Executive Overview — What We’re Dealing With

This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.

Extended Dwell Time Impact

For 23+ hours, this malware remained undetected — a half-day window that permitted the adversary to complete initial execution, establish basic persistence, and perform initial system enumeration.

Global Detection Posture — Who Caught It, Who Missed It

VirusTotal engines: 71. Detected as malicious: 67. Missed: 4. Coverage: 94.4%.

Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.

Behavioral Storyline — How the Malware Operates

Dominant system-level operations (48.94% of behavior) suggest this malware performs deep system reconnaissance, privilege escalation, or core OS manipulation. It’s actively probing system defenses and attempting to gain administrative control.

MITRE ATT&CK Mapping

• T1564 – Attempts to modify Explorer settings to prevent hidden files from being displayed
• T1564 – Attempts to modify Explorer settings to prevent file extensions from being displayed
• T1202 – Uses Windows utilities for basic functionality
• T1562 – Attempts to modify Explorer settings to prevent hidden files from being displayed
• T1562 – Attempts to modify Explorer settings to prevent file extensions from being displayed
• T1036 – A file was accessed within the Public folder.
• T1112 – Attempts to disable or modify Explorer Folder Options
• T1112 – Attempts to modify Explorer settings to prevent hidden files from being displayed
• T1112 – Attempts to modify Explorer settings to prevent file extensions from being displayed
• T1548 – A file was accessed within the Public folder.
• T1562.006 – Attempts to modify Explorer settings to prevent hidden files from being displayed
• T1562.006 – Attempts to modify Explorer settings to prevent file extensions from being displayed
• T1497 – Checks for mouse movement
• T1027 – The binary contains an unknown PE section name indicative of packing
• T1027.002 – The binary contains an unknown PE section name indicative of packing
• T1564.001 – Attempts to modify Explorer settings to prevent hidden files from being displayed
• T1564.001 – Attempts to modify Explorer settings to prevent file extensions from being displayed
• T1071 – Yara detections observed in process dumps, payloads or dropped files
• T1071 – Reads data out of its own binary image
• T1071 – Reads from the memory of another process
• T1071 – The PE file contains an overlay
• T1071 – Creates a slightly modified copy of itself
• T1486 – Exhibits possible ransomware or wiper file modification behavior: overwrites_existing_files
• T1485 – Anomalous file deletion behavior detected (10+)
• T1129 – The process attempted to dynamically load a malicious function
• T1129 – The process tried to load dynamically one or more functions.
• T1140 – Detected an attempt to pull out some data from the binary image
• T1045 – Manalize Local SandBox Packer Harvesting
• T1179 – The process behaves as a keylogger (keyboard capturing detected)
• T1056 – The process behaves as a keylogger (keyboard capturing detected)
• T1158 – Detected the creation of a non white-listed hidden or system file
• T1055 – Likely PROPagate Technique is running
• T1086 – Detected some PowerShell commands executions
• T1031 – The process attempted to disable the displaying of the file extensions in Windows Explorer
• T1112 – The process attempted to disable the displaying of the file extensions in Windows Explorer
• T1031 – The process attempted to alter the hidden files’ displaying configuration on Explorer
• T1112 – The process attempted to alter the hidden files’ displaying configuration on Explorer
• T1036 – Creates a directory in C:\Program Files
• T1036 – Drops PE files to the windows directory (C:\\Windows)
• T1036 – Creates files inside the system directory
• T1036 – Icon mismatch, binary includes an Icon from a different legit application in order to fool users
• T1036 – Creates files inside the program directory
• T1036 – Drops PE files to the user directory
• T1036 – Creates files inside the user directory
• T1036 – Drops PE files to the user root directory (C:\\Documents and Settings\\User or C:\\Users\\User)
• T1036 – Drops PE files to the program directory root (C:\\Program Files)
• T1036 – Drops executable to common a third party application directory
• T1036 – Drops a PE files to the windows directory (C:\\Windows) and starts it
• T1027.002 – Sample is packed with UPX
• T1564.001 – Changes the view of files in windows explorer (hidden files and folders)
• T1027 – Sample is packed with UPX
• T1083 – Reads ini files
• T1082 – Queries the volume information (name, serial number etc) of a device

Following the Trail — Network & DNS Activity

Outbound activity leans on reputable infrastructure (e.g., CDNs, cloud endpoints) to blend in. TLS sessions and
HTTP calls show routine beaconing and IP‑lookup behavior that can masquerade as normal browsing.

Hunting tip: alert on unknown binaries initiating TLS to IP‑lookup services or unusual CDN endpoints — especially early in execution.