Analysis
- max time kernel
149s - max time network
139s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
21/04/2026, 03:44
General
- Target LNMemoStart.exe
- Size 2.3MB
- Sample260421-eahc4sbs6v
- SHA256 f958f101f710616cc0caa6da6ca6c230910065f8c7f0314c44625d73c7b41ade
Malware Config
Signatures
- Drops startup file 1 IoCs
- ConfuserEx .NET packer 3 IoCs
Detects ConfuserEx .NET packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\LNMemoStart.exe"C:\Users\Admin\AppData\Local\Temp\LNMemoStart.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1080-0-0x000002B2F9690000-0x000002B2F98D6000-memory.dmp
memory/1080-1-0x000002B2FBF10000-0x000002B2FC022000-memory.dmp
memory/1080-2-0x000002B2F9CE0000-0x000002B2F9CE6000-memory.dmp
memory/1080-3-0x000002B2F9D50000-0x000002B2F9D60000-memory.dmp
memory/1080-4-0x000002B2F9D10000-0x000002B2F9D34000-memory.dmp
memory/1080-5-0x000002B2FF930000-0x000002B2FFAD8000-memory.dmp
memory/1080-15-0x000002B2FFAE0000-0x000002B2FFB56000-memory.dmp
memory/1080-16-0x000002B2FC370000-0x000002B2FC38E000-memory.dmp
memory/1080-17-0x000002B2F9D50000-0x000002B2F9D60000-memory.dmp
memory/1080-18-0x000002B2F9D50000-0x000002B2F9D60000-memory.dmp
memory/1080-19-0x000002B2F9D50000-0x000002B2F9D60000-memory.dmp