Analysis
- user interaction
yes - max time kernel
238s - max time network
209s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
17/04/2026, 18:10
General
- Target win64.console.exe
- Size 89KB
- Sample260417-wsbrqaey8m
- SHA256 4c9e3852dffb789567fa55739f5568bb0da62fd2f1fdbdce3628b777d07a593d
Malware Config
Signatures
- Modifies registry class 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\win64.console.exe"C:\Users\Admin\AppData\Local\Temp\win64.console.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\win64.exeC:\Users\Admin\AppData\Local\Temp\win64.exe2⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2492-96-0x00007FF6AA200000-0x00007FF6B0366000-memory.dmp
memory/2492-111-0x00007FF6AA200000-0x00007FF6B0366000-memory.dmp
memory/2492-0-0x0000025BD0450000-0x0000025BD0451000-memory.dmp
memory/2492-138-0x00007FF6AA200000-0x00007FF6B0366000-memory.dmp
memory/2492-73-0x0000025BCCC20000-0x0000025BCCDBA000-memory.dmp
memory/2492-72-0x00007FF6AA200000-0x00007FF6B0366000-memory.dmp
memory/2492-79-0x0000025BCCC20000-0x0000025BCCDBA000-memory.dmp
memory/2492-75-0x00007FF6AA200000-0x00007FF6B0366000-memory.dmp
memory/2492-78-0x00007FF6AA200000-0x00007FF6B0366000-memory.dmp
memory/2492-81-0x00007FF6AA200000-0x00007FF6B0366000-memory.dmp
memory/2492-84-0x00007FF6AA200000-0x00007FF6B0366000-memory.dmp
memory/2492-87-0x00007FF6AA200000-0x00007FF6B0366000-memory.dmp
memory/2492-90-0x00007FF6AA200000-0x00007FF6B0366000-memory.dmp
memory/2492-93-0x00007FF6AA200000-0x00007FF6B0366000-memory.dmp
memory/2492-1-0x0000025BD0450000-0x0000025BD0451000-memory.dmp
memory/2492-102-0x00007FF6AA200000-0x00007FF6B0366000-memory.dmp
memory/2492-2-0x0000025BD0450000-0x0000025BD0451000-memory.dmp
memory/2492-105-0x00007FF6AA200000-0x00007FF6B0366000-memory.dmp
memory/2492-108-0x00007FF6AA200000-0x00007FF6B0366000-memory.dmp
memory/2492-99-0x00007FF6AA200000-0x00007FF6B0366000-memory.dmp
memory/2492-114-0x00007FF6AA200000-0x00007FF6B0366000-memory.dmp
memory/2492-117-0x00007FF6AA200000-0x00007FF6B0366000-memory.dmp
memory/2492-120-0x00007FF6AA200000-0x00007FF6B0366000-memory.dmp
memory/2492-123-0x00007FF6AA200000-0x00007FF6B0366000-memory.dmp
memory/2492-126-0x00007FF6AA200000-0x00007FF6B0366000-memory.dmp
memory/2492-129-0x00007FF6AA200000-0x00007FF6B0366000-memory.dmp
memory/2492-132-0x00007FF6AA200000-0x00007FF6B0366000-memory.dmp
memory/2492-135-0x00007FF6AA200000-0x00007FF6B0366000-memory.dmp
memory/2552-71-0x00007FF7B63D0000-0x00007FF7B63ED000-memory.dmp