Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
21/04/2026, 03:44
General
- Target LESLIE NOTE.exe
- Size 5.6MB
- Sample260421-eahc4sbs6v
- SHA256 f2867bbe82532fd268ea9ad20a83724700168f45d2017bd56e27f8b72c6450fe
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- ConfuserEx .NET packer 7 IoCs
Detects ConfuserEx .NET packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\LESLIE NOTE.exe"C:\Users\Admin\AppData\Local\Temp\LESLIE NOTE.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\LNLoading.exe"C:\Users\Admin\AppData\Local\Temp\LNLoading.exe" 02⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2192-16-0x000002331E3A0000-0x000002331E4E2000-memory.dmp
memory/2192-35-0x0000023320200000-0x0000023320210000-memory.dmp
memory/2192-34-0x000002331EAC0000-0x000002331EACC000-memory.dmp
memory/2192-18-0x0000023320200000-0x0000023320210000-memory.dmp
memory/2192-17-0x000002331E870000-0x000002331E8FA000-memory.dmp
memory/4232-7-0x000002074C650000-0x000002074C66A000-memory.dmp
memory/4232-3-0x000002074C7F0000-0x000002074C800000-memory.dmp
memory/4232-0-0x000002074A1E0000-0x000002074A788000-memory.dmp
memory/4232-8-0x000002074C7F0000-0x000002074C800000-memory.dmp
memory/4232-9-0x000002074C810000-0x000002074C81E000-memory.dmp
memory/4232-10-0x000002076AFF0000-0x000002076B00C000-memory.dmp
memory/4232-11-0x000002074C7F0000-0x000002074C800000-memory.dmp
memory/4232-12-0x000002076B040000-0x000002076B068000-memory.dmp
memory/4232-13-0x000002076C550000-0x000002076C60A000-memory.dmp
memory/4232-5-0x000002074AB20000-0x000002074AB26000-memory.dmp
memory/4232-4-0x0000020764F00000-0x00000207650A8000-memory.dmp
memory/4232-6-0x000002074ACF0000-0x000002074AD14000-memory.dmp
memory/4232-19-0x000002076E060000-0x000002076E0C0000-memory.dmp
memory/4232-20-0x00000207662B0000-0x00000207662EA000-memory.dmp
memory/4232-21-0x0000020766270000-0x0000020766296000-memory.dmp
memory/4232-26-0x0000020766340000-0x0000020766362000-memory.dmp
memory/4232-28-0x0000020766600000-0x00000207666B0000-memory.dmp
memory/4232-30-0x000002074C7F0000-0x000002074C800000-memory.dmp
memory/4232-31-0x000002074AB10000-0x000002074AB1C000-memory.dmp
memory/4232-32-0x000002074C7F0000-0x000002074C800000-memory.dmp
memory/4232-33-0x000002074C7F0000-0x000002074C800000-memory.dmp
memory/4232-2-0x000002074AB60000-0x000002074ABA2000-memory.dmp
memory/4232-1-0x0000020765100000-0x000002076587A000-memory.dmp