Analysis
- max time kernel
149s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
21/04/2026, 21:28
General
- Target 2026-04-21_01d399946022a34a347232f43eff7029_mespinoza.exe
- Size 3.3MB
- Sample260421-1blb2sb17n
- SHA256 8759427cf0d9533c68c217a5362ce935594cdf683af5b93e776d26e2a0bd7e3c
Malware Config
Signatures
- Detects executables packed with VMProtect. 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Kills process with taskkill 1 IoCs
- Modifies registry key 1 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-21_01d399946022a34a347232f43eff7029_mespinoza.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-21_01d399946022a34a347232f43eff7029_mespinoza.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c taskkill /IM steam.exe /F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /IM steam.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /c REG ADD HKCU\Software\Valve\Steam /f /v AutoLoginUser /t REG_SZ /d rd2dn20252⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKCU\Software\Valve\Steam /f /v AutoLoginUser /t REG_SZ /d rd2dn20253⤵
- Modifies registry key
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /c REG ADD HKCU\Software\Valve\Steam /f /v RememberPassword /t REG_SZ /d 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKCU\Software\Valve\Steam /f /v RememberPassword /t REG_SZ /d 13⤵
- Modifies registry key
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2192-0-0x0000000140110000-0x00000001403FE000-memory.dmp
memory/2192-1-0x00007FFC65C90000-0x00007FFC65C92000-memory.dmp
memory/2192-2-0x00007FFC65CA0000-0x00007FFC65CA2000-memory.dmp
memory/2192-3-0x00007FFC646C0000-0x00007FFC646C2000-memory.dmp
memory/2192-4-0x00007FFC646D0000-0x00007FFC646D2000-memory.dmp
memory/2192-5-0x00007FFC63410000-0x00007FFC63412000-memory.dmp
memory/2192-6-0x00007FFC63420000-0x00007FFC63422000-memory.dmp
memory/2192-7-0x00007FFC65CB0000-0x00007FFC65CB2000-memory.dmp
memory/2192-8-0x00007FFC65CC0000-0x00007FFC65CC2000-memory.dmp
memory/2192-13-0x0000000140000000-0x0000000140757000-memory.dmp
memory/2192-15-0x0000000002AA0000-0x0000000002BBE000-memory.dmp
memory/2192-16-0x0000000140110000-0x00000001403FE000-memory.dmp
memory/2192-17-0x0000000140000000-0x0000000140757000-memory.dmp