Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
21/04/2026, 18:24
General
- Target Tax Assessment Letter.exe
- Size 1.9MB
- Sample260421-w2celsat8q
- SHA256 facf78d474b66ed821288db41fa6ad8a7b6f30650eb12127cb3e9a3cc6146116
Malware Config
Signatures
- Drops file in System32 directory 4 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Drops file in Program Files directory 6 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 5 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\Overwolf.exe"C:\Program Files\Common Files\Overwolf.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{F8284233-48F4-4680-ADDD-F8284233}3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\Tax Assessment Letter.exe"C:\Users\Admin\AppData\Local\Temp\Tax Assessment Letter.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Overwolf.exe
vulkan-1.bin
vulkan-1.dll
Schedule Work
Schedule Work
memory/448-11-0x00007FFE02770000-0x00007FFE03038000-memory.dmp
memory/448-10-0x00007FF6BE760000-0x00007FF6BE944000-memory.dmp
memory/448-8-0x000001EA6F7D0000-0x000001EA6F7D1000-memory.dmp
memory/448-5-0x00007FFE02770000-0x00007FFE03038000-memory.dmp
memory/448-12-0x000001EA6FA00000-0x000001EA6FA55000-memory.dmp
memory/448-4-0x00007FFE1EEF0000-0x00007FFE1F0E5000-memory.dmp
memory/448-0-0x0000000180000000-0x000000018004B000-memory.dmp
memory/1188-21-0x0000019A03FC0000-0x0000019A03FC1000-memory.dmp
memory/1188-24-0x0000000180000000-0x000000018004B000-memory.dmp
memory/1596-20-0x00007FFE1EEF0000-0x00007FFE1F0E5000-memory.dmp
memory/1596-14-0x00007FFE02770000-0x00007FFE03038000-memory.dmp
memory/1596-36-0x0000019C53010000-0x0000019C53065000-memory.dmp
memory/1596-37-0x00007FFE02770000-0x00007FFE03038000-memory.dmp
memory/1596-16-0x0000000180000000-0x000000018004B000-memory.dmp
memory/3340-28-0x0000026E5B090000-0x0000026E5B091000-memory.dmp
memory/3340-39-0x0000026E5C200000-0x0000026E5C26D000-memory.dmp
memory/3340-43-0x00007FFE1EEF0000-0x00007FFE1F0E5000-memory.dmp
memory/3340-68-0x0000026E5B8A0000-0x0000026E5B8F5000-memory.dmp
memory/3340-30-0x0000000180000000-0x000000018004B000-memory.dmp
memory/3340-34-0x00007FFE1EEF0000-0x00007FFE1F0E5000-memory.dmp
memory/4744-50-0x0000015186FB0000-0x0000015186FB1000-memory.dmp
memory/4744-57-0x00007FFE1EEF0000-0x00007FFE1F0E5000-memory.dmp
memory/4744-53-0x0000000180000000-0x000000018006D000-memory.dmp
memory/4744-69-0x0000015188A60000-0x0000015188AB5000-memory.dmp