Overview
overview
3Static
static
3UD Procces...to.lnk
windows11-21h2-x64
3UD Procces...UP.exe
windows11-21h2-x64
1UD Procces...UP.exe
windows11-21h2-x64
1UD Procces...ls.dll
windows11-21h2-x64
1UD Procces...ns.dll
windows11-21h2-x64
1UD Procces...es.dll
windows11-21h2-x64
1UD Procces...ls.dll
windows11-21h2-x64
1UD Procces...es.dll
windows11-21h2-x64
1UD Procces...ls.dll
windows11-21h2-x64
1UD Procces...ks.dll
windows11-21h2-x64
1UD Procces...us.dll
windows11-21h2-x64
1UD Procces...er.dll
windows11-21h2-x64
1UD Procces...es.dll
windows11-21h2-x64
1UD Procces...er.dll
windows11-21h2-x64
1Analysis
- max time kernel
149s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
28/06/2026, 02:33
Static task
static1
Behavioral task
behavioral1
Sample
UD Proccess Hacker/Process Hacker/DUP - Acceso directo.lnk
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
UD Proccess Hacker/Process Hacker/DUP.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
UD Proccess Hacker/Process Hacker/plugins/DUP.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral4
Sample
UD Proccess Hacker/Process Hacker/plugins/DotNetTools.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
UD Proccess Hacker/Process Hacker/plugins/ExtendedNotifications.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
UD Proccess Hacker/Process Hacker/plugins/ExtendedServices.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
UD Proccess Hacker/Process Hacker/plugins/ExtendedTools.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral8
Sample
UD Proccess Hacker/Process Hacker/plugins/HardwareDevices.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
UD Proccess Hacker/Process Hacker/plugins/NetworkTools.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral10
Sample
UD Proccess Hacker/Process Hacker/plugins/OnlineChecks.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
UD Proccess Hacker/Process Hacker/plugins/ToolStatus.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral12
Sample
UD Proccess Hacker/Process Hacker/plugins/Updater.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
UD Proccess Hacker/Process Hacker/plugins/UserNotes.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral14
Sample
UD Proccess Hacker/Process Hacker/plugins/WindowExplorer.dll
Resource
win11-20260513-en
windows11-21h2-x64
General
- Target UD Proccess Hacker/Process Hacker/DUP.exe
- Size 2.3MB
- Sample260628-c1vd9aey91
- SHA256 a956b4c5f7add385e7b68752185746d5ecbe933fde77eae2eb44432685296a06
- MD5 04522c0d75b3a49d1a1f2295d7baa498
- SHA1 f04f4908b3c7fa9af0f01177564cbf6070f031e4
- SHA512 3b0bfe0a9f48f7a8d98c8569119148936b46e3253f549cf5d4565bec792123ae7de85be925de8501a9e3b3840c1bce4f198e9a0d38209ed57a32192c9f68f7b0
- SSDEEP 49152:st7Gk7NEMKGnCmX3dF7PAwcFZfhFCZ1l2tQZkRV1QeKOOEL:stpN1OZUF2tQZG3QjOO
- TLSH T101B57D0266E700C8D1B7867CC677451AEB393D161B309AFF02A0D96B2FB7AD15939B13
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 DUP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz DUP.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3608 DUP.exe - Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 3608 DUP.exe Token: SeIncBasePriorityPrivilege 3608 DUP.exe Token: 33 3608 DUP.exe Token: SeLoadDriverPrivilege 3608 DUP.exe Token: SeProfSingleProcessPrivilege 3608 DUP.exe Token: SeBackupPrivilege 3608 DUP.exe Token: SeRestorePrivilege 3608 DUP.exe Token: SeShutdownPrivilege 3608 DUP.exe Token: SeTakeOwnershipPrivilege 3608 DUP.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe 3608 DUP.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3880 wrote to memory of 3608 3880 DUP.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\UD Proccess Hacker\Process Hacker\DUP.exe"C:\Users\Admin\AppData\Local\Temp\UD Proccess Hacker\Process Hacker\DUP.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\UD Proccess Hacker\Process Hacker\DUP.exe"C:\Users\Admin\AppData\Local\Temp\UD Proccess Hacker\Process Hacker\DUP.exe" -nomp2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3608
-