Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
27/05/2026, 11:07
General
- Target 88d021ec5caf53c289f0c7a04d646802f3dc1cecfee529e12655bf4c7ab0a520.exe
- Size 9.6MB
- Sample260527-m8hersb16k
- SHA256 88d021ec5caf53c289f0c7a04d646802f3dc1cecfee529e12655bf4c7ab0a520
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
- UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 40 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\88d021ec5caf53c289f0c7a04d646802f3dc1cecfee529e12655bf4c7ab0a520.exe"C:\Users\Admin\AppData\Local\Temp\88d021ec5caf53c289f0c7a04d646802f3dc1cecfee529e12655bf4c7ab0a520.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ktmutil.exeC:\Windows\SysWOW64\ktmutil.exe2⤵
-
-
C:\Windows\SysWOW64\CertEnrollCtrl.exeC:\Windows\SysWOW64\CertEnrollCtrl.exe2⤵
-
-
C:\Windows\SysWOW64\CertEnrollCtrl.exeC:\Windows\SysWOW64\CertEnrollCtrl.exe2⤵
-
-
C:\Windows\SysWOW64\logman.exeC:\Windows\SysWOW64\logman.exe2⤵
-
-
C:\Windows\SysWOW64\SystemPropertiesComputerName.exeC:\Windows\SysWOW64\SystemPropertiesComputerName.exe2⤵
-
-
C:\Windows\SysWOW64\ftp.exeC:\Windows\SysWOW64\ftp.exe2⤵
-
-
C:\Windows\SysWOW64\resmon.exeC:\Windows\SysWOW64\resmon.exe2⤵
-
-
C:\Windows\SysWOW64\getmac.exeC:\Windows\SysWOW64\getmac.exe2⤵
-
-
C:\Windows\SysWOW64\convert.exeC:\Windows\SysWOW64\convert.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RrENj.log
loldsb.ini
memory/3384-48-0x0000000002DA0000-0x0000000002DC7000-memory.dmp
memory/3384-1-0x0000000010000000-0x00000000101BC000-memory.dmp
memory/3384-14-0x00000000037F0000-0x0000000004054000-memory.dmp
memory/3384-15-0x0000000002DA0000-0x0000000002DC7000-memory.dmp
memory/3384-16-0x00000000044E0000-0x0000000004D44000-memory.dmp
memory/3384-24-0x0000000003030000-0x0000000003057000-memory.dmp
memory/3384-25-0x00000000044E0000-0x0000000004D44000-memory.dmp
memory/3384-27-0x0000000003030000-0x0000000003057000-memory.dmp
memory/3384-47-0x00000000044E0000-0x0000000004D44000-memory.dmp
memory/3384-13-0x0000000002DA0000-0x0000000002DC7000-memory.dmp
memory/3384-4-0x00000000037F0000-0x0000000004054000-memory.dmp
memory/3384-54-0x0000000003030000-0x0000000003057000-memory.dmp
memory/3384-49-0x00000000037F0000-0x0000000004054000-memory.dmp
memory/3384-26-0x00000000044E0000-0x0000000004D44000-memory.dmp
memory/3384-12-0x00000000037F0000-0x0000000004054000-memory.dmp
memory/4436-50-0x0000000010000000-0x00000000101BC000-memory.dmp
memory/4436-66-0x00000000030D0000-0x00000000030F7000-memory.dmp
memory/4436-46-0x0000000000400000-0x0000000000DCF000-memory.dmp
memory/4436-41-0x0000000000400000-0x0000000000DCF000-memory.dmp
memory/4436-43-0x0000000000400000-0x0000000000DCF000-memory.dmp
memory/4436-42-0x0000000000400000-0x0000000000DCF000-memory.dmp
memory/4436-55-0x0000000003DE0000-0x0000000004644000-memory.dmp
memory/4436-63-0x0000000003DE0000-0x0000000004644000-memory.dmp
memory/4436-65-0x0000000003DE0000-0x0000000004644000-memory.dmp
memory/4436-44-0x0000000000400000-0x0000000000DCF000-memory.dmp
memory/4436-64-0x00000000030D0000-0x00000000030F7000-memory.dmp
memory/4436-67-0x0000000004AD0000-0x0000000005334000-memory.dmp
memory/4436-70-0x0000000004AD0000-0x0000000005334000-memory.dmp
memory/4436-74-0x0000000003290000-0x00000000032B7000-memory.dmp
memory/4436-40-0x0000000000400000-0x0000000000DCF000-memory.dmp
memory/4436-77-0x0000000003DE0000-0x0000000004644000-memory.dmp
memory/4436-78-0x0000000004AD0000-0x0000000005334000-memory.dmp