Analysis
- max time kernel
149s - max time network
97s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
01/05/2026, 04:38
General
- Target Camtasia (2021) v2021.0.8 Build 32516/camtasia.exe
- Size 453.5MB
- Sample260501-e9d5qsgs4l
- SHA256 171a97520d980f2be0df770513e354ba3f8cbe39a40a52fab0c1961c42c31a68
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 13 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Camtasia (2021) v2021.0.8 Build 32516\camtasia.exe"C:\Users\Admin\AppData\Local\Temp\Camtasia (2021) v2021.0.8 Build 32516\camtasia.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{396EE107-4E7B-464C-B1AA-7DBAA892AB00}\.cr\camtasia.exe"C:\Windows\Temp\{396EE107-4E7B-464C-B1AA-7DBAA892AB00}\.cr\camtasia.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\Camtasia (2021) v2021.0.8 Build 32516\camtasia.exe" -burn.filehandle.attached=564 -burn.filehandle.self=5722⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
camtasia.exe
BootstrapperCore.config
BootstrapperCore.dll
CamtasiaBootstrapperApplication.dll
EditionConstants.dll
System.Windows.Interactivity.dll
WPFCommonControls.dll
WPFCommonViewModel.dll
mbahost.dll
memory/5016-88-0x0000000006740000-0x0000000006750000-memory.dmp
memory/5016-94-0x0000000006790000-0x00000000067D0000-memory.dmp
memory/5016-79-0x0000000005D40000-0x0000000005D50000-memory.dmp
memory/5016-74-0x0000000006150000-0x000000000620A000-memory.dmp
memory/5016-84-0x00000000036A0000-0x00000000036A8000-memory.dmp
memory/5016-67-0x0000000005D40000-0x0000000005D50000-memory.dmp
memory/5016-66-0x00000000034E0000-0x00000000034F8000-memory.dmp
memory/5016-61-0x0000000005D40000-0x0000000005D50000-memory.dmp
memory/5016-92-0x00000000067E0000-0x0000000006870000-memory.dmp
memory/5016-78-0x0000000003580000-0x000000000358A000-memory.dmp
memory/5016-95-0x0000000005D40000-0x0000000005D50000-memory.dmp
memory/5016-96-0x0000000008B40000-0x0000000008B48000-memory.dmp
memory/5016-97-0x000000000B440000-0x000000000B478000-memory.dmp
memory/5016-98-0x000000000B400000-0x000000000B40E000-memory.dmp
memory/5016-99-0x0000000005D40000-0x0000000005D50000-memory.dmp
memory/5016-100-0x0000000005D40000-0x0000000005D50000-memory.dmp
memory/5016-101-0x0000000005D40000-0x0000000005D50000-memory.dmp
memory/5016-102-0x0000000005D40000-0x0000000005D50000-memory.dmp
memory/5016-103-0x0000000005D40000-0x0000000005D50000-memory.dmp