Executive Overview — What We’re Dealing With

This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.

Extended Dwell Time Impact

For 7+ hours, this malware remained undetected — a several-hour window that allowed the adversary to complete initial compromise and begin early-stage persistence establishment.

Global Detection Posture — Who Caught It, Who Missed It

VirusTotal engines: 73. Detected as malicious: 69. Missed: 4. Coverage: 94.5%.

Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.

Behavioral Storyline — How the Malware Operates

Intensive file system activity (37.68% of behavior) indicates data harvesting, file encryption, or dropper behavior. The threat is actively searching for and manipulating files across the system.

MITRE ATT&CK Mapping

• T1543.003 – start service
• T1027 – encode data using XOR
• T1543.003 – modify service
• T1569.002 – modify service
• T1083 – get file size
• T1543.003 – persist via Windows service
• T1569.002 – persist via Windows service
• T1129 – parse PE header
• T1027.005 – contain obfuscated stackstrings
• T1543.003 – create service
• T1569.002 – create service
• T1129 – link function at runtime on Windows
• T1016 – get socket status
• T1027 – encrypt data using RC4 KSA
• T1129 – Drops a binary and executes it
• T1053 – Installs itself for autorun at Windows startup
• T1543 – Attempts to stop active services
• T1543 – Created a service that was not started
• T1547 – Installs itself for autorun at Windows startup
• T1543.003 – Attempts to stop active services
• T1543.003 – Created a service that was not started
• T1547.001 – Installs itself for autorun at Windows startup
• T1539 – Touches a file containing cookies, possibly for information gathering
• T1489 – Attempts to stop active services
• T1486 – Exhibits possible ransomware or wiper file modification behavior: mass_file_deletion overwrites_existing_files
• T1485 – Anomalous file deletion behavior detected (10+)
• T1485 – Clears Windows events or logs
• T1564 – A process created a hidden window
• T1202 – Uses Windows utilities for basic functionality
• T1562 – Tries to unhook or modify Windows functions monitored by CAPE
• T1562 – Attempts to stop active services
• T1112 – Installs itself for autorun at Windows startup
• T1112 – Installs itself for autorun at Windows startup
• T1070 – Deletes executed files from disk
• T1070 – Clears Windows events or logs
• T1562.001 – Tries to unhook or modify Windows functions monitored by CAPE
• T1562.001 – Attempts to stop active services
• T1027 – The binary likely contains encrypted or compressed data
• T1564.003 – A process created a hidden window
• T1027.002 – The binary likely contains encrypted or compressed data
• T1082 – Access the NetLogon registry key, potentially used for discovery or tampering
• T1082 – Checks available memory
• T1057 – Expresses interest in specific running processes
• T1057 – Enumerates running processes
• T1012 – Access the NetLogon registry key, potentially used for discovery or tampering
• T1071 – Performs HTTP requests potentially not found in PCAP.
• T1071 – HTTP traffic contains suspicious features which may be indicative of malware related traffic
• T1071 – Resolves a suspicious Top Level Domain (TLD)
• T1095 – Generates some ICMP traffic
• T1547.008 – Enables driver privileges
• T1547.008 – Spawns drivers
• T1548 – Found direct / indirect Syscall (likely to bypass EDR)
• T1036 – Creates a directory in C:\Program Files
• T1036 – Creates files inside the program directory
• T1036 – Drops executable to common a third party application directory
• T1036 – Drops a PE files to the windows directory (C:\\Windows) and starts it
• T1036 – Drops PE files to the windows directory (C:\\Windows)
• T1036 – Creates files inside the system directory
• T1036 – Creates files in the system32 config directory
• T1036 – Creates files inside the user directory
• T1497 – May sleep (evasive loops) to hinder dynamic analysis
• T1027 – Binary may include packed or crypted data
• T1027.002 – Binary may include packed or crypted data
• T1070.006 – Binary contains a suspicious time stamp
• T1135 – Connects to many different private IPs via SMB (likely to spread or exploit)
• T1082 – Queries the volume information (name, serial number etc) of a device
• T1082 – Queries the cryptographic machine GUID
• T1080 – Infects executable files (exe, dll, sys, html)
• T1573 – Uses HTTPS
• T1105 – Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.
• T1105 – Tries to download HTTP data from a sinkholed host
• T1105 – Downloads files from webservers via HTTP
• T1105 – Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable)
• T1095 – Downloads files from webservers via HTTP
• T1095 – Posts data to webserver
• T1095 – Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable)
• T1071 – Uses HTTPS
• T1071 – Uses a known web browser user agent for HTTP communication
• T1071 – Downloads files from webservers via HTTP
• T1071 – Posts data to webserver
• T1071 – Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable)

Following the Trail — Network & DNS Activity

Outbound activity leans on reputable infrastructure (e.g., CDNs, cloud endpoints) to blend in. TLS sessions and
HTTP calls show routine beaconing and IP‑lookup behavior that can masquerade as normal browsing.

Hunting tip: alert on unknown binaries initiating TLS to IP‑lookup services or unusual CDN endpoints — especially early in execution.