Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
08/05/2026, 22:25
General
- Target PresentationFontCache.exe
- Size 3.4MB
- Sample260508-2cb1fae17z
- SHA256 ae597c76a6cbbb3eb1387c100438d292c07a2a083fbdcdae5e3cab70caa56d07
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Modifies registry key 1 TTPs 3 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PresentationFontCache.exe"C:\Users\Admin\AppData\Local\Temp\PresentationFontCache.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exe"attrib" +h C:\Users\Admin\AppData\Roaming\.netz2⤵
- Views/modifies file attributes
-
-
C:\Users\Admin\AppData\Roaming\.netz\PresentationFontCache.exe"C:\Users\Admin\AppData\Roaming\.netz\PresentationFontCache.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exe"reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v netz_bot3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exe"reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v netz_bot /d C:\Users\Admin\AppData\Roaming\.netz\PresentationFontCache.exe /f3⤵
- Adds Run key to start application
- Modifies registry key
-
-
-
C:\Users\Admin\AppData\Roaming\.netz\PresentationFontCache.exeC:\Users\Admin\AppData\Roaming\.netz\PresentationFontCache.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exe"reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v netz_bot2⤵
- Modifies registry key
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
PresentationFontCache.exe
bot_log.txt
bot_log.txt
memory/5888-22-0x00007FF7E1640000-0x00007FF7E23DA000-memory.dmp
memory/5888-15-0x000001A4E66E0000-0x000001A4E67B6000-memory.dmp
memory/5888-7-0x00007FF7E1640000-0x00007FF7E23DA000-memory.dmp
memory/5888-13-0x00007FF7E1640000-0x00007FF7E23DA000-memory.dmp
memory/5920-12-0x00007FF626C50000-0x00007FF6279EA000-memory.dmp
memory/5920-0-0x00007FF626C50000-0x00007FF6279EA000-memory.dmp
memory/5920-6-0x0000017679870000-0x0000017679946000-memory.dmp
memory/5920-5-0x00007FF626C50000-0x00007FF6279EA000-memory.dmp
memory/6104-10-0x00007FF7E1640000-0x00007FF7E23DA000-memory.dmp
memory/6104-16-0x00007FF7E1640000-0x00007FF7E23DA000-memory.dmp
memory/6104-17-0x0000026291AB0000-0x0000026291B86000-memory.dmp
memory/6104-24-0x00007FF7E1640000-0x00007FF7E23DA000-memory.dmp
memory/6104-32-0x00007FF7E1640000-0x00007FF7E23DA000-memory.dmp