Overview
overview
7Static
static
3ZigWallet.exe
windows10-2004-x64
7ZigWallet.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3LICENSES.c...m.html
windows10-2004-x64
3LICENSES.c...m.html
windows11-21h2-x64
4Microsoft.exe
windows10-2004-x64
1d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows10-2004-x64
1resources/app.js
windows10-2004-x64
3resources/app.js
windows11-21h2-x64
3resources/elevate.exe
windows10-2004-x64
3resources/elevate.exe
windows11-21h2-x64
3vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...7z.dll
windows10-2004-x64
3$PLUGINSDI...7z.dll
windows11-21h2-x64
3Analysis
- max time kernel
150s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/04/2026, 04:30
Static task
static1
Behavioral task
behavioral1
Sample
ZigWallet.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
ZigWallet.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
Microsoft.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
d3dcompiler_47.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
ffmpeg.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
libEGL.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
libGLESv2.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
resources/app.js
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
resources/app.js
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral16
Sample
resources/elevate.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
resources/elevate.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral18
Sample
vk_swiftshader.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
vulkan-1.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20260130-en
windows11-21h2-x64
General
- Target Microsoft.exe
- Size 180.1MB
- Sample260426-e5bh2sfw7p
- SHA256 6343da9b2ced5c828d52aace4a8de1cb93dc338ddbd3c1185f0feaa69cfc85af
- MD5 c54a97043598a37be7948debe488d9a5
- SHA1 a2a49cfeb1c665ede548803fb6f02145d226a6e6
- SHA512 609323ff10977bfe553281bb8f5a31e236380df99d50f086d5521b8e25eadf73fb011de78e29bf6d387bd99b16f4646581a5f36cb4047101e1dc8646d0743add
- SSDEEP 1572864:A4SuXYuY8+xLxZu3Jidykta0iObusUd557Y8mn/XJjU0X+6s/na9ujx1JE+t8tT7:DWo3Cc1j9X
- TLSH T1B0988C03F39A40D9E01DD1758B5B9633EAB1B8894325A2DF27540B522F77EE86B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4480 Microsoft.exe 4480 Microsoft.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4492 Microsoft.exe Token: SeCreatePagefilePrivilege 4492 Microsoft.exe Token: SeShutdownPrivilege 4492 Microsoft.exe Token: SeCreatePagefilePrivilege 4492 Microsoft.exe Token: SeShutdownPrivilege 4492 Microsoft.exe Token: SeCreatePagefilePrivilege 4492 Microsoft.exe Token: SeShutdownPrivilege 4492 Microsoft.exe Token: SeCreatePagefilePrivilege 4492 Microsoft.exe Token: SeShutdownPrivilege 4492 Microsoft.exe Token: SeCreatePagefilePrivilege 4492 Microsoft.exe Token: SeShutdownPrivilege 4492 Microsoft.exe Token: SeCreatePagefilePrivilege 4492 Microsoft.exe Token: SeShutdownPrivilege 4492 Microsoft.exe Token: SeCreatePagefilePrivilege 4492 Microsoft.exe Token: SeShutdownPrivilege 4492 Microsoft.exe Token: SeCreatePagefilePrivilege 4492 Microsoft.exe Token: SeShutdownPrivilege 4492 Microsoft.exe Token: SeCreatePagefilePrivilege 4492 Microsoft.exe Token: SeShutdownPrivilege 4492 Microsoft.exe Token: SeCreatePagefilePrivilege 4492 Microsoft.exe Token: SeShutdownPrivilege 4492 Microsoft.exe Token: SeCreatePagefilePrivilege 4492 Microsoft.exe Token: SeShutdownPrivilege 4492 Microsoft.exe Token: SeCreatePagefilePrivilege 4492 Microsoft.exe Token: SeShutdownPrivilege 4492 Microsoft.exe Token: SeCreatePagefilePrivilege 4492 Microsoft.exe Token: SeShutdownPrivilege 4492 Microsoft.exe Token: SeCreatePagefilePrivilege 4492 Microsoft.exe Token: SeShutdownPrivilege 4492 Microsoft.exe Token: SeCreatePagefilePrivilege 4492 Microsoft.exe Token: SeShutdownPrivilege 4492 Microsoft.exe Token: SeCreatePagefilePrivilege 4492 Microsoft.exe Token: SeShutdownPrivilege 4492 Microsoft.exe Token: SeCreatePagefilePrivilege 4492 Microsoft.exe Token: SeShutdownPrivilege 4492 Microsoft.exe Token: SeCreatePagefilePrivilege 4492 Microsoft.exe Token: SeShutdownPrivilege 4492 Microsoft.exe Token: SeCreatePagefilePrivilege 4492 Microsoft.exe Token: SeShutdownPrivilege 4492 Microsoft.exe Token: SeCreatePagefilePrivilege 4492 Microsoft.exe Token: SeShutdownPrivilege 4492 Microsoft.exe Token: SeCreatePagefilePrivilege 4492 Microsoft.exe Token: SeShutdownPrivilege 4492 Microsoft.exe Token: SeCreatePagefilePrivilege 4492 Microsoft.exe Token: SeShutdownPrivilege 4492 Microsoft.exe Token: SeCreatePagefilePrivilege 4492 Microsoft.exe Token: SeShutdownPrivilege 4492 Microsoft.exe Token: SeCreatePagefilePrivilege 4492 Microsoft.exe Token: SeShutdownPrivilege 4492 Microsoft.exe Token: SeCreatePagefilePrivilege 4492 Microsoft.exe Token: SeShutdownPrivilege 4492 Microsoft.exe Token: SeCreatePagefilePrivilege 4492 Microsoft.exe Token: SeShutdownPrivilege 4492 Microsoft.exe Token: SeCreatePagefilePrivilege 4492 Microsoft.exe Token: SeShutdownPrivilege 4492 Microsoft.exe Token: SeCreatePagefilePrivilege 4492 Microsoft.exe Token: SeShutdownPrivilege 4492 Microsoft.exe Token: SeCreatePagefilePrivilege 4492 Microsoft.exe Token: SeShutdownPrivilege 4492 Microsoft.exe Token: SeCreatePagefilePrivilege 4492 Microsoft.exe Token: SeShutdownPrivilege 4492 Microsoft.exe Token: SeCreatePagefilePrivilege 4492 Microsoft.exe Token: SeShutdownPrivilege 4492 Microsoft.exe Token: SeCreatePagefilePrivilege 4492 Microsoft.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4744 wrote to memory of 4492 4744 Microsoft.exe 85 PID 4492 wrote to memory of 3808 4492 Microsoft.exe 86 PID 4492 wrote to memory of 3808 4492 Microsoft.exe 86 PID 4492 wrote to memory of 4728 4492 Microsoft.exe 87 PID 4492 wrote to memory of 4480 4492 Microsoft.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\Microsoft.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\Microsoft.exeC:\Users\Admin\AppData\Local\Temp\Microsoft.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\Microsoft.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Microsoft" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1964,i,15681104893780572377,13799425243871614435,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:23⤵PID:3808
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Microsoft" --field-trial-handle=2172,i,15681104893780572377,13799425243871614435,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:33⤵PID:4728
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Microsoft" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2624,i,15681104893780572377,13799425243871614435,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1064 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4480
-
-