Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
30/04/2026, 04:28
General
- Target b80a0c3ffe3c6de924c5caf9cb1ddb5a9e8442e5b4d4d6f7579c482bc60db541.exe
- Size 15.8MB
- Sample260430-e3x92aay3w
- SHA256 b80a0c3ffe3c6de924c5caf9cb1ddb5a9e8442e5b4d4d6f7579c482bc60db541
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 23 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b80a0c3ffe3c6de924c5caf9cb1ddb5a9e8442e5b4d4d6f7579c482bc60db541.exe"C:\Users\Admin\AppData\Local\Temp\b80a0c3ffe3c6de924c5caf9cb1ddb5a9e8442e5b4d4d6f7579c482bc60db541.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Mxt263\bin\XWin_MobaX.exe"C:\Users\Admin\AppData\Local\Temp\Mxt263\bin\XWin_MobaX.exe" -silent-dup-error -notrayicon -nolisten inet6 -hostintitle +bs -clipboard -nowgl -multiwindow -noreset :02⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Mxt263\bin\xkbcomp_w32.exe"C:\Users\Admin\AppData\Local\Temp\Mxt263\bin\xkbcomp_w32.exe" -w 1 "-RC:\Users\Admin\AppData\Local\Temp\Mxt263\usr\share\X11\xkb" -xkm "C:\Users\Admin\AppData\Local\Temp\Mxt263\var\log\xwin\xkb_a04344" -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" "C:\Users\Admin\AppData\Local\Temp\Mxt263\var\log\xwin\server-0.xkm"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
XWin_MobaX.exe
libX11-6.dll
libXau-6.dll
libXdmcp-6.dll
libdl.dll
libgcc_s_dw2-1.dll
libglapi-0.dll
libwinpthread-1.dll
libxcb-1.dll
libxcb-image-0.dll
libxcb-shm-0.dll
libxcb-util-1.dll
swrast_dri.so
xkbcomp_w32.exe
zlib1.dll
http
media
Compose
XI18N_OBJS
accessx
basic
complete
iso9995
ledcaps
lednum
mousekeys
pc
aliases
xfree86
base
mokeypad
basic
complete
extra
iso9995
level5
mousekeys
numpad
pc
7x13-ISO8859-1.pcf
cursor.pcf
fonts.alias
fonts.dir
xkb_a04344
memory/2924-1486-0x000000006DDC0000-0x000000006DDE0000-memory.dmp
memory/2924-1488-0x000000006DBC0000-0x000000006DBCF000-memory.dmp
memory/2924-1482-0x000000006C370000-0x000000006C4B3000-memory.dmp
memory/2924-1483-0x000000006DFD0000-0x000000006DFF3000-memory.dmp
memory/2924-1484-0x000000006E010000-0x000000006E02C000-memory.dmp
memory/2924-1485-0x000000006DC20000-0x000000006DC48000-memory.dmp
memory/2924-1481-0x0000000000400000-0x0000000000450000-memory.dmp
memory/2924-1487-0x000000006DC50000-0x000000006DC5D000-memory.dmp
memory/3052-1497-0x000000006DDC0000-0x000000006DDE0000-memory.dmp
memory/3052-1501-0x000000006C370000-0x000000006C4B3000-memory.dmp
memory/3052-1496-0x000000006E010000-0x000000006E02C000-memory.dmp
memory/3052-1504-0x000000006DAB0000-0x000000006DACE000-memory.dmp
memory/3052-1498-0x000000006DBF0000-0x000000006DBFE000-memory.dmp
memory/3052-1499-0x000000006DBD0000-0x000000006DBDE000-memory.dmp
memory/3052-1500-0x000000006DC50000-0x000000006DC5D000-memory.dmp
memory/3052-1507-0x0000000001340000-0x0000000001942000-memory.dmp
memory/3052-1502-0x000000006DC20000-0x000000006DC48000-memory.dmp
memory/3052-1503-0x000000006DBC0000-0x000000006DBCF000-memory.dmp
memory/3052-1495-0x0000000000400000-0x0000000000788000-memory.dmp
memory/3052-1506-0x000000006DFD0000-0x000000006DFF3000-memory.dmp
memory/3052-1509-0x000000006DEA0000-0x000000006DEDB000-memory.dmp
memory/3052-1508-0x000000006D4F0000-0x000000006DAA8000-memory.dmp
memory/3052-1505-0x000000006DBE0000-0x000000006DBED000-memory.dmp
memory/4672-3-0x0000000006A10000-0x0000000006A11000-memory.dmp
memory/4672-1494-0x0000000006A10000-0x0000000006A11000-memory.dmp
memory/4672-1493-0x0000000004DA0000-0x0000000004DA1000-memory.dmp
memory/4672-1491-0x0000000000400000-0x0000000001C3E000-memory.dmp
memory/4672-1492-0x0000000002320000-0x0000000002922000-memory.dmp
memory/4672-1490-0x0000000004250000-0x0000000004251000-memory.dmp
memory/4672-1489-0x0000000000400000-0x0000000001C3E000-memory.dmp
memory/4672-1-0x0000000004250000-0x0000000004251000-memory.dmp
memory/4672-2-0x0000000004DA0000-0x0000000004DA1000-memory.dmp
memory/4672-0-0x0000000000400000-0x0000000001C3E000-memory.dmp
memory/4672-1510-0x0000000000400000-0x0000000001C3E000-memory.dmp