Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
21/04/2026, 21:28
General
- Target 2026-04-21_01d399946022a34a347232f43eff7029_mespinoza.exe
- Size 3.3MB
- Sample260421-1blb2sb17n
- SHA256 8759427cf0d9533c68c217a5362ce935594cdf683af5b93e776d26e2a0bd7e3c
Malware Config
Signatures
- Detects executables packed with VMProtect. 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Kills process with taskkill 1 IoCs
- Modifies registry key 1 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-21_01d399946022a34a347232f43eff7029_mespinoza.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-21_01d399946022a34a347232f43eff7029_mespinoza.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c taskkill /IM steam.exe /F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /IM steam.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /c REG ADD HKCU\Software\Valve\Steam /f /v AutoLoginUser /t REG_SZ /d rd2dn20252⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKCU\Software\Valve\Steam /f /v AutoLoginUser /t REG_SZ /d rd2dn20253⤵
- Modifies registry key
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /c REG ADD HKCU\Software\Valve\Steam /f /v RememberPassword /t REG_SZ /d 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKCU\Software\Valve\Steam /f /v RememberPassword /t REG_SZ /d 13⤵
- Modifies registry key
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2988-15-0x000001B7020B0000-0x000001B7020E0000-memory.dmp
memory/5060-6-0x00007FFB461B0000-0x00007FFB461B2000-memory.dmp
memory/5060-2-0x00007FFB488C0000-0x00007FFB488C2000-memory.dmp
memory/5060-3-0x00007FFB48670000-0x00007FFB48672000-memory.dmp
memory/5060-5-0x00007FFB461A0000-0x00007FFB461A2000-memory.dmp
memory/5060-4-0x00007FFB48680000-0x00007FFB48682000-memory.dmp
memory/5060-0-0x0000000140110000-0x00000001403FE000-memory.dmp
memory/5060-8-0x00007FFB488E0000-0x00007FFB488E2000-memory.dmp
memory/5060-12-0x0000000140000000-0x0000000140757000-memory.dmp
memory/5060-7-0x00007FFB488D0000-0x00007FFB488D2000-memory.dmp
memory/5060-1-0x00007FFB488B0000-0x00007FFB488B2000-memory.dmp
memory/5060-16-0x0000000000840000-0x0000000000870000-memory.dmp
memory/5060-17-0x0000000140110000-0x00000001403FE000-memory.dmp
memory/5060-18-0x0000000140000000-0x0000000140757000-memory.dmp