Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/06/2026, 12:19
General
- Target LTG.exe
- Size 1.3MB
- Sample260604-phm9faft4m
- SHA256 58d6c50949c3687cbd3b469b194ebd66582e4f46bd09f2e21f769f06b9f76b06
Malware Config
Signatures
- Family: MetaQuotes
MetaQuotes is a Windows adware family.
- Detects MetaQuotes adware 3 IoCs
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in Program Files directory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\LTG.exe"C:\Users\Admin\AppData\Local\Temp\LTG.exe"1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4852-0-0x0000000000DB0000-0x0000000001112000-memory.dmp
memory/4852-1-0x0000000000DB0000-0x0000000001112000-memory.dmp
memory/4852-2-0x0000000001500000-0x00000000015BE000-memory.dmp
memory/4852-4-0x0000000001BB0000-0x0000000001C5C000-memory.dmp
memory/4852-8-0x0000000001F20000-0x0000000001FED000-memory.dmp
memory/4852-10-0x0000000000DB0000-0x0000000001112000-memory.dmp
memory/4852-9-0x0000000001FF0000-0x000000000272F000-memory.dmp
memory/4852-13-0x0000000002790000-0x0000000002931000-memory.dmp
memory/4852-41-0x00000000033C0000-0x00000000034CB000-memory.dmp
memory/4852-42-0x00000000034D0000-0x0000000003825000-memory.dmp
memory/4852-55-0x00000000039B0000-0x00000000039DC000-memory.dmp
memory/4852-100-0x0000000008A30000-0x0000000008D8E000-memory.dmp
memory/4852-121-0x0000000000DB0000-0x0000000001112000-memory.dmp
memory/4852-109-0x000000000B110000-0x000000000B137000-memory.dmp
memory/4852-108-0x00000000090D0000-0x000000000910B000-memory.dmp
memory/4852-107-0x00000000063B0000-0x00000000063C5000-memory.dmp
memory/4852-106-0x0000000009030000-0x00000000090C1000-memory.dmp
memory/4852-105-0x0000000008ED0000-0x0000000009024000-memory.dmp
memory/4852-103-0x0000000008E90000-0x0000000008EC3000-memory.dmp
memory/4852-102-0x0000000008D90000-0x0000000008E82000-memory.dmp
memory/4852-97-0x0000000008930000-0x0000000008A29000-memory.dmp
memory/4852-96-0x000000000A380000-0x000000000A42C000-memory.dmp
memory/4852-93-0x0000000006370000-0x000000000637D000-memory.dmp
memory/4852-91-0x00000000062E0000-0x00000000062EA000-memory.dmp
memory/4852-89-0x00000000062D0000-0x00000000062D8000-memory.dmp
memory/4852-87-0x0000000006290000-0x00000000062CB000-memory.dmp
memory/4852-86-0x00000000061C0000-0x000000000628C000-memory.dmp
memory/4852-84-0x0000000006150000-0x00000000061BA000-memory.dmp
memory/4852-79-0x0000000006110000-0x0000000006137000-memory.dmp
memory/4852-78-0x00000000060D0000-0x0000000006104000-memory.dmp
memory/4852-74-0x0000000006000000-0x0000000006018000-memory.dmp
memory/4852-73-0x0000000005FE0000-0x0000000005FF2000-memory.dmp
memory/4852-71-0x00000000064E0000-0x00000000065F5000-memory.dmp
memory/4852-67-0x0000000005F30000-0x0000000005FB3000-memory.dmp
memory/4852-66-0x00000000039E0000-0x00000000039F2000-memory.dmp
memory/4852-65-0x0000000005D60000-0x0000000005DFE000-memory.dmp
memory/4852-63-0x0000000005970000-0x0000000005A1D000-memory.dmp
memory/4852-62-0x0000000005940000-0x000000000596C000-memory.dmp
memory/4852-54-0x0000000003960000-0x0000000003990000-memory.dmp
memory/4852-53-0x00000000038D0000-0x0000000003901000-memory.dmp
memory/4852-43-0x0000000003830000-0x00000000038CD000-memory.dmp
memory/4852-60-0x00000000051B0000-0x0000000005940000-memory.dmp
memory/4852-40-0x0000000003390000-0x00000000033B2000-memory.dmp
memory/4852-39-0x0000000003290000-0x0000000003390000-memory.dmp
memory/4852-38-0x0000000003160000-0x000000000328A000-memory.dmp
memory/4852-81-0x0000000006140000-0x000000000614C000-memory.dmp
memory/4852-34-0x0000000003020000-0x00000000030BE000-memory.dmp
memory/4852-33-0x0000000003010000-0x000000000301A000-memory.dmp
memory/4852-31-0x0000000003000000-0x000000000300C000-memory.dmp
memory/4852-30-0x0000000002FF0000-0x0000000002FF7000-memory.dmp
memory/4852-28-0x0000000002E40000-0x0000000002FE9000-memory.dmp
memory/4852-15-0x00000000029B0000-0x0000000002C4A000-memory.dmp
memory/4852-21-0x0000000001F20000-0x0000000001FED000-memory.dmp
memory/4852-20-0x0000000001DF0000-0x0000000001F1A000-memory.dmp
memory/4852-18-0x0000000001C60000-0x0000000001DB6000-memory.dmp
memory/4852-35-0x00000000030C0000-0x000000000315B000-memory.dmp
memory/4852-19-0x0000000001DC0000-0x0000000001DEB000-memory.dmp
memory/4852-16-0x00000000017A0000-0x0000000001A69000-memory.dmp
memory/4852-11-0x0000000001500000-0x00000000015BE000-memory.dmp
memory/4852-27-0x0000000002C50000-0x0000000002E34000-memory.dmp
memory/4852-14-0x0000000002940000-0x00000000029AB000-memory.dmp
memory/4852-12-0x0000000002730000-0x0000000002785000-memory.dmp
memory/4852-7-0x0000000001DF0000-0x0000000001F1A000-memory.dmp
memory/4852-5-0x0000000001C60000-0x0000000001DB6000-memory.dmp
memory/4852-3-0x00000000017A0000-0x0000000001A69000-memory.dmp
memory/4852-6-0x0000000001DC0000-0x0000000001DEB000-memory.dmp