Analysis
- user interaction
yes - max time kernel
102s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
29/04/2026, 18:45
General
- Target AME Beta.exe
- Size 146.6MB
- Sample260429-xd97eaez4s
- SHA256 a637f32b64e1493b315db9139065105656c84518dca20ce3b18c89750ee40c82
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\AME Beta.exe"C:\Users\Admin\AppData\Local\Temp\AME Beta.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AME Beta.exe"C:\Users\Admin\AppData\Local\Temp\AME Beta.exe" "C:\Users\Admin\AppData\Local\Temp\AME" Interprocess Administrator --Mode TwoWay --Nodes Level=User:ProcessID=3708 --Host 37082⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Microsoft.Bcl.AsyncInterfaces.dll
Microsoft.Win32.TaskScheduler.dll
Newtonsoft.Json.dll
SharpSevenZip.dll
System.Buffers.dll
System.IO.Pipelines.dll
System.Memory.dll
System.Numerics.Vectors.dll
System.Runtime.CompilerServices.Unsafe.dll
System.Text.Encodings.Web.dll
System.Text.Json.dll
System.Threading.Tasks.Extensions.dll
YamlDotNet.dll
memory/3320-119-0x00000251A2820000-0x00000251A2830000-memory.dmp
memory/3320-150-0x00000251A2820000-0x00000251A2830000-memory.dmp
memory/3320-151-0x00000251A2750000-0x00000251A275C000-memory.dmp
memory/3320-152-0x00000251A2820000-0x00000251A2830000-memory.dmp
memory/3320-117-0x00000251A2920000-0x00000251A2940000-memory.dmp
memory/3320-112-0x00000251A2820000-0x00000251A2830000-memory.dmp
memory/3708-99-0x0000015770950000-0x000001577095A000-memory.dmp
memory/3708-88-0x00000157709D0000-0x0000015770A92000-memory.dmp
memory/3708-109-0x0000015771230000-0x0000015771248000-memory.dmp
memory/3708-105-0x0000015771280000-0x00000157712D8000-memory.dmp
memory/3708-102-0x0000015770970000-0x000001577097A000-memory.dmp
memory/3708-100-0x0000015770890000-0x0000015770898000-memory.dmp
memory/3708-0-0x0000015764F20000-0x0000015765F20000-memory.dmp
memory/3708-97-0x0000015770AA0000-0x0000015770ABA000-memory.dmp
memory/3708-132-0x00000157713E0000-0x0000015771400000-memory.dmp
memory/3708-128-0x00000157714F0000-0x0000015771614000-memory.dmp
memory/3708-95-0x0000015770960000-0x0000015770968000-memory.dmp
memory/3708-93-0x0000015770980000-0x00000157709A8000-memory.dmp
memory/3708-91-0x00000157708A0000-0x00000157708AA000-memory.dmp
memory/3708-133-0x00000157713D0000-0x00000157713D8000-memory.dmp
memory/3708-89-0x0000015770850000-0x0000015770860000-memory.dmp
memory/3708-111-0x0000015771250000-0x000001577126E000-memory.dmp
memory/3708-86-0x0000015770860000-0x000001577087A000-memory.dmp
memory/3708-137-0x0000015773720000-0x0000015773758000-memory.dmp
memory/3708-138-0x00000157714B0000-0x00000157714BE000-memory.dmp
memory/3708-141-0x0000015774E20000-0x0000015774ED4000-memory.dmp
memory/3708-83-0x0000015770AD0000-0x0000015770C9A000-memory.dmp
memory/3708-146-0x000001576FCF0000-0x000001576FCFC000-memory.dmp
memory/3708-148-0x0000015770850000-0x0000015770860000-memory.dmp
memory/3708-147-0x00000157712E0000-0x000001577134B000-memory.dmp
memory/3708-149-0x0000015770850000-0x0000015770860000-memory.dmp
memory/3708-81-0x00000157708B0000-0x00000157708FE000-memory.dmp
memory/3708-77-0x00000157781A0000-0x00000157791A0000-memory.dmp
memory/3708-1-0x0000015770850000-0x0000015770860000-memory.dmp
memory/3708-157-0x0000015774CD0000-0x0000015774CE8000-memory.dmp
memory/3708-159-0x00000157759E0000-0x0000015775A56000-memory.dmp
memory/3708-162-0x00000157712E0000-0x000001577134B000-memory.dmp