Analysis
- user interaction
yes - max time kernel
0s - max time network
11s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
06/05/2026, 09:43
Errors
General
- Target mod_my_l.exe
- Size 22KB
- Sample260506-lp88psex4v
- SHA256 7a8d7b846f26b7b00b3c03b7188e7ebfc4112093749023c63246d6b14b6d7f69
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\mod_my_l.exe"C:\Users\Admin\AppData\Local\Temp\mod_my_l.exe"1⤵
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
RGIEC83.tmp
memory/828-3-0x000001D4FFE70000-0x000001D4FFEC9000-memory.dmp
memory/828-2-0x000001D4FFE70000-0x000001D4FFEC9000-memory.dmp
memory/828-0-0x000001D4FFE70000-0x000001D4FFEC9000-memory.dmp
memory/828-4-0x000001D4FFE70000-0x000001D4FFEC9000-memory.dmp
memory/828-5-0x00007FFB2D765000-0x00007FFB2D766000-memory.dmp
memory/828-6-0x000001D4FFF30000-0x000001D4FFF6C000-memory.dmp
memory/828-1-0x000001D4FFE70000-0x000001D4FFEC9000-memory.dmp
memory/828-34-0x00007FFB2D4B0000-0x00007FFB2DE51000-memory.dmp
memory/828-35-0x00007FFB2D4B0000-0x00007FFB2DE51000-memory.dmp
memory/828-36-0x00007FFB2D4B0000-0x00007FFB2DE51000-memory.dmp
memory/828-37-0x0000000000BD0000-0x0000000000BE9000-memory.dmp
memory/984-7-0x00000234842D0000-0x000002348436A000-memory.dmp
memory/5048-8-0x00007FF76AB90000-0x00007FF76AB9C000-memory.dmp