Analysis
- user interaction
yes - max time kernel
90s - max time network
82s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
22/06/2026, 22:44
General
- Target SatoshiTerminal.exe
- Size 216KB
- Sample260622-2payxagy4r
- SHA256 949b186936491c1fe536ce241227d29f24d82d711804786f9348bdea12fba62d
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
- Adds Run key to start application 2 TTPs 4 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SatoshiTerminal.exe"C:\Users\Admin\AppData\Local\Temp\SatoshiTerminal.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "Microsoft\Windows\WinThemeHelper" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBCD3.tmp.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker.exe" --hidden2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\WinThemeHelper.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\WinThemeHelper.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\WinThemeHelper.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\WinThemeHelper.exe" --hidden1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker.exe" --hidden1⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
RuntimeBroker.exe
tmpBCD3.tmp.xml
memory/2096-25-0x0000000000580000-0x000000000058C000-memory.dmp
memory/2096-34-0x00007FF9059A0000-0x00007FF906344000-memory.dmp
memory/2096-30-0x00007FF9059A0000-0x00007FF906344000-memory.dmp
memory/2096-29-0x00007FF9059A0000-0x00007FF906344000-memory.dmp
memory/2096-28-0x00007FF9059A0000-0x00007FF906344000-memory.dmp
memory/2096-27-0x00007FF9059A0000-0x00007FF906344000-memory.dmp
memory/2096-26-0x00007FF9059A0000-0x00007FF906344000-memory.dmp
memory/2504-16-0x00007FF9059A0000-0x00007FF906344000-memory.dmp
memory/2504-0-0x00007FF905B2F000-0x00007FF905B30000-memory.dmp
memory/2504-21-0x00007FF9059A0000-0x00007FF906344000-memory.dmp
memory/2504-22-0x00007FF9059A0000-0x00007FF906344000-memory.dmp
memory/2504-23-0x00007FF9059A0000-0x00007FF906344000-memory.dmp
memory/2504-19-0x00007FF9059A0000-0x00007FF906344000-memory.dmp
memory/2504-18-0x00007FF9059A0000-0x00007FF906344000-memory.dmp
memory/2504-20-0x00007FF9059A0000-0x00007FF906344000-memory.dmp
memory/2504-15-0x00007FF9059A0000-0x00007FF906344000-memory.dmp
memory/2504-3-0x00007FF9059A0000-0x00007FF906344000-memory.dmp
memory/2504-2-0x0000000001090000-0x0000000001096000-memory.dmp
memory/2504-32-0x00007FF9059A0000-0x00007FF906344000-memory.dmp
memory/2504-33-0x00007FF9059A0000-0x00007FF906344000-memory.dmp
memory/2504-1-0x0000000000900000-0x0000000000940000-memory.dmp
memory/2504-44-0x00007FF9059A0000-0x00007FF906344000-memory.dmp