Analysis
- max time kernel
150s - max time network
157s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
06/06/2026, 21:55
General
- Target 94b9522a2dd130419b9880df1e91814b556955fb25b7aba294758edfec77bc42.exe
- Size 3.7MB
- Sample260606-1s85fads2x
- SHA256 94b9522a2dd130419b9880df1e91814b556955fb25b7aba294758edfec77bc42
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 29 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\94b9522a2dd130419b9880df1e91814b556955fb25b7aba294758edfec77bc42.exe"C:\Users\Admin\AppData\Local\Temp\94b9522a2dd130419b9880df1e91814b556955fb25b7aba294758edfec77bc42.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\TranslucentTB\updates\TranslucentTB\TranslucentTB.exe"C:\Users\Admin\AppData\Local\TranslucentTB\updates\TranslucentTB\TranslucentTB.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CGameDownloader.dll
Ijwhost.dll
MSVCP140.dll
Qt5Core.dll
Qt5Gui.dll
Qt5Network.dll
Qt5Qml.dll
Qt5QmlModels.dll
Qt5Quick.dll
Qt5QuickWidgets.dll
Qt5Widgets.dll
TranslucentTB.exe
VCRUNTIME140.dll
VCRUNTIME140D.dll
XChat.bmp
libcurl.dll
msvcp140_1.dll
original_CGameDownloader.DLL
qwindows.dll
quazip1-qt5.dll
ucrtbased.dll
vcruntime140_1.dll
zlibd.dll
memory/2036-164-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-176-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-141-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-139-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-138-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-137-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-136-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-135-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-134-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-149-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-150-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-151-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-165-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-122-0x00007FFCED930000-0x00007FFCEDD28000-memory.dmp
memory/2036-121-0x00007FFCDE620000-0x00007FFCDEB61000-memory.dmp
memory/2036-152-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-153-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-158-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-163-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-161-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-162-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-154-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-143-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-167-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-168-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-170-0x000001CAEDC70000-0x000001CAEDE23000-memory.dmp
memory/2036-171-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-172-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-173-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-142-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-177-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-178-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-181-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-182-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-183-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-186-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-187-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-188-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-191-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-192-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-195-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-196-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-197-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-200-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-201-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-202-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-205-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-206-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-207-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-210-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-211-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-212-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-215-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-216-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-219-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-220-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-221-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp
memory/2036-222-0x000001CAEDB40000-0x000001CAEDC69000-memory.dmp