Analysis
- max time kernel
149s - max time network
103s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
- submitted
06/05/2026, 16:16
General
- Target Windows小工具.exe
- Size 968KB
- Sample260506-trbdfses81
- SHA256 233a9ef2f890d6b4a4a83dd1867fe825d5bcb86c37a3a05183fbd3c1004d4cb7
Malware Config
Signatures
- UPX packed file 28 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Windows小工具.exe"C:\Users\Admin\AppData\Local\Temp\Windows小工具.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c systeminfo2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\systeminfo.exesysteminfo3⤵
- System Location Discovery: System Language Discovery
- Gathers system information
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2260-48-0x0000000001570000-0x000000000160C000-memory.dmp
memory/5876-20-0x0000000010000000-0x000000001003E000-memory.dmp
memory/5876-5-0x0000000010000000-0x000000001003E000-memory.dmp
memory/5876-47-0x0000000010000000-0x000000001003E000-memory.dmp
memory/5876-44-0x0000000010000000-0x000000001003E000-memory.dmp
memory/5876-42-0x0000000010000000-0x000000001003E000-memory.dmp
memory/5876-38-0x0000000010000000-0x000000001003E000-memory.dmp
memory/5876-36-0x0000000010000000-0x000000001003E000-memory.dmp
memory/5876-34-0x0000000010000000-0x000000001003E000-memory.dmp
memory/5876-32-0x0000000010000000-0x000000001003E000-memory.dmp
memory/5876-30-0x0000000010000000-0x000000001003E000-memory.dmp
memory/5876-28-0x0000000010000000-0x000000001003E000-memory.dmp
memory/5876-26-0x0000000010000000-0x000000001003E000-memory.dmp
memory/5876-22-0x0000000010000000-0x000000001003E000-memory.dmp
memory/5876-0-0x0000000010000000-0x000000001003E000-memory.dmp
memory/5876-46-0x0000000010000000-0x000000001003E000-memory.dmp
memory/5876-14-0x0000000010000000-0x000000001003E000-memory.dmp
memory/5876-18-0x0000000010000000-0x000000001003E000-memory.dmp
memory/5876-12-0x0000000010000000-0x000000001003E000-memory.dmp
memory/5876-6-0x0000000010000000-0x000000001003E000-memory.dmp
memory/5876-16-0x0000000010000000-0x000000001003E000-memory.dmp
memory/5876-4-0x0000000010000000-0x000000001003E000-memory.dmp
memory/5876-24-0x0000000010000000-0x000000001003E000-memory.dmp
memory/5876-10-0x0000000010000000-0x000000001003E000-memory.dmp
memory/5876-8-0x0000000010000000-0x000000001003E000-memory.dmp
memory/5876-3-0x0000000010000000-0x000000001003E000-memory.dmp
memory/5876-2-0x0000000010000000-0x000000001003E000-memory.dmp
memory/5876-40-0x0000000010000000-0x000000001003E000-memory.dmp
memory/5876-49-0x0000000010000000-0x000000001003E000-memory.dmp
memory/5876-50-0x0000000000AC0000-0x0000000000B5C000-memory.dmp