Analysis
- max time kernel
148s - max time network
148s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
15/03/2026, 00:45
General
- Target mod_payload.exe
- Size 1002KB
- Sample260315-a4cbqsfs7v
- SHA256 493a52ae0ef7fcd776bffe1801c400138662e0d78afe03cf9fb455ae2a9aed5a
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\mod_payload.exe"C:\Users\Admin\AppData\Local\Temp\mod_payload.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\System32\calc.exeC:\Windows\System32\calc.exe2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3956-0-0x000001B0BF800000-0x000001B0BF8BE000-memory.dmp
memory/3956-1-0x000001B0C1630000-0x000001B0C1640000-memory.dmp
memory/3956-2-0x000001B0D9FB0000-0x000001B0DA06A000-memory.dmp
memory/3956-3-0x000001B0C1630000-0x000001B0C1640000-memory.dmp
memory/3956-4-0x000001B0DA070000-0x000001B0DA20A000-memory.dmp
memory/3956-10-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-55-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-94-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-92-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-66-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-64-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-62-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-60-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-58-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-52-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-50-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-48-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-46-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-44-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-42-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-38-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-34-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-56-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-40-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-36-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-28-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-122-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-124-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-126-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-120-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-119-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-116-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-114-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-112-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-110-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-108-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-106-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-104-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-102-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-130-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-100-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-98-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-96-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-90-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-88-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-86-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-84-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-82-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-80-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-78-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-76-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-74-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-72-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-70-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-68-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-26-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-24-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-22-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-20-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-19-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-16-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-14-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-12-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-8-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-32-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-30-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-6-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-5-0x000001B0DA070000-0x000001B0DA204000-memory.dmp
memory/3956-3202-0x000001B0C1630000-0x000001B0C1640000-memory.dmp
memory/3956-3650-0x000001B0C1630000-0x000001B0C1640000-memory.dmp
memory/3956-4148-0x000001B0C1630000-0x000001B0C1640000-memory.dmp
memory/3956-6752-0x000001B0C1590000-0x000001B0C1598000-memory.dmp
memory/3956-6753-0x000001B0C1630000-0x000001B0C1640000-memory.dmp
memory/3956-6754-0x000001B0C1630000-0x000001B0C1640000-memory.dmp
memory/3956-6760-0x000001B0C1630000-0x000001B0C1640000-memory.dmp
memory/3956-6761-0x000001B0C1630000-0x000001B0C1640000-memory.dmp
memory/3956-6762-0x000001B0DA770000-0x000001B0DA7F4000-memory.dmp
memory/3956-9018-0x000001B0DA9B0000-0x000001B0DAA7E000-memory.dmp