Analysis
- user interaction
yes - max time kernel
104s - max time network
102s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
23/04/2026, 14:35
General
- Target ctxrtemutest.exe
- Size 43.5MB
- Sample260423-ryc5hsf13w
- SHA256 b040f33e0964338fc8a4c69f501c378341389a5da5c3e7e38f6fa6c387af9a65
Malware Config
Signatures
- Loads dropped DLL 64 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 3 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 6 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ctxrtemutest.exe"C:\Users\Admin\AppData\Local\Temp\ctxrtemutest.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ctxrtemutest.exe"C:\Users\Admin\AppData\Local\Temp\ctxrtemutest.exe"2⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\ctxrtemutest.exe"C:\Users\Admin\AppData\Local\Temp\ctxrtemutest.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ctxrtemutest.exe"C:\Users\Admin\AppData\Local\Temp\ctxrtemutest.exe"2⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\ctxrtemutest.exe"C:\Users\Admin\AppData\Local\Temp\ctxrtemutest.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ctxrtemutest.exe"C:\Users\Admin\AppData\Local\Temp\ctxrtemutest.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
1733596de393459890cf6977d6063116.tmp
qt_help_en.qm
_SHA224.pyd
cd.cp313-win_amd64.pyd
81d243bd2c585b0f4821__mypyc.cp313-win_amd64.pyd
MSVCP140.dll
MSVCP140_1.dll
Qt6Core.dll
QtCore.pyd
sip.cp313-win_amd64.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_asyncio.pyd
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_multiprocessing.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_uuid.pyd
_wmi.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyexpat.pyd
python3.dll
python313.dll
pywintypes313.dll
select.pyd
Lorem ipsum.txt
unicodedata.pyd
win32file.pyd
win32pipe.pyd
win32security.pyd
winsound.pyd
memory/1252-276-0x00007FFE2DFE1000-0x00007FFE2E14F000-memory.dmp
memory/1252-277-0x00007FFE4BF30000-0x00007FFE4BF32000-memory.dmp
memory/1252-297-0x00007FFE2DC00000-0x00007FFE2E586000-memory.dmp
memory/1252-298-0x00007FFE2CFB0000-0x00007FFE2D5FA000-memory.dmp
memory/1252-300-0x00007FFE2C3F0000-0x00007FFE2C629000-memory.dmp
memory/1252-299-0x00007FFE2D600000-0x00007FFE2DADB000-memory.dmp
memory/1252-301-0x00007FFE2DC00000-0x00007FFE2E586000-memory.dmp
memory/1252-302-0x0000017A40300000-0x0000017A4036B000-memory.dmp
memory/1252-303-0x00007FFE2DFE1000-0x00007FFE2E14F000-memory.dmp
memory/1252-304-0x00007FFE2DC00000-0x00007FFE2E586000-memory.dmp
memory/1252-281-0x00007FFE2DC00000-0x00007FFE2E586000-memory.dmp
memory/1252-289-0x0000017A41E20000-0x0000017A41E30000-memory.dmp
memory/1252-267-0x00007FFE2EFA0000-0x00007FFE2F22F000-memory.dmp
memory/4412-754-0x00007FFE4BF30000-0x00007FFE4BF32000-memory.dmp
memory/4412-749-0x00007FFE2D5D0000-0x00007FFE2D85F000-memory.dmp
memory/4412-763-0x0000022C83250000-0x0000022C832BB000-memory.dmp
memory/4412-762-0x00007FFE2B4F0000-0x00007FFE2B729000-memory.dmp
memory/4412-761-0x00007FFE2A960000-0x00007FFE2AFAA000-memory.dmp
memory/4412-760-0x00007FFE2B730000-0x00007FFE2BC0B000-memory.dmp
memory/4412-759-0x0000022C84900000-0x0000022C84910000-memory.dmp
memory/4412-755-0x00007FFE2BC10000-0x00007FFE2C596000-memory.dmp
memory/4808-533-0x00007FFE29590000-0x00007FFE297C9000-memory.dmp
memory/4808-519-0x00007FFE2CD20000-0x00007FFE2CFAF000-memory.dmp
memory/4808-525-0x00007FFE4BF30000-0x00007FFE4BF32000-memory.dmp
memory/4808-526-0x00007FFE2B980000-0x00007FFE2C306000-memory.dmp
memory/4808-534-0x0000018AF5BB0000-0x0000018AF5C1B000-memory.dmp
memory/4808-530-0x0000018AF7220000-0x0000018AF7230000-memory.dmp
memory/4808-531-0x00007FFE2A750000-0x00007FFE2AC2B000-memory.dmp
memory/4808-532-0x00007FFE297D0000-0x00007FFE29E1A000-memory.dmp