PowerShell execution policy
• T1082 – Queries OS version via WMI
• T1082 – Collects hardware properties
• T1082 – Query OS Information
• T1082 – Reads system data
• T1082 – Enumerates running processes
• T1083 – Searches for sensitive browser data
• T1083 – Possibly does reconnaissance
• T1083 – Reads sensitive browser data
• T1095 – Connects to remote host
• T1095 – Sets up server that accepts incoming connections
• T1113 – Takes screenshot
• T1119 – Searches for sensitive browser data
• T1119 – Reads sensitive browser data
• T1119 – Combination of other detections shows multiple input capture behaviors
• T1134 – Enables process privileges
• T1217 – Searches for sensitive browser data
• T1518.001 – Tries to detect the presence of antivirus software
• T1552.001 – Searches for sensitive browser data
• T1552.001 – Reads sensitive browser data
• T1552.002 – Searches for sensitive browser data
• T1555.003 – Reads sensitive browser data
• T1564.003 – Creates process with hidden window
• T1571 – Tries to connect using an uncommon port
• T1129 – The process attempted to dynamically load a malicious function
• T1129 – The process tried to load dynamically one or more functions.
• T1564.003 – Detected the creation of a hidden window (common execution hiding technique)
• T1057 – The process has tried to detect the debugger probing the use of page guards.
• T1057 – The process attempted to detect a running debugger using common APIs
• T1089 – The process has tried to suspend a sandbox-related thread (possible sandbox evasion attempt)
• T1082 – Queries for the computername
• T1012 – The process collected information about installed softwares
• T1119 – The process collected information about installed softwares
• T1086 – Detected the execution of a powershell command with one or more suspicious parameter
• T1027 – Detected the execution of a powershell command with one or more suspicious parameter
• T1129 – Detected the execution of a powershell command with one or more suspicious parameter
• T1012 – The process tried to collect informations about the system reading some known registry keys
• T1082 – The process tried to collect informations about the system reading some known registry keys
• T1086 – Detected some PowerShell commands executions
• T1027.009 – Drops interesting files and uses them
• T1047 – Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
• T1047 – Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
• T1047 – Queries process information (via WMI, Win32_Process)
• T1106 – .NET source code references suspicious native API functions
• T1055 – May try to detect the Windows Explorer process (often used for injection)
• T1036 – Creates files inside the user directory
• T1497 – Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
• T1497 – Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
• T1497 – Allocates memory with a write watch (potentially for evading sandboxes)
• T1562.001 – Creates guard pages, often used to prevent reverse engineering and debugging
• T1140 – .NET source code contains calls to encryption/decryption functions
• T1027 – .NET source code contains long base64-encoded strings
• T1027.002 – .NET source code contains potential unpacker
• T1003 – Tries to harvest and steal browser information (history, passwords, etc)
• T1518.001 – Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
• T1518.001 – Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
• T1057 – Queries a list of all running processes
• T1057 – May try to detect the Windows Explorer process (often used for injection)
• T1057 – Queries a list of all open handles
• T1083 – Reads ini files
• T1082 – Queries the product ID of Windows
• T1082 – Checks if Microsoft Office is installed
• T1082 – Queries the cryptographic machine GUID
• T1082 – Queries process information (via WMI, Win32_Process)
• T1082 – Queries the volume information (name, serial number etc) of a device
• T1082 – Queries a list of all open handles
• T1113 – Contains functionality to capture screen (.Net source)
• T1560 – .NET source code contains calls to encryption/decryption functions
• T1005 – Tries to harvest and steal browser information (history, passwords, etc)

Following the Trail — Network & DNS Activity

Outbound activity leans on reputable infrastructure (e.g., CDNs, cloud endpoints) to blend in. TLS sessions and
HTTP calls show routine beaconing and IP‑lookup behavior that can masquerade as normal browsing.

Hunting tip: alert on unknown binaries initiating TLS to IP‑lookup services or unusual CDN endpoints — especially early in execution.