Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
25/05/2026, 22:23
General
- Target tmpuw3p2zee.exe
- Size 58KB
- Sample260525-2ba2raa141
- SHA256 18fc38daf13abe5b65c9cb694bd551a1b1d11b9077b0f255a680f567c0c949aa
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 30 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\tmpuw3p2zee.exe"C:\Users\Admin\AppData\Local\Temp\tmpuw3p2zee.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpuw3p2zee.exe"C:\Users\Admin\AppData\Local\Temp\tmpuw3p2zee.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 3885⤵
- Program crash
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1876 -ip 18761⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/408-18-0x0000000000180000-0x0000000000186000-memory.dmp
memory/408-15-0x0000000000180000-0x0000000000186000-memory.dmp
memory/408-14-0x0000000000180000-0x0000000000186000-memory.dmp
memory/408-20-0x00007FF88CE30000-0x00007FF88CE31000-memory.dmp
memory/1876-8-0x0000000077972000-0x0000000077973000-memory.dmp
memory/1876-7-0x0000000001150000-0x0000000001156000-memory.dmp
memory/1876-4-0x0000000001150000-0x0000000001156000-memory.dmp
memory/1876-16-0x0000000001150000-0x0000000001156000-memory.dmp
memory/3388-55-0x00007FF86E680000-0x00007FF86E787000-memory.dmp
memory/3388-101-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-11-0x00007FF88CE40000-0x00007FF88CE41000-memory.dmp
memory/3388-19-0x00007FF88CE30000-0x00007FF88CE31000-memory.dmp
memory/3388-9-0x0000000002A70000-0x0000000002A76000-memory.dmp
memory/3388-21-0x00007FF88CE20000-0x00007FF88CE21000-memory.dmp
memory/3388-22-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-24-0x0000000002A60000-0x0000000002A70000-memory.dmp
memory/3388-23-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-25-0x00007FF86E722000-0x00007FF86E723000-memory.dmp
memory/3388-26-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-27-0x00007FF86E680000-0x00007FF86E787000-memory.dmp
memory/3388-29-0x00007FF86E680000-0x00007FF86E787000-memory.dmp
memory/3388-28-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-33-0x00007FF86E680000-0x00007FF86E787000-memory.dmp
memory/3388-32-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-34-0x00007FF86E680000-0x00007FF86E787000-memory.dmp
memory/3388-63-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-31-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-30-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-37-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-36-0x00007FF86E680000-0x00007FF86E787000-memory.dmp
memory/3388-43-0x00007FF86E680000-0x00007FF86E787000-memory.dmp
memory/3388-42-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-45-0x00007FF86E680000-0x00007FF86E787000-memory.dmp
memory/3388-44-0x00007FF86E680000-0x00007FF86E787000-memory.dmp
memory/3388-41-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-40-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-39-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-38-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-47-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-46-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-48-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-49-0x00007FF86E680000-0x00007FF86E787000-memory.dmp
memory/3388-51-0x00007FF86E680000-0x00007FF86E787000-memory.dmp
memory/3388-50-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-53-0x0000000002A60000-0x0000000002A70000-memory.dmp
memory/3388-52-0x00007FF86E680000-0x00007FF86E787000-memory.dmp
memory/3388-56-0x00007FF86E680000-0x00007FF86E787000-memory.dmp
memory/3388-58-0x00007FF86E680000-0x00007FF86E787000-memory.dmp
memory/3388-57-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-61-0x00007FF86E680000-0x00007FF86E787000-memory.dmp
memory/3388-60-0x00007FF86E680000-0x00007FF86E787000-memory.dmp
memory/3388-59-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-10-0x00007FF88CCAD000-0x00007FF88CCAE000-memory.dmp
memory/3388-54-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-62-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-66-0x00007FF86E680000-0x00007FF86E787000-memory.dmp
memory/3388-3-0x0000000002A70000-0x0000000002A76000-memory.dmp
memory/3388-65-0x00007FF86E680000-0x00007FF86E787000-memory.dmp
memory/3388-35-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-67-0x00007FF86E680000-0x00007FF86E787000-memory.dmp
memory/3388-68-0x00007FF86E680000-0x00007FF86E787000-memory.dmp
memory/3388-69-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-70-0x00007FF86E680000-0x00007FF86E787000-memory.dmp
memory/3388-75-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-74-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-73-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-72-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-71-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-78-0x00007FF86E680000-0x00007FF86E787000-memory.dmp
memory/3388-77-0x00007FF86E680000-0x00007FF86E787000-memory.dmp
memory/3388-76-0x00007FF86E680000-0x00007FF86E787000-memory.dmp
memory/3388-79-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-81-0x00007FF86E680000-0x00007FF86E787000-memory.dmp
memory/3388-82-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-80-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-84-0x00007FF86E680000-0x00007FF86E787000-memory.dmp
memory/3388-83-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-86-0x00007FF86E680000-0x00007FF86E787000-memory.dmp
memory/3388-85-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-87-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-88-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-92-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-91-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-90-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-89-0x00007FF86E680000-0x00007FF86E787000-memory.dmp
memory/3388-93-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-96-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-98-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-97-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-95-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-94-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-100-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-64-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-99-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-102-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-103-0x00007FF86E680000-0x00007FF86E787000-memory.dmp
memory/3388-104-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-105-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-106-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-107-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-109-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-108-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-110-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-111-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-113-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/3388-112-0x0000000002A50000-0x0000000002A60000-memory.dmp
memory/4996-2-0x0000000000400000-0x0000000000405000-memory.dmp