Analysis
- max time kernel
149s - max time network
154s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 12:19
General
- Target LTG.exe
- Size 1.3MB
- Sample260604-phm9faft4m
- SHA256 58d6c50949c3687cbd3b469b194ebd66582e4f46bd09f2e21f769f06b9f76b06
Malware Config
Signatures
- Family: MetaQuotes
MetaQuotes is a Windows adware family.
- Detects MetaQuotes adware 1 IoCs
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in Program Files directory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\LTG.exe"C:\Users\Admin\AppData\Local\Temp\LTG.exe"1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5064-0-0x0000000000170000-0x00000000004D2000-memory.dmp
memory/5064-2-0x0000000000FA0000-0x000000000105D000-memory.dmp
memory/5064-1-0x0000000000170000-0x00000000004D2000-memory.dmp
memory/5064-4-0x00000000015B0000-0x000000000165E000-memory.dmp
memory/5064-7-0x0000000001800000-0x000000000199A000-memory.dmp
memory/5064-8-0x00000000019A0000-0x0000000001A76000-memory.dmp
memory/5064-3-0x0000000001060000-0x00000000013D4000-memory.dmp
memory/5064-5-0x0000000001660000-0x00000000017C2000-memory.dmp
memory/5064-6-0x0000000000E40000-0x0000000000E69000-memory.dmp
memory/5064-9-0x0000000001A80000-0x000000000222E000-memory.dmp
memory/5064-10-0x0000000002230000-0x000000000228D000-memory.dmp
memory/5064-18-0x0000000002B70000-0x0000000002B7A000-memory.dmp
memory/5064-25-0x0000000003060000-0x00000000030FD000-memory.dmp
memory/5064-24-0x0000000002F40000-0x0000000003052000-memory.dmp
memory/5064-28-0x0000000003620000-0x0000000003651000-memory.dmp
memory/5064-34-0x0000000005D50000-0x0000000005D68000-memory.dmp
memory/5064-50-0x000000000A3F0000-0x000000000A522000-memory.dmp
memory/5064-57-0x0000000006FB0000-0x0000000006FD4000-memory.dmp
memory/5064-56-0x0000000006BB0000-0x0000000006BD7000-memory.dmp
memory/5064-55-0x0000000006B80000-0x0000000006BA8000-memory.dmp
memory/5064-43-0x0000000006030000-0x0000000006117000-memory.dmp
memory/5064-54-0x0000000006B40000-0x0000000006B77000-memory.dmp
memory/5064-53-0x0000000006280000-0x0000000006295000-memory.dmp
memory/5064-52-0x0000000006A90000-0x0000000006B31000-memory.dmp
memory/5064-51-0x000000000AD30000-0x000000000B09D000-memory.dmp
memory/5064-42-0x0000000005FC0000-0x0000000006027000-memory.dmp
memory/5064-48-0x000000000A110000-0x000000000A1BE000-memory.dmp
memory/5064-41-0x0000000005EA0000-0x0000000005FBE000-memory.dmp
memory/5064-49-0x000000000A1C0000-0x000000000A2ED000-memory.dmp
memory/5064-44-0x0000000006120000-0x000000000614D000-memory.dmp
memory/5064-35-0x0000000005DE0000-0x0000000005E5F000-memory.dmp
memory/5064-47-0x0000000006200000-0x000000000620D000-memory.dmp
memory/5064-46-0x0000000006160000-0x000000000616A000-memory.dmp
memory/5064-45-0x0000000006150000-0x0000000006159000-memory.dmp
memory/5064-40-0x0000000006560000-0x0000000006587000-memory.dmp
memory/5064-39-0x0000000006550000-0x000000000655C000-memory.dmp
memory/5064-38-0x0000000006510000-0x0000000006545000-memory.dmp
memory/5064-37-0x0000000005D90000-0x0000000005DA8000-memory.dmp
memory/5064-36-0x0000000005D70000-0x0000000005D82000-memory.dmp
memory/5064-26-0x0000000003100000-0x0000000003478000-memory.dmp
memory/5064-33-0x00000000036C0000-0x000000000376C000-memory.dmp
memory/5064-32-0x0000000005920000-0x0000000005A0A000-memory.dmp
memory/5064-31-0x00000000057B0000-0x0000000005916000-memory.dmp
memory/5064-30-0x0000000004F40000-0x00000000057A7000-memory.dmp
memory/5064-27-0x0000000003480000-0x00000000034C2000-memory.dmp
memory/5064-29-0x0000000003680000-0x00000000036B1000-memory.dmp
memory/5064-15-0x0000000002990000-0x0000000002B43000-memory.dmp
memory/5064-13-0x00000000024B0000-0x0000000002755000-memory.dmp
memory/5064-23-0x0000000002F10000-0x0000000002F36000-memory.dmp
memory/5064-22-0x0000000002DF0000-0x0000000002F01000-memory.dmp
memory/5064-21-0x0000000002CD0000-0x0000000002DF0000-memory.dmp
memory/5064-20-0x0000000002C30000-0x0000000002CCE000-memory.dmp
memory/5064-19-0x0000000002B80000-0x0000000002C23000-memory.dmp
memory/5064-14-0x0000000002760000-0x0000000002981000-memory.dmp
memory/5064-17-0x0000000002B60000-0x0000000002B6C000-memory.dmp
memory/5064-16-0x0000000002B50000-0x0000000002B57000-memory.dmp
memory/5064-12-0x0000000002440000-0x00000000024AF000-memory.dmp
memory/5064-11-0x0000000002290000-0x000000000243C000-memory.dmp