Analysis
- max time kernel
149s - max time network
157s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
21/04/2026, 03:44
General
- Target LESLIE NOTE.exe
- Size 5.6MB
- Sample260421-eahc4sbs6v
- SHA256 f2867bbe82532fd268ea9ad20a83724700168f45d2017bd56e27f8b72c6450fe
Malware Config
Signatures
- ConfuserEx .NET packer 7 IoCs
Detects ConfuserEx .NET packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\LESLIE NOTE.exe"C:\Users\Admin\AppData\Local\Temp\LESLIE NOTE.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\LNLoading.exe"C:\Users\Admin\AppData\Local\Temp\LNLoading.exe" 02⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3156-17-0x000001FBB3750000-0x000001FBB3892000-memory.dmp
memory/3156-35-0x000001FBCDF60000-0x000001FBCDF70000-memory.dmp
memory/3156-19-0x000001FBCDF60000-0x000001FBCDF70000-memory.dmp
memory/3156-18-0x000001FBB3CD0000-0x000001FBB3D5A000-memory.dmp
memory/3756-14-0x00000210F85D0000-0x00000210F868A000-memory.dmp
memory/3756-4-0x00000210F1670000-0x00000210F1818000-memory.dmp
memory/3756-6-0x00000210F0600000-0x00000210F0624000-memory.dmp
memory/3756-7-0x00000210F0620000-0x00000210F063A000-memory.dmp
memory/3756-8-0x00000210F0800000-0x00000210F0810000-memory.dmp
memory/3756-9-0x00000210F18D0000-0x00000210F18DE000-memory.dmp
memory/3756-10-0x00000210F0800000-0x00000210F0810000-memory.dmp
memory/3756-11-0x00000210F7070000-0x00000210F708C000-memory.dmp
memory/3756-12-0x00000210F0800000-0x00000210F0810000-memory.dmp
memory/3756-13-0x00000210F70C0000-0x00000210F70E8000-memory.dmp
memory/3756-0-0x00000210EE2C0000-0x00000210EE868000-memory.dmp
memory/3756-5-0x00000210EEC70000-0x00000210EEC76000-memory.dmp
memory/3756-3-0x00000210F0800000-0x00000210F0810000-memory.dmp
memory/3756-2-0x00000210EECC0000-0x00000210EED02000-memory.dmp
memory/3756-20-0x00000210FA0F0000-0x00000210FA150000-memory.dmp
memory/3756-21-0x00000210F2290000-0x00000210F22CA000-memory.dmp
memory/3756-22-0x00000210F2250000-0x00000210F2276000-memory.dmp
memory/3756-27-0x00000210F2320000-0x00000210F2342000-memory.dmp
memory/3756-29-0x00000210F25E0000-0x00000210F2690000-memory.dmp
memory/3756-31-0x00000210F0800000-0x00000210F0810000-memory.dmp
memory/3756-32-0x00000210F0800000-0x00000210F0810000-memory.dmp
memory/3756-33-0x00000210F0800000-0x00000210F0810000-memory.dmp
memory/3756-34-0x00000210F0800000-0x00000210F0810000-memory.dmp
memory/3756-1-0x00000210F0EF0000-0x00000210F166A000-memory.dmp