Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 00:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmp9qcotsm8.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp9qcotsm8.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmp9qcotsm8.exe
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target tmp9qcotsm8.exe
- Size 54KB
- Sample260602-avytdabt2r
- SHA256 3753caeb575f59c4bd0ba61e99d86a5e063175054ee101ac5bfd7110137b3719
- MD5 7a5cea94e5b35851c4e1a8b3dbf3a89d
- SHA1 95a9d1540c46dda39dee29ef5c5a9b4b1ba2c83c
- SHA512 a2956967dc127a03649556c2e47fad23c288f33f1c14dbcfb69abb43e6ce9e60991ec6f167e3f97a173dbf385ffa4b8d820668012a69340ec082fc8ba6020452
- SSDEEP 768:z3CCRtWM5usSRJDTlLTOpJiqRZNoCRtxihG1gfFNsHWP4jBS:r5tPusSRJDTlLTOpJiaDjts4gfFi2+A
- TLSH T18E430721F7AD4034F39A4AF919B1CB9C41B73E35AD609507530BDCAF1E312E1A9A4B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1596 set thread context of 3312 1596 tmp9qcotsm8.exe 83 - Program crash 1 IoCs
pid pid_target Process procid_target 2212 3136 WerFault.exe 84 - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp9qcotsm8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp9qcotsm8.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3136 winver.exe 3136 winver.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3200 Explorer.EXE - Suspicious use of AdjustPrivilegeToken 56 IoCs
description pid Process Token: SeShutdownPrivilege 3200 Explorer.EXE Token: SeCreatePagefilePrivilege 3200 Explorer.EXE Token: SeShutdownPrivilege 3200 Explorer.EXE Token: SeCreatePagefilePrivilege 3200 Explorer.EXE Token: SeShutdownPrivilege 3200 Explorer.EXE Token: SeCreatePagefilePrivilege 3200 Explorer.EXE Token: SeShutdownPrivilege 3200 Explorer.EXE Token: SeCreatePagefilePrivilege 3200 Explorer.EXE Token: SeShutdownPrivilege 3200 Explorer.EXE Token: SeCreatePagefilePrivilege 3200 Explorer.EXE Token: SeShutdownPrivilege 3200 Explorer.EXE Token: SeCreatePagefilePrivilege 3200 Explorer.EXE Token: SeShutdownPrivilege 3200 Explorer.EXE Token: SeCreatePagefilePrivilege 3200 Explorer.EXE Token: SeShutdownPrivilege 3200 Explorer.EXE Token: SeCreatePagefilePrivilege 3200 Explorer.EXE Token: SeShutdownPrivilege 3200 Explorer.EXE Token: SeCreatePagefilePrivilege 3200 Explorer.EXE Token: SeShutdownPrivilege 3200 Explorer.EXE Token: SeCreatePagefilePrivilege 3200 Explorer.EXE Token: SeShutdownPrivilege 3200 Explorer.EXE Token: SeCreatePagefilePrivilege 3200 Explorer.EXE Token: SeShutdownPrivilege 3200 Explorer.EXE Token: SeCreatePagefilePrivilege 3200 Explorer.EXE Token: SeShutdownPrivilege 3200 Explorer.EXE Token: SeCreatePagefilePrivilege 3200 Explorer.EXE Token: SeShutdownPrivilege 3200 Explorer.EXE Token: SeCreatePagefilePrivilege 3200 Explorer.EXE Token: SeShutdownPrivilege 3200 Explorer.EXE Token: SeCreatePagefilePrivilege 3200 Explorer.EXE Token: SeShutdownPrivilege 3200 Explorer.EXE Token: SeCreatePagefilePrivilege 3200 Explorer.EXE Token: SeShutdownPrivilege 3200 Explorer.EXE Token: SeCreatePagefilePrivilege 3200 Explorer.EXE Token: SeShutdownPrivilege 3200 Explorer.EXE Token: SeCreatePagefilePrivilege 3200 Explorer.EXE Token: SeShutdownPrivilege 3200 Explorer.EXE Token: SeCreatePagefilePrivilege 3200 Explorer.EXE Token: SeShutdownPrivilege 3200 Explorer.EXE Token: SeCreatePagefilePrivilege 3200 Explorer.EXE Token: SeShutdownPrivilege 3200 Explorer.EXE Token: SeCreatePagefilePrivilege 3200 Explorer.EXE Token: SeShutdownPrivilege 3200 Explorer.EXE Token: SeCreatePagefilePrivilege 3200 Explorer.EXE Token: SeShutdownPrivilege 3200 Explorer.EXE Token: SeCreatePagefilePrivilege 3200 Explorer.EXE Token: SeShutdownPrivilege 3200 Explorer.EXE Token: SeCreatePagefilePrivilege 3200 Explorer.EXE Token: SeShutdownPrivilege 3200 Explorer.EXE Token: SeCreatePagefilePrivilege 3200 Explorer.EXE Token: SeShutdownPrivilege 3200 Explorer.EXE Token: SeCreatePagefilePrivilege 3200 Explorer.EXE Token: SeShutdownPrivilege 3200 Explorer.EXE Token: SeCreatePagefilePrivilege 3200 Explorer.EXE Token: SeShutdownPrivilege 3200 Explorer.EXE Token: SeCreatePagefilePrivilege 3200 Explorer.EXE - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3136 winver.exe 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1596 tmp9qcotsm8.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3200 Explorer.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1596 wrote to memory of 3312 1596 tmp9qcotsm8.exe 83 PID 1596 wrote to memory of 3312 1596 tmp9qcotsm8.exe 83 PID 1596 wrote to memory of 3312 1596 tmp9qcotsm8.exe 83 PID 3312 wrote to memory of 3136 3312 tmp9qcotsm8.exe 84 PID 3136 wrote to memory of 3200 3136 winver.exe 54 PID 3136 wrote to memory of 2424 3136 winver.exe 51 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2424
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\tmp9qcotsm8.exe"C:\Users\Admin\AppData\Local\Temp\tmp9qcotsm8.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\tmp9qcotsm8.exe"C:\Users\Admin\AppData\Local\Temp\tmp9qcotsm8.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\SysWOW64\winver.exewinver4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 4245⤵
- Program crash
PID:2212
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3136 -ip 31361⤵PID:1476