Analysis
- max time kernel
149s - max time network
91s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
10/05/2026, 01:57
General
- Target Lifenz Booster Utility.exe
- Size 110KB
- Sample260510-cdsl5sa14k
- SHA256 f87e88c9ebf0b5c7a7e92b7c093397abce3e78488b4557da404161a4faf8004c
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lifenz Booster Utility.exe"C:\Users\Admin\AppData\Local\Temp\Lifenz Booster Utility.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qaaedfyh\qaaedfyh.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES34F6.tmp" "c:\Users\Admin\AppData\Local\Temp\qaaedfyh\CSCC56865EC07E44A7A8D1BB70EF9B86DA.TMP"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
RES34F6.tmp
__PSScriptPolicyTest_oi2wz3u2.mle.ps1
qaaedfyh.dll
CSCC56865EC07E44A7A8D1BB70EF9B86DA.TMP
qaaedfyh.0.cs
qaaedfyh.cmdline
memory/1044-62-0x000000001E7C0000-0x000000001E7F8000-memory.dmp
memory/1044-48-0x000000001D670000-0x000000001D67A000-memory.dmp
memory/1044-8-0x0000000002C80000-0x0000000002CA2000-memory.dmp
memory/1044-76-0x000000001B5B0000-0x000000001B74A000-memory.dmp
memory/1044-72-0x000000001BA20000-0x000000001BA30000-memory.dmp
memory/1044-70-0x000000001BA20000-0x000000001BA30000-memory.dmp
memory/1044-7-0x000000001BA20000-0x000000001BA30000-memory.dmp
memory/1044-25-0x0000000002CB0000-0x0000000002CBC000-memory.dmp
memory/1044-26-0x00007FF4D7CC0000-0x00007FF4D7CD0000-memory.dmp
memory/1044-33-0x000000001D140000-0x000000001D15C000-memory.dmp
memory/1044-34-0x000000001D160000-0x000000001D213000-memory.dmp
memory/1044-35-0x000000001CD90000-0x000000001CD9A000-memory.dmp
memory/1044-36-0x000000001D250000-0x000000001D27A000-memory.dmp
memory/1044-37-0x000000001D250000-0x000000001D274000-memory.dmp
memory/1044-38-0x000000001BA20000-0x000000001BA30000-memory.dmp
memory/1044-46-0x000000001D640000-0x000000001D65C000-memory.dmp
memory/1044-47-0x000000001D660000-0x000000001D66A000-memory.dmp
memory/1044-9-0x000000001BA20000-0x000000001BA30000-memory.dmp
memory/1044-49-0x000000001BA20000-0x000000001BA30000-memory.dmp
memory/1044-56-0x000000001D780000-0x000000001D79A000-memory.dmp
memory/1044-57-0x000000001D640000-0x000000001D648000-memory.dmp
memory/1044-58-0x000000001D650000-0x000000001D656000-memory.dmp
memory/1044-59-0x000000001D660000-0x000000001D66A000-memory.dmp
memory/1044-61-0x000000001DA70000-0x000000001DA78000-memory.dmp
memory/1044-0-0x0000000000950000-0x0000000000972000-memory.dmp
memory/1044-63-0x000000001E790000-0x000000001E79E000-memory.dmp
memory/1044-64-0x000000001BA20000-0x000000001BA30000-memory.dmp
memory/1044-65-0x000000001BA20000-0x000000001BA30000-memory.dmp
memory/1044-67-0x0000000001190000-0x000000000119C000-memory.dmp
memory/1044-69-0x00007FF4D7CC0000-0x00007FF4D7CD0000-memory.dmp
memory/1044-68-0x0000000002A80000-0x0000000002A92000-memory.dmp
memory/1044-66-0x000000001B5B0000-0x000000001B74A000-memory.dmp
memory/2436-19-0x000002A28F0E0000-0x000002A28F0EC000-memory.dmp
memory/3552-22-0x0000019B83060000-0x0000019B830BD000-memory.dmp
memory/3552-23-0x0000019B82F40000-0x0000019B82F4C000-memory.dmp