Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
08/05/2026, 22:25
General
- Target PresentationFontCache.exe
- Size 3.4MB
- Sample260508-2cb1fae17z
- SHA256 ae597c76a6cbbb3eb1387c100438d292c07a2a083fbdcdae5e3cab70caa56d07
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Modifies registry key 1 TTPs 3 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PresentationFontCache.exe"C:\Users\Admin\AppData\Local\Temp\PresentationFontCache.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exe"attrib" +h C:\Users\Admin\AppData\Roaming\.netz2⤵
- Views/modifies file attributes
-
-
C:\Users\Admin\AppData\Roaming\.netz\PresentationFontCache.exe"C:\Users\Admin\AppData\Roaming\.netz\PresentationFontCache.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exe"reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v netz_bot3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exe"reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v netz_bot /d C:\Users\Admin\AppData\Roaming\.netz\PresentationFontCache.exe /f3⤵
- Adds Run key to start application
- Modifies registry key
-
-
-
C:\Users\Admin\AppData\Roaming\.netz\PresentationFontCache.exeC:\Users\Admin\AppData\Roaming\.netz\PresentationFontCache.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exe"reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v netz_bot2⤵
- Modifies registry key
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
PresentationFontCache.exe
bot_log.txt
bot_log.txt
memory/1360-20-0x000001C9A33A0000-0x000001C9A340B000-memory.dmp
memory/1360-15-0x00007FF612100000-0x00007FF612E9A000-memory.dmp
memory/1360-16-0x000001C9A33A0000-0x000001C9A340B000-memory.dmp
memory/1360-10-0x00007FF612100000-0x00007FF612E9A000-memory.dmp
memory/2084-12-0x00007FF612100000-0x00007FF612E9A000-memory.dmp
memory/2084-14-0x00000251CFD00000-0x00000251CFD6B000-memory.dmp
memory/2084-7-0x00007FF612100000-0x00007FF612E9A000-memory.dmp
memory/2084-18-0x00000251CFD00000-0x00000251CFD6B000-memory.dmp
memory/2084-54-0x00000251CFD00000-0x00000251CFD6B000-memory.dmp
memory/2084-53-0x00007FF612100000-0x00007FF612E9A000-memory.dmp
memory/4828-0-0x00007FF788D60000-0x00007FF789AFA000-memory.dmp
memory/4828-6-0x0000017E0CF90000-0x0000017E0CFFB000-memory.dmp
memory/4828-4-0x00007FF788D60000-0x00007FF789AFA000-memory.dmp