Analysis
- user interaction
yes - max time kernel
3s - max time network
12s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
23/05/2026, 14:04
General
- Target AnyDeskGrabber.exe
- Size 14.3MB
- Sample260523-rdms8aaw8n
- SHA256 0ca02a36b2a3f5c9c1b762ae974da280116bf6574d046f757e381d20dcc6ab8f
Malware Config
Signatures
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnyDeskGrabber.exe"C:\Users\Admin\AppData\Local\Temp\AnyDeskGrabber.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\AnyDeskGrabber.exeC:\Users\Admin\AppData\Local\Temp\AnyDeskGrabber.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
elevation_service.exe
python3.dll
python311.dll
DiagnosticsHub.StandardCollector.Service.exe
FXSSVC.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
WmiApSrv.exe
wbengine.exe
StructuredQuerySchema.bin
memory/220-241-0x0000000000400000-0x00000000005D6000-memory.dmp
memory/220-160-0x0000000000400000-0x00000000005D6000-memory.dmp
memory/536-32-0x0000000140000000-0x00000001401E9000-memory.dmp
memory/536-15-0x0000000000730000-0x0000000000790000-memory.dmp
memory/536-24-0x0000000000730000-0x0000000000790000-memory.dmp
memory/1076-418-0x0000000140000000-0x0000000140241000-memory.dmp
memory/1552-50-0x0000000000D10000-0x0000000000D70000-memory.dmp
memory/1552-56-0x0000000000D10000-0x0000000000D70000-memory.dmp
memory/1552-58-0x0000000140000000-0x00000001402E9000-memory.dmp
memory/1640-245-0x0000000140000000-0x00000001401D5000-memory.dmp
memory/1748-47-0x0000000140000000-0x0000000140136000-memory.dmp
memory/1860-417-0x0000000140000000-0x0000000140149000-memory.dmp
memory/1920-191-0x0000000140000000-0x00000001401C1000-memory.dmp
memory/1920-257-0x0000000140000000-0x00000001401C1000-memory.dmp
memory/2172-236-0x0000000140000000-0x0000000140209000-memory.dmp
memory/2212-75-0x00000000006D0000-0x0000000000730000-memory.dmp
memory/2440-242-0x0000000140000000-0x0000000140216000-memory.dmp
memory/2444-258-0x0000000140000000-0x0000000140172000-memory.dmp
memory/2444-305-0x000000000A520000-0x000000000A528000-memory.dmp
memory/2444-286-0x0000000001EE0000-0x0000000001EF0000-memory.dmp
memory/2444-270-0x0000000001C30000-0x0000000001C40000-memory.dmp
memory/2444-255-0x0000000000910000-0x0000000000970000-memory.dmp
memory/2444-249-0x0000000000910000-0x0000000000970000-memory.dmp
memory/2736-8-0x0000000140000000-0x0000000140E73000-memory.dmp
memory/2736-6-0x0000000000670000-0x00000000006D0000-memory.dmp
memory/2736-0-0x0000000000670000-0x00000000006D0000-memory.dmp
memory/2880-97-0x0000000140000000-0x0000000140214000-memory.dmp
memory/2880-99-0x0000000000CA0000-0x0000000000D00000-memory.dmp
memory/3376-232-0x0000000140000000-0x000000014020E000-memory.dmp
memory/3432-246-0x0000000140000000-0x0000000140201000-memory.dmp
memory/3712-354-0x0000000140000000-0x00000001401D7000-memory.dmp
memory/3828-233-0x0000000140000000-0x0000000140147000-memory.dmp
memory/4160-237-0x0000000140000000-0x00000001401F6000-memory.dmp
memory/4228-433-0x0000000140000000-0x0000000140222000-memory.dmp
memory/4684-23-0x0000000140000000-0x00000001401E9000-memory.dmp
memory/4684-135-0x0000000140000000-0x00000001401E9000-memory.dmp