Analysis
- user interaction
yes - max time kernel
148s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
26/06/2026, 07:47
General
- Target ABDownloadManager.exe
- Size 541KB
- Sample260626-jmh8dsav9r
- SHA256 61ad36f768a7668f54262a6ed52645bcaeac8f295916a1d6d94109577e2af9a1
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ABDownloadManager.exe"C:\Users\Admin\AppData\Local\Temp\ABDownloadManager.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ABDownloadManager.exeC:\Users\Admin\AppData\Local\Temp\ABDownloadManager.exe2⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\ABDownloadManager.exe"C:\Users\Admin\AppData\Local\Temp\ABDownloadManager.exe" --background1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ABDownloadManager.exeC:\Users\Admin\AppData\Local\Temp\ABDownloadManager.exe --background2⤵
- Checks processor information in registry
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
app.port
jna5155441689519385497.dll
tray_icon_9543430279289933103.ico
WinTray.dll
nucleus_windows_theme.dll
83aa4cc77f591dfc2374580bbd95f6ba_0614be28-6f9f-4e40-9823-d5629ec4caf8
memory/3984-103-0x000001E34DF50000-0x000001E34DF60000-memory.dmp
memory/3984-125-0x000001E34DF20000-0x000001E34DF30000-memory.dmp
memory/3984-45-0x000001E34DE10000-0x000001E34DE20000-memory.dmp
memory/3984-47-0x000001E34DE20000-0x000001E34DE30000-memory.dmp
memory/3984-49-0x000001E34DE30000-0x000001E34DE40000-memory.dmp
memory/3984-57-0x000001E34DE70000-0x000001E34DE80000-memory.dmp
memory/3984-113-0x000001E34DEE0000-0x000001E34DEF0000-memory.dmp
memory/3984-55-0x000001E34DE50000-0x000001E34DE60000-memory.dmp
memory/3984-54-0x000001E34DE40000-0x000001E34DE50000-memory.dmp
memory/3984-63-0x000001E3550E0000-0x000001E355350000-memory.dmp
memory/3984-70-0x000001E34DEC0000-0x000001E34DED0000-memory.dmp
memory/3984-75-0x000001E34DED0000-0x000001E34DEE0000-memory.dmp
memory/3984-74-0x000001E355670000-0x000001E3558E0000-memory.dmp
memory/3984-69-0x000001E34DEA0000-0x000001E34DEB0000-memory.dmp
memory/3984-101-0x000001E34DE90000-0x000001E34DEA0000-memory.dmp
memory/3984-67-0x000001E34DE90000-0x000001E34DEA0000-memory.dmp
memory/3984-66-0x000001E34DE80000-0x000001E34DE90000-memory.dmp
memory/3984-65-0x000001E34DBA0000-0x000001E34DE10000-memory.dmp
memory/3984-77-0x000001E34DEE0000-0x000001E34DEF0000-memory.dmp
memory/3984-82-0x000001E34DE10000-0x000001E34DE20000-memory.dmp
memory/3984-81-0x000001E34DF00000-0x000001E34DF10000-memory.dmp
memory/3984-80-0x000001E34DEF0000-0x000001E34DF00000-memory.dmp
memory/3984-85-0x000001E34DF10000-0x000001E34DF20000-memory.dmp
memory/3984-84-0x000001E34DE20000-0x000001E34DE30000-memory.dmp
memory/3984-89-0x000001E34DF20000-0x000001E34DF30000-memory.dmp
memory/3984-88-0x000001E34DE30000-0x000001E34DE40000-memory.dmp
memory/3984-93-0x000001E34DF30000-0x000001E34DF40000-memory.dmp
memory/3984-92-0x000001E34DE60000-0x000001E34DE70000-memory.dmp
memory/3984-91-0x000001E34DE50000-0x000001E34DE60000-memory.dmp
memory/3984-90-0x000001E34DE40000-0x000001E34DE50000-memory.dmp
memory/3984-96-0x000001E34DF40000-0x000001E34DF50000-memory.dmp
memory/3984-95-0x000001E34DE70000-0x000001E34DE80000-memory.dmp
memory/3984-107-0x000001E34DEC0000-0x000001E34DED0000-memory.dmp
memory/3984-106-0x000001E34DEA0000-0x000001E34DEB0000-memory.dmp
memory/3984-105-0x000001E34DF70000-0x000001E34DF80000-memory.dmp
memory/3984-104-0x000001E34DF60000-0x000001E34DF70000-memory.dmp
memory/3984-15-0x000001E34DBA0000-0x000001E34DE10000-memory.dmp
memory/3984-102-0x000001E34DEB0000-0x000001E34DEC0000-memory.dmp
memory/3984-68-0x000001E34DEB0000-0x000001E34DEC0000-memory.dmp
memory/3984-16-0x000001E355670000-0x000001E3558E0000-memory.dmp
memory/3984-56-0x000001E34DE60000-0x000001E34DE70000-memory.dmp
memory/3984-112-0x000001E34DF90000-0x000001E34DFA0000-memory.dmp
memory/3984-122-0x000001E34DF10000-0x000001E34DF20000-memory.dmp
memory/3984-124-0x000001E34DFD0000-0x000001E34DFE0000-memory.dmp
memory/3984-100-0x000001E34DE80000-0x000001E34DE90000-memory.dmp
memory/3984-128-0x000001E34DFE0000-0x000001E34DFF0000-memory.dmp
memory/3984-127-0x000001E34DF30000-0x000001E34DF40000-memory.dmp
memory/3984-123-0x000001E34DFC0000-0x000001E34DFD0000-memory.dmp
memory/3984-119-0x000001E34DFB0000-0x000001E34DFC0000-memory.dmp
memory/3984-118-0x000001E34DFA0000-0x000001E34DFB0000-memory.dmp
memory/3984-117-0x000001E34DF00000-0x000001E34DF10000-memory.dmp
memory/3984-116-0x000001E34DEF0000-0x000001E34DF00000-memory.dmp
memory/3984-110-0x000001E34DED0000-0x000001E34DEE0000-memory.dmp
memory/3984-111-0x000001E34DF80000-0x000001E34DF90000-memory.dmp
memory/3984-139-0x000001E34DF60000-0x000001E34DF70000-memory.dmp
memory/3984-138-0x000001E34DF50000-0x000001E34DF60000-memory.dmp
memory/3984-137-0x000001E34E020000-0x000001E34E030000-memory.dmp
memory/3984-136-0x000001E34E010000-0x000001E34E020000-memory.dmp
memory/3984-135-0x000001E34E000000-0x000001E34E010000-memory.dmp
memory/3984-142-0x000001E34E030000-0x000001E34E040000-memory.dmp
memory/3984-141-0x000001E34DF70000-0x000001E34DF80000-memory.dmp
memory/3984-145-0x000001E34E040000-0x000001E34E050000-memory.dmp
memory/3984-144-0x000001E34DF80000-0x000001E34DF90000-memory.dmp
memory/3984-134-0x000001E34DFF0000-0x000001E34E000000-memory.dmp
memory/3984-133-0x000001E34DF40000-0x000001E34DF50000-memory.dmp
memory/3984-173-0x000001E34DF90000-0x000001E34DFA0000-memory.dmp
memory/3984-190-0x000001E34DFA0000-0x000001E34DFB0000-memory.dmp
memory/3984-5-0x000001E3550E0000-0x000001E355350000-memory.dmp
memory/3984-191-0x000001E34DFB0000-0x000001E34DFC0000-memory.dmp
memory/3984-255-0x000001E34DFC0000-0x000001E34DFD0000-memory.dmp
memory/3984-256-0x000001E34DFD0000-0x000001E34DFE0000-memory.dmp
memory/3984-262-0x000001E34DFE0000-0x000001E34DFF0000-memory.dmp
memory/3984-274-0x000001E34DFF0000-0x000001E34E000000-memory.dmp
memory/3984-277-0x000001E34E020000-0x000001E34E030000-memory.dmp
memory/3984-276-0x000001E34E010000-0x000001E34E020000-memory.dmp
memory/3984-275-0x000001E34E000000-0x000001E34E010000-memory.dmp
memory/3984-283-0x000001E34E030000-0x000001E34E040000-memory.dmp
memory/3984-289-0x000001E34E040000-0x000001E34E050000-memory.dmp