Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
01/06/2026, 13:48
General
- Target tmp1t8czq5z.exe
- Size 561KB
- Sample260601-q356esev3v
- SHA256 7d2820ce0549cf60a3b7516249bae46d65d01bb487c7b0aff121b35f8e2d1c95
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
- Drops startup file 2 IoCs
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates processes with tasklist 1 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp1t8czq5z.exe"C:\Users\Admin\AppData\Local\Temp\tmp1t8czq5z.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exe"wmic" diskdrive get model3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exe"tasklist"3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\windows_media_helper.exeC:\Users\Admin\AppData\Local\Temp\windows_media_helper.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\display_config_utility.exeC:\Users\Admin\AppData\Local\Temp\display_config_utility.exe2⤵
-
-
C:\Users\Admin\AppData\Local\DirectX\dxdiag_service.exeC:\Users\Admin\AppData\Local\DirectX\dxdiag_service.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp6caa9a89.exe"C:\Users\Admin\AppData\Local\Temp\tmp6caa9a89.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exe"wmic" diskdrive get model3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exe"tasklist"3⤵
- Enumerates processes with tasklist
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
dxdiag_service.exe
display_config_utility.exe
tmp6caa9a89.exe
Microsoft Windows Security Update.lnk
memory/3060-105-0x0000000002550000-0x00000000025EE000-memory.dmp
memory/3060-108-0x0000000002AA0000-0x0000000002C4C000-memory.dmp
memory/3060-101-0x00000000010B0000-0x00000000010CB000-memory.dmp
memory/3060-102-0x0000000001EC0000-0x0000000001FD1000-memory.dmp
memory/3060-103-0x00000000021E0000-0x0000000002492000-memory.dmp
memory/3060-104-0x00000000024A0000-0x000000000254E000-memory.dmp
memory/3060-92-0x0000000180000000-0x000000018001E000-memory.dmp
memory/3060-106-0x00000000025F0000-0x0000000002710000-memory.dmp
memory/3060-107-0x0000000002A50000-0x0000000002A92000-memory.dmp
memory/3060-100-0x0000000001C90000-0x0000000001D33000-memory.dmp
memory/3060-109-0x0000000001E40000-0x0000000001E66000-memory.dmp
memory/3060-110-0x0000000002C70000-0x0000000002C99000-memory.dmp
memory/3060-97-0x00000000012A0000-0x0000000001614000-memory.dmp
memory/3060-96-0x00000000011E0000-0x000000000129D000-memory.dmp
memory/3060-95-0x0000000000840000-0x0000000000843000-memory.dmp
memory/3060-98-0x00000000016F0000-0x0000000001781000-memory.dmp
memory/3060-99-0x0000000001790000-0x0000000001C8A000-memory.dmp
memory/3060-87-0x0000000180000000-0x000000018001E000-memory.dmp
memory/4524-63-0x0000000005220000-0x0000000005241000-memory.dmp
memory/4524-57-0x0000000002D80000-0x0000000002DB1000-memory.dmp
memory/4524-76-0x0000000005E90000-0x0000000005E9C000-memory.dmp
memory/4524-77-0x0000000005EB0000-0x0000000005F86000-memory.dmp
memory/4524-78-0x0000000005FA0000-0x0000000006087000-memory.dmp
memory/4524-79-0x0000000006090000-0x000000000609A000-memory.dmp
memory/4524-74-0x0000000005C70000-0x0000000005E5E000-memory.dmp
memory/4524-67-0x00000000057F0000-0x000000000585F000-memory.dmp
memory/4524-66-0x0000000005600000-0x00000000056AF000-memory.dmp
memory/4524-72-0x0000000005C40000-0x0000000005C49000-memory.dmp
memory/4524-71-0x0000000005C10000-0x0000000005C3D000-memory.dmp
memory/4524-70-0x0000000005BA0000-0x0000000005C07000-memory.dmp
memory/4524-19-0x00000000009A0000-0x00000000009BC000-memory.dmp
memory/4524-69-0x0000000005880000-0x000000000598C000-memory.dmp
memory/4524-68-0x0000000005860000-0x0000000005877000-memory.dmp
memory/4524-65-0x0000000005270000-0x00000000052EF000-memory.dmp
memory/4524-64-0x0000000005250000-0x0000000005268000-memory.dmp
memory/4524-62-0x00000000051C0000-0x000000000521D000-memory.dmp
memory/4524-60-0x0000000004F50000-0x00000000050B6000-memory.dmp
memory/4524-58-0x0000000004360000-0x0000000004BC7000-memory.dmp
memory/4524-56-0x0000000002AD0000-0x0000000002B6D000-memory.dmp
memory/4524-55-0x00000000029B0000-0x0000000002AC2000-memory.dmp
memory/4524-54-0x0000000002950000-0x0000000002979000-memory.dmp
memory/4524-53-0x0000000001C60000-0x0000000001C86000-memory.dmp
memory/4524-52-0x0000000002790000-0x000000000293C000-memory.dmp
memory/4524-47-0x0000000001ED0000-0x0000000002182000-memory.dmp
memory/4524-45-0x0000000001C40000-0x0000000001C5B000-memory.dmp
memory/4524-48-0x0000000002190000-0x000000000223E000-memory.dmp
memory/4524-43-0x0000000001450000-0x000000000194A000-memory.dmp
memory/4524-44-0x0000000001950000-0x00000000019F3000-memory.dmp
memory/4524-80-0x00000000060A0000-0x0000000006121000-memory.dmp
memory/4524-73-0x0000000005C50000-0x0000000005C5C000-memory.dmp
memory/4524-61-0x00000000050C0000-0x00000000051AA000-memory.dmp
memory/4524-59-0x0000000004BD0000-0x0000000004F48000-memory.dmp
memory/4524-75-0x0000000005E60000-0x0000000005E88000-memory.dmp
memory/4524-50-0x00000000022E0000-0x0000000002400000-memory.dmp
memory/4524-51-0x0000000002740000-0x0000000002782000-memory.dmp
memory/4524-49-0x0000000002240000-0x00000000022DE000-memory.dmp
memory/4524-46-0x0000000001CB0000-0x0000000001DC1000-memory.dmp
memory/4524-41-0x0000000000F40000-0x00000000012B4000-memory.dmp
memory/4524-42-0x00000000013B0000-0x0000000001441000-memory.dmp
memory/4524-40-0x0000000000D50000-0x0000000000E0D000-memory.dmp
memory/4524-39-0x00000000004A0000-0x00000000004A3000-memory.dmp
memory/4524-20-0x0000000180000000-0x000000018001E000-memory.dmp
memory/4524-25-0x0000000180000000-0x000000018001E000-memory.dmp
memory/5252-0-0x0000000140000000-0x00000001400B0000-memory.dmp