Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
25/06/2026, 12:11
General
- Target PerthTweaks.GameMode.exe
- Size 68.8MB
- Sample260625-pc3ryabt9y
- SHA256 0b19ed5c04f2ddec5ac98ba4ca5e1656e4cdb12d5c3d31f9829e81160dd1c303
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PerthTweaks.GameMode.exe"C:\Users\Admin\AppData\Local\Temp\PerthTweaks.GameMode.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
wpfgfx_cor3.dll
memory/3488-90-0x0000026323BE0000-0x0000026324380000-memory.dmp
memory/3488-111-0x00000263232C0000-0x00000263232E0000-memory.dmp
memory/3488-39-0x00000263226E0000-0x0000026322F10000-memory.dmp
memory/3488-55-0x000002631D970000-0x000002631D990000-memory.dmp
memory/3488-75-0x0000026321D20000-0x0000026321D40000-memory.dmp
memory/3488-123-0x0000026323300000-0x0000026323320000-memory.dmp
memory/3488-86-0x0000026323080000-0x00000263230D0000-memory.dmp
memory/3488-83-0x0000026321D60000-0x0000026321E70000-memory.dmp
memory/3488-31-0x000002631D8C0000-0x000002631D910000-memory.dmp
memory/3488-67-0x0000026321BF0000-0x0000026321C10000-memory.dmp
memory/3488-63-0x0000026321C60000-0x0000026321CA0000-memory.dmp
memory/3488-59-0x0000026321BD0000-0x0000026321BF0000-memory.dmp
memory/3488-47-0x000002631D950000-0x000002631D970000-memory.dmp
memory/3488-43-0x0000026321B30000-0x0000026321BB0000-memory.dmp
memory/3488-51-0x0000026307130000-0x0000026307140000-memory.dmp
memory/3488-19-0x0000026321900000-0x0000026321B30000-memory.dmp
memory/3488-23-0x000002631D200000-0x000002631D360000-memory.dmp
memory/3488-6-0x000002631C570000-0x000002631D200000-memory.dmp
memory/3488-35-0x000002631D910000-0x000002631D950000-memory.dmp
memory/3488-94-0x00000263230D0000-0x0000026323100000-memory.dmp
memory/3488-71-0x0000026321CC0000-0x0000026321CF0000-memory.dmp
memory/3488-135-0x0000026305780000-0x0000026305790000-memory.dmp
memory/3488-131-0x00000263244E0000-0x0000026324520000-memory.dmp
memory/3488-119-0x00000263233E0000-0x0000026323430000-memory.dmp
memory/3488-115-0x0000026321EA0000-0x0000026321EB0000-memory.dmp
memory/3488-127-0x0000026324580000-0x00000263245E0000-memory.dmp
memory/3488-107-0x0000026324380000-0x0000026324440000-memory.dmp
memory/3488-103-0x0000026323130000-0x0000026323160000-memory.dmp
memory/3488-98-0x0000026323200000-0x0000026323290000-memory.dmp
memory/3488-145-0x0000026325420000-0x0000026325470000-memory.dmp
memory/3488-142-0x00000263252B0000-0x0000026325420000-memory.dmp
memory/3488-15-0x0000026307270000-0x0000026307290000-memory.dmp
memory/3488-10-0x000002631E9C0000-0x000002631F920000-memory.dmp
memory/3488-154-0x0000026325910000-0x0000026325980000-memory.dmp
memory/3488-158-0x0000026325B80000-0x0000026325CE0000-memory.dmp
memory/3488-162-0x0000026325090000-0x00000263250A0000-memory.dmp
memory/3488-166-0x0000026325120000-0x0000026325130000-memory.dmp