Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
21/04/2026, 03:44
General
- Target LNMemoStart.exe
- Size 2.3MB
- Sample260421-eahc4sbs6v
- SHA256 f958f101f710616cc0caa6da6ca6c230910065f8c7f0314c44625d73c7b41ade
Malware Config
Signatures
- Drops startup file 1 IoCs
- ConfuserEx .NET packer 3 IoCs
Detects ConfuserEx .NET packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\LNMemoStart.exe"C:\Users\Admin\AppData\Local\Temp\LNMemoStart.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3952-0-0x000002B2118E0000-0x000002B211B26000-memory.dmp
memory/3952-1-0x000002B22BF20000-0x000002B22C032000-memory.dmp
memory/3952-2-0x000002B211EB0000-0x000002B211EB6000-memory.dmp
memory/3952-3-0x000002B211F60000-0x000002B211F70000-memory.dmp
memory/3952-4-0x000002B211F20000-0x000002B211F44000-memory.dmp
memory/3952-5-0x000002B230CA0000-0x000002B230E48000-memory.dmp
memory/3952-15-0x000002B230ED0000-0x000002B230F46000-memory.dmp
memory/3952-16-0x000002B2310B0000-0x000002B2310CE000-memory.dmp
memory/3952-17-0x000002B211F60000-0x000002B211F70000-memory.dmp
memory/3952-18-0x000002B211F60000-0x000002B211F70000-memory.dmp
memory/3952-19-0x000002B211EE0000-0x000002B211EEC000-memory.dmp
memory/3952-20-0x000002B211F60000-0x000002B211F70000-memory.dmp