Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/06/2026, 04:57
General
- Target EdgeFirst.exe
- Size 3.4MB
- Sample260602-flnvpsfs9r
- SHA256 8a992532fc35ce545053bee69c3d1ef14f84e4802043ed3e14bd7b67321b48e7
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\EdgeFirst.exe"C:\Users\Admin\AppData\Local\Temp\EdgeFirst.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS85B48DB8\EdgeFirstInstaller.exe.\EdgeFirstInstaller.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Duende.IdentityModel.dll
EdgeFirstInstaller.exe
EdgeFirstInstaller.exe.config
EdgeFirstInstaller.pdb
System.Memory.dll
System.Net.Http.dll
System.Text.Json.dll
memory/4124-270-0x00000117A6B10000-0x00000117A6B48000-memory.dmp
memory/4124-275-0x00000117A6B80000-0x00000117A6BA6000-memory.dmp
memory/4124-276-0x00000117C0AA0000-0x00000117C0AB0000-memory.dmp
memory/4124-271-0x00000117A6AF0000-0x00000117A6B0A000-memory.dmp
memory/4124-277-0x00000117C0AA0000-0x00000117C0AB0000-memory.dmp
memory/4124-273-0x00000117C0910000-0x00000117C09A8000-memory.dmp
memory/4124-279-0x00000117C33D0000-0x00000117C3402000-memory.dmp
memory/4124-268-0x00000117A4D00000-0x00000117A4DC2000-memory.dmp
memory/4124-281-0x00000117C4430000-0x00000117C45F2000-memory.dmp
memory/4124-283-0x00000117C0AA0000-0x00000117C0AB0000-memory.dmp
memory/4124-293-0x00000117C0AA0000-0x00000117C0AB0000-memory.dmp
memory/4124-294-0x00000117C0AA0000-0x00000117C0AB0000-memory.dmp