Resubmissions
29/05/2026, 12:17
260529-pf7v3acs4p729/05/2026, 12:13
260529-pd2w2abs7s729/05/2026, 11:18
260529-nektgaaw2m724/05/2026, 00:13
260524-ah3a2acs7n7Analysis
- max time kernel
149s - max time network
129s - platform
windows11-21h2_x64 - resource
win11-20260513-uk - resource tags
- submitted
29/05/2026, 12:13
General
- Target bot_x64.exe
- Size 40KB
- Sample260529-pd2w2abs7s
- SHA256 2841aab00ee6f00213e594dc562d03b982e6d8570a6de2a0797f3a147665f4ca
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 16 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bot_x64.exe"C:\Users\Admin\AppData\Local\Temp\bot_x64.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
winhost.exe
memory/500-25-0x00007FFCC2E60000-0x00007FFCC3069000-memory.dmp
memory/3056-4-0x000001E2B5DD0000-0x000001E2B5DD3000-memory.dmp
memory/3056-20-0x000001E2B63B0000-0x000001E2B63B7000-memory.dmp
memory/3180-19-0x00000000030A0000-0x00000000030A7000-memory.dmp
memory/3180-21-0x0000000002FA0000-0x0000000002FA1000-memory.dmp
memory/3180-27-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-29-0x0000000002DF0000-0x0000000002E00000-memory.dmp
memory/3180-28-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-30-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-31-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-32-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-36-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-37-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-35-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-34-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-33-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-38-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-40-0x0000000003030000-0x0000000003040000-memory.dmp
memory/3180-39-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-44-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-45-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-47-0x0000000003030000-0x0000000003040000-memory.dmp
memory/3180-46-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-43-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-42-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-41-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-48-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-51-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-50-0x0000000002DF0000-0x0000000002E00000-memory.dmp
memory/3180-49-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-52-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-53-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-54-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-55-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-56-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-57-0x0000000002FB0000-0x0000000002FC0000-memory.dmp
memory/3180-58-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-59-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-60-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-61-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-63-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-66-0x0000000002FC0000-0x0000000002FD0000-memory.dmp
memory/3180-65-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-62-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-64-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-67-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-69-0x0000000002FC0000-0x0000000002FD0000-memory.dmp
memory/3180-68-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-74-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-75-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-73-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-72-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-71-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-70-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-76-0x0000000002FC0000-0x0000000002FD0000-memory.dmp
memory/3180-77-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-78-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-80-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-79-0x0000000002FB0000-0x0000000002FC0000-memory.dmp
memory/3180-82-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-81-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/3180-83-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/4212-0-0x00007FFCC2E60000-0x00007FFCC3069000-memory.dmp