Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 06:46
General
- Target _f16b26b76d82b3575490bd80198af4a49a25d463fe2778ba2ee982997505e387.exe
- Size 7.8MB
- Sample260604-hj2d5aay2w
- SHA256 f16b26b76d82b3575490bd80198af4a49a25d463fe2778ba2ee982997505e387
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Drops file in System32 directory 3 IoCs
- Drops file in Program Files directory 38 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\_f16b26b76d82b3575490bd80198af4a49a25d463fe2778ba2ee982997505e387.exe"C:\Users\Admin\AppData\Local\Temp\_f16b26b76d82b3575490bd80198af4a49a25d463fe2778ba2ee982997505e387.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-LDB48.tmp\is-12JLT.tmp"C:\Users\Admin\AppData\Local\Temp\is-LDB48.tmp\is-12JLT.tmp" /SL4 $6022E "C:\Users\Admin\AppData\Local\Temp\_f16b26b76d82b3575490bd80198af4a49a25d463fe2778ba2ee982997505e387.exe" 7848540 522242⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
dvdshow.exe
nosound.mp3
is-12JLT.tmp
memory/860-13-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/860-112-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/860-133-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/860-131-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/860-16-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/860-18-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/860-20-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/860-7-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/860-129-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/860-8-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/860-114-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/860-116-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/860-118-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/860-120-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/860-122-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/860-125-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/860-127-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/3664-1-0x0000000000400000-0x0000000000413000-memory.dmp
memory/3664-14-0x0000000000400000-0x0000000000413000-memory.dmp
memory/3664-0-0x000000000040C000-0x000000000040D000-memory.dmp