Analysis
- max time kernel
149s - max time network
129s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
06/05/2026, 16:17
General
- Target 605d22281f92f8af783bbc8bdd9f1201e427f5fae8cba7670d8a5d7894a195a7.exe
- Size 2.2MB
- Sample260506-trbn8aes9x
- SHA256 605d22281f92f8af783bbc8bdd9f1201e427f5fae8cba7670d8a5d7894a195a7
Malware Config
Signatures
- Manipulates Digital Signatures 1 TTPs 4 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Deletes itself 1 IoCs
- Executes dropped EXE 2 IoCs
- Drops file in System32 directory 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\605d22281f92f8af783bbc8bdd9f1201e427f5fae8cba7670d8a5d7894a195a7.exe"C:\Users\Admin\AppData\Local\Temp\605d22281f92f8af783bbc8bdd9f1201e427f5fae8cba7670d8a5d7894a195a7.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\605d22281f92f8af783bbc8bdd9f1201e427f5fae8cba7670d8a5d7894a195a7.exe"C:\Users\Admin\AppData\Local\Temp\605d22281f92f8af783bbc8bdd9f1201e427f5fae8cba7670d8a5d7894a195a7.exe" --no-service2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\605d22281f92f8af783bbc8bdd9f1201e427f5fae8cba7670d8a5d7894a195a7.exe"C:\Windows\system32\605d22281f92f8af783bbc8bdd9f1201e427f5fae8cba7670d8a5d7894a195a7.exe" --delete "C:\Users\Admin\AppData\Local\Temp\605d22281f92f8af783bbc8bdd9f1201e427f5fae8cba7670d8a5d7894a195a7.exe"3⤵
- Manipulates Digital Signatures
- Deletes itself
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\605d22281f92f8af783bbc8bdd9f1201e427f5fae8cba7670d8a5d7894a195a7.exe"C:\Windows\system32\605d22281f92f8af783bbc8bdd9f1201e427f5fae8cba7670d8a5d7894a195a7.exe" -admin1⤵
- Manipulates Digital Signatures
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
605d22281f92f8af783bbc8bdd9f1201e427f5fae8cba7670d8a5d7894a195a7.exe
memory/4320-0-0x00007FF62C170000-0x00007FF62C858000-memory.dmp
memory/4320-3-0x00007FF62C170000-0x00007FF62C858000-memory.dmp
memory/4320-2-0x000001980F9C0000-0x000001980F9F1000-memory.dmp
memory/4356-11-0x000002CACFED0000-0x000002CACFF01000-memory.dmp
memory/4356-12-0x00007FF62C170000-0x00007FF62C858000-memory.dmp
memory/4944-19-0x00007FF7B7DA0000-0x00007FF7B8488000-memory.dmp
memory/4944-16-0x0000025C34830000-0x0000025C34861000-memory.dmp
memory/5360-9-0x00007FF7B7DA0000-0x00007FF7B8488000-memory.dmp
memory/5360-20-0x00007FF7B7DA0000-0x00007FF7B8488000-memory.dmp
memory/5360-18-0x0000024941AD0000-0x0000024941ADC000-memory.dmp
memory/5360-17-0x0000024941A70000-0x0000024941AA1000-memory.dmp