Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
08/05/2026, 22:58
General
- Target dotnet-sdk-10.0.203-win-x64.exe
- Size 206.1MB
- Sample260508-2yadqsft61
- SHA256 fa6979cfbf3b7e9822828c2f1c8fa4de6e92fa7ae319e4c8882b50f7b0aeabff
Score
4/10
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dotnet-sdk-10.0.203-win-x64.exe"C:\Users\Admin\AppData\Local\Temp\dotnet-sdk-10.0.203-win-x64.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\TEMP\{5D69D440-FA9E-4EC9-B404-B12C5C6CBC06}\.ba\wixstdba.exe"C:\Windows\TEMP\{5D69D440-FA9E-4EC9-B404-B12C5C6CBC06}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{BABE348F-C8FC-46F7-9D28-85189F8A1BE2} {C861706C-9744-46D0-9E05-023C1AC6C859}2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
BootstrapperApplicationData.xml
DotNetLogo_256x.png
dotnet.ico
thm.wxl
thm.xml
wixstdba.exe
memory/5016-29-0x0000000002850000-0x000000000292A000-memory.dmp
memory/5016-36-0x0000000002850000-0x000000000292A000-memory.dmp
memory/5052-28-0x0000000002F90000-0x000000000306A000-memory.dmp
memory/5052-38-0x0000000002F90000-0x000000000306A000-memory.dmp