Analysis
- user interaction
yes - max time kernel
300s - max time network
275s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 06:05
General
- Target PerthGM.exe
- Size 68.8MB
- Sample260604-gs73labt8l
- SHA256 0b19ed5c04f2ddec5ac98ba4ca5e1656e4cdb12d5c3d31f9829e81160dd1c303
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 36 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PerthGM.exe"C:\Users\Admin\AppData\Local\Temp\PerthGM.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
wpfgfx_cor3.dll
memory/1608-103-0x000001C45DEB0000-0x000001C45DEE0000-memory.dmp
memory/1608-90-0x000001C45E760000-0x000001C45EF00000-memory.dmp
memory/1608-23-0x000001C4459C0000-0x000001C445B20000-memory.dmp
memory/1608-10-0x000001C45A590000-0x000001C45B4F0000-memory.dmp
memory/1608-51-0x000001C442590000-0x000001C4425A0000-memory.dmp
memory/1608-63-0x000001C446440000-0x000001C446480000-memory.dmp
memory/1608-75-0x000001C45D910000-0x000001C45D930000-memory.dmp
memory/1608-71-0x000001C45D8B0000-0x000001C45D8E0000-memory.dmp
memory/1608-67-0x000001C45D870000-0x000001C45D890000-memory.dmp
memory/1608-35-0x000001C444370000-0x000001C4443B0000-memory.dmp
memory/1608-86-0x000001C45DC00000-0x000001C45DC50000-memory.dmp
memory/1608-94-0x000001C45DE50000-0x000001C45DE80000-memory.dmp
memory/1608-107-0x000001C45F0B0000-0x000001C45F170000-memory.dmp
memory/1608-123-0x000001C45F240000-0x000001C45F260000-memory.dmp
memory/1608-119-0x000001C45F1F0000-0x000001C45F240000-memory.dmp
memory/1608-115-0x000001C45DEE0000-0x000001C45DEF0000-memory.dmp
memory/1608-111-0x000001C45EF90000-0x000001C45EFB0000-memory.dmp
memory/1608-5-0x000001C443360000-0x000001C443FF0000-memory.dmp
memory/1608-31-0x000001C442660000-0x000001C4426B0000-memory.dmp
memory/1608-98-0x000001C45EF00000-0x000001C45EF90000-memory.dmp
memory/1608-82-0x000001C45DAF0000-0x000001C45DC00000-memory.dmp
memory/1608-59-0x000001C446420000-0x000001C446440000-memory.dmp
memory/1608-55-0x000001C444690000-0x000001C4446B0000-memory.dmp
memory/1608-47-0x000001C444660000-0x000001C444680000-memory.dmp
memory/1608-43-0x000001C4443B0000-0x000001C444430000-memory.dmp
memory/1608-39-0x000001C445B20000-0x000001C446350000-memory.dmp
memory/1608-127-0x000001C45F320000-0x000001C45F380000-memory.dmp
memory/1608-135-0x000001C440760000-0x000001C440770000-memory.dmp
memory/1608-131-0x000001C45F280000-0x000001C45F2C0000-memory.dmp
memory/1608-141-0x000001C45F730000-0x000001C45F8A0000-memory.dmp
memory/1608-145-0x000001C45F8A0000-0x000001C45F8F0000-memory.dmp
memory/1608-19-0x000001C445630000-0x000001C445860000-memory.dmp
memory/1608-15-0x000001C4425C0000-0x000001C4425E0000-memory.dmp
memory/1608-154-0x000001C45FA90000-0x000001C45FB00000-memory.dmp
memory/1608-166-0x000001C45F5A0000-0x000001C45F5B0000-memory.dmp
memory/1608-162-0x000001C45F510000-0x000001C45F520000-memory.dmp
memory/1608-158-0x000001C460100000-0x000001C460260000-memory.dmp
memory/1608-170-0x000001C4647A0000-0x000001C4647C0000-memory.dmp