Analysis
- max time kernel
148s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
01/06/2026, 13:48
General
- Target tmp1t8czq5z.exe
- Size 561KB
- Sample260601-q356esev3v
- SHA256 7d2820ce0549cf60a3b7516249bae46d65d01bb487c7b0aff121b35f8e2d1c95
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
- Drops startup file 2 IoCs
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates processes with tasklist 1 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp1t8czq5z.exe"C:\Users\Admin\AppData\Local\Temp\tmp1t8czq5z.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exe"wmic" diskdrive get model3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exe"tasklist"3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\system_audio_service.exeC:\Users\Admin\AppData\Local\Temp\system_audio_service.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\driver_compatibility_check.exeC:\Users\Admin\AppData\Local\Temp\driver_compatibility_check.exe2⤵
-
-
C:\Users\Admin\AppData\Local\DirectX\dxdiag_service.exeC:\Users\Admin\AppData\Local\DirectX\dxdiag_service.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp79a7bf4e.exe"C:\Users\Admin\AppData\Local\Temp\tmp79a7bf4e.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exe"wmic" diskdrive get model3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exe"tasklist"3⤵
- Enumerates processes with tasklist
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
dxdiag_service.exe
driver_compatibility_check.exe
tmp79a7bf4e.exe
Microsoft Windows Security Update.lnk
memory/1628-100-0x0000000001080000-0x0000000001550000-memory.dmp
memory/1628-67-0x0000000180000000-0x000000018001E000-memory.dmp
memory/1628-96-0x0000000000720000-0x0000000000723000-memory.dmp
memory/1628-97-0x0000000000730000-0x00000000007EE000-memory.dmp
memory/1628-98-0x0000000000DB0000-0x0000000001079000-memory.dmp
memory/1628-99-0x0000000000BD0000-0x0000000000C60000-memory.dmp
memory/1628-107-0x0000000002100000-0x00000000021AC000-memory.dmp
memory/1628-101-0x0000000001550000-0x00000000015EE000-memory.dmp
memory/1628-102-0x00000000016F0000-0x000000000170B000-memory.dmp
memory/1628-72-0x0000000180000000-0x000000018001E000-memory.dmp
memory/1628-103-0x00000000017F0000-0x00000000018F0000-memory.dmp
memory/1628-104-0x0000000001AF0000-0x0000000001DA0000-memory.dmp
memory/1628-105-0x0000000001DA0000-0x00000000020F5000-memory.dmp
memory/1628-108-0x00000000021B0000-0x000000000225D000-memory.dmp
memory/1628-106-0x0000000001710000-0x00000000017AB000-memory.dmp
memory/1628-111-0x0000000002710000-0x00000000028B1000-memory.dmp
memory/1628-110-0x00000000026D0000-0x0000000002701000-memory.dmp
memory/1628-109-0x0000000002260000-0x000000000238A000-memory.dmp
memory/1732-0-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/4020-91-0x0000000006360000-0x000000000636A000-memory.dmp
memory/4020-77-0x0000000005450000-0x00000000054D3000-memory.dmp
memory/4020-92-0x0000000006370000-0x00000000063EF000-memory.dmp
memory/4020-93-0x00000000063F0000-0x0000000006417000-memory.dmp
memory/4020-78-0x00000000057F0000-0x0000000005899000-memory.dmp
memory/4020-59-0x0000000003250000-0x000000000335B000-memory.dmp
memory/4020-51-0x0000000002010000-0x00000000020AB000-memory.dmp
memory/4020-49-0x00000000023D0000-0x0000000002680000-memory.dmp
memory/4020-48-0x00000000020D0000-0x00000000021D0000-memory.dmp
memory/4020-46-0x0000000001DF0000-0x0000000001E8E000-memory.dmp
memory/4020-42-0x0000000001890000-0x0000000001920000-memory.dmp
memory/4020-39-0x0000000000900000-0x0000000000903000-memory.dmp
memory/4020-89-0x00000000061B0000-0x000000000627D000-memory.dmp
memory/4020-88-0x0000000006190000-0x000000000619C000-memory.dmp
memory/4020-87-0x0000000006160000-0x0000000006188000-memory.dmp
memory/4020-86-0x0000000005F70000-0x000000000615B000-memory.dmp
memory/4020-85-0x0000000005D40000-0x0000000005D4B000-memory.dmp
memory/4020-84-0x0000000005CD0000-0x0000000005D3A000-memory.dmp
memory/4020-82-0x0000000005C80000-0x0000000005CBB000-memory.dmp
memory/4020-83-0x0000000005CC0000-0x0000000005CC8000-memory.dmp
memory/4020-81-0x0000000005A70000-0x0000000005B78000-memory.dmp
memory/4020-80-0x0000000005A50000-0x0000000005A67000-memory.dmp
memory/4020-79-0x00000000059E0000-0x0000000005A4B000-memory.dmp
memory/4020-90-0x0000000006290000-0x000000000635C000-memory.dmp
memory/4020-76-0x0000000005430000-0x0000000005442000-memory.dmp
memory/4020-75-0x0000000005410000-0x000000000542F000-memory.dmp
memory/4020-74-0x00000000053B0000-0x0000000005405000-memory.dmp
memory/4020-73-0x0000000005370000-0x000000000539C000-memory.dmp
memory/4020-62-0x0000000004BE0000-0x0000000005370000-memory.dmp
memory/4020-20-0x0000000180000000-0x000000018001E000-memory.dmp
memory/4020-25-0x0000000180000000-0x000000018001E000-memory.dmp
memory/4020-61-0x0000000003610000-0x0000000003640000-memory.dmp
memory/4020-60-0x0000000003360000-0x00000000033FD000-memory.dmp
memory/4020-58-0x00000000031F0000-0x000000000321B000-memory.dmp
memory/4020-57-0x00000000031A0000-0x00000000031C2000-memory.dmp
memory/4020-55-0x0000000002FB0000-0x0000000002FE1000-memory.dmp
memory/4020-54-0x0000000002B40000-0x0000000002C6A000-memory.dmp
memory/4020-53-0x0000000002A90000-0x0000000002B3D000-memory.dmp
memory/4020-52-0x00000000029E0000-0x0000000002A8C000-memory.dmp
memory/4020-50-0x0000000002680000-0x00000000029D5000-memory.dmp
memory/4020-47-0x00000000014A0000-0x00000000014BB000-memory.dmp
memory/4020-43-0x0000000001920000-0x0000000001DF0000-memory.dmp
memory/4020-19-0x0000000000FE0000-0x0000000000FFC000-memory.dmp
memory/4020-41-0x00000000015C0000-0x0000000001889000-memory.dmp
memory/4020-40-0x0000000001300000-0x00000000013BE000-memory.dmp