Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
15/04/2026, 08:52
General
- Target dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe
- Size 9.6MB
- Sample260415-kstrrac19s
- SHA256 dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1
Malware Config
Signatures
- Power Settings 1 TTPs 1 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Suspicious use of SetThreadContext 1 IoCs
- UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 40 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe"C:\Users\Admin\AppData\Local\Temp\dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\OneDriveSetup.exeC:\Windows\SysWOW64\OneDriveSetup.exe2⤵
-
-
C:\Windows\SysWOW64\cscript.exeC:\Windows\SysWOW64\cscript.exe2⤵
-
-
C:\Windows\SysWOW64\OneDriveSetup.exeC:\Windows\SysWOW64\OneDriveSetup.exe2⤵
-
-
C:\Windows\SysWOW64\help.exeC:\Windows\SysWOW64\help.exe2⤵
-
-
C:\Windows\SysWOW64\chkntfs.exeC:\Windows\SysWOW64\chkntfs.exe2⤵
-
-
C:\Windows\SysWOW64\powercfg.exeC:\Windows\SysWOW64\powercfg.exe2⤵
- Power Settings
-
-
C:\Windows\SysWOW64\printui.exeC:\Windows\SysWOW64\printui.exe2⤵
-
-
C:\Windows\SysWOW64\gpscript.exeC:\Windows\SysWOW64\gpscript.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
sMaNT.log
loldsb.ini
memory/8-61-0x0000000003290000-0x00000000032B7000-memory.dmp
memory/8-50-0x0000000010000000-0x00000000101BC000-memory.dmp
memory/8-97-0x00000000015F0000-0x00000000016AF000-memory.dmp
memory/8-77-0x00000000015F0000-0x00000000016AF000-memory.dmp
memory/8-72-0x0000000003310000-0x0000000003316000-memory.dmp
memory/8-71-0x00000000015F0000-0x00000000016AF000-memory.dmp
memory/8-64-0x0000000004920000-0x0000000005184000-memory.dmp
memory/8-68-0x00000000032E0000-0x0000000003307000-memory.dmp
memory/8-62-0x0000000004920000-0x0000000005184000-memory.dmp
memory/8-57-0x0000000003C30000-0x0000000004494000-memory.dmp
memory/8-55-0x0000000003C30000-0x0000000004494000-memory.dmp
memory/8-43-0x0000000000400000-0x0000000000DCF000-memory.dmp
memory/8-39-0x0000000000400000-0x0000000000DCF000-memory.dmp
memory/8-42-0x0000000000400000-0x0000000000DCF000-memory.dmp
memory/8-40-0x0000000000400000-0x0000000000DCF000-memory.dmp
memory/8-45-0x0000000000400000-0x0000000000DCF000-memory.dmp
memory/8-41-0x0000000000400000-0x0000000000DCF000-memory.dmp
memory/1400-49-0x0000000003910000-0x0000000004174000-memory.dmp
memory/1400-27-0x0000000003170000-0x0000000003197000-memory.dmp
memory/1400-54-0x0000000003170000-0x0000000003197000-memory.dmp
memory/1400-47-0x0000000004600000-0x0000000004E64000-memory.dmp
memory/1400-48-0x0000000003120000-0x0000000003147000-memory.dmp
memory/1400-46-0x00000000013C0000-0x000000000147F000-memory.dmp
memory/1400-12-0x0000000003120000-0x0000000003147000-memory.dmp
memory/1400-26-0x0000000004600000-0x0000000004E64000-memory.dmp
memory/1400-0-0x0000000010000000-0x00000000101BC000-memory.dmp
memory/1400-13-0x0000000003910000-0x0000000004174000-memory.dmp
memory/1400-25-0x0000000004600000-0x0000000004E64000-memory.dmp
memory/1400-24-0x0000000003170000-0x0000000003197000-memory.dmp
memory/1400-5-0x0000000003910000-0x0000000004174000-memory.dmp
memory/1400-20-0x0000000004600000-0x0000000004E64000-memory.dmp
memory/1400-19-0x0000000004600000-0x0000000004E64000-memory.dmp
memory/1400-15-0x0000000003120000-0x0000000003147000-memory.dmp
memory/1400-14-0x0000000003910000-0x0000000004174000-memory.dmp