Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
28/06/2026, 03:23
General
- Target encoder.exe
- Size 37.1MB
- Sample260628-dxy4psez6v
- SHA256 ffadfcfd54e76d2666bad15be22bd336d1da81b6216b5ef8400faf6b6b511fef
Malware Config
Signatures
- Loads dropped DLL 22 IoCs
- Drops file in System32 directory 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\encoder.exe"C:\Users\Admin\AppData\Local\Temp\encoder.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\encoder.exe"C:\Users\Admin\AppData\Local\Temp\encoder.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-ChildItem Cert:\LocalMachine\Root, Cert:\CurrentUser\Root | Where-Object {$_.Subject -like '*mitmproxy*'} | Measure-Object | Select-Object -ExpandProperty Count"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\certutil.execertutil -viewstore -user Root3⤵
-
-
-
C:\Windows\System32\CredentialUIBroker.exe"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainerFailedMip -Embedding1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
_imaging.cp314-win_amd64.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
auto.tcl
cp1252.enc
pkgIndex.tcl
init.tcl
pkgIndex.tcl
package.tcl
tclIndex
tm.tcl
button.tcl
entry.tcl
icons.tcl
listbox.tcl
menu.tcl
panedwindow.tcl
pkgIndex.tcl
scale.tcl
tk.tcl
_tkinter.pyd
_wmi.pyd
_zstd.pyd
base_library.zip
blue.json
INSTALLER
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
python3.DLL
python314.dll
Lorem ipsum.txt
tcl86t.dll
msgcat-1.6.1.tm
tk86t.dll
zlib1.dll
memory/2712-1145-0x00007FFE775BF000-0x00007FFE775C0000-memory.dmp
memory/2712-1146-0x00007FFE77430000-0x00007FFE77DD4000-memory.dmp
memory/2712-1147-0x00007FFE77430000-0x00007FFE77DD4000-memory.dmp
memory/2712-1151-0x00007FFE77430000-0x00007FFE77DD4000-memory.dmp
memory/2712-1150-0x000002E6F21D0000-0x000002E6F21F2000-memory.dmp
memory/2712-1152-0x00007FFE77430000-0x00007FFE77DD4000-memory.dmp
memory/2712-1153-0x00007FFE77430000-0x00007FFE77DD4000-memory.dmp
memory/2712-1154-0x00007FFE77430000-0x00007FFE77DD4000-memory.dmp
memory/2712-1155-0x00007FFE77430000-0x00007FFE77DD4000-memory.dmp
memory/2712-1159-0x00007FFE77430000-0x00007FFE77DD4000-memory.dmp
memory/2712-1158-0x00007FFE77430000-0x00007FFE77DD4000-memory.dmp
memory/2712-1156-0x00007FFE77430000-0x00007FFE77DD4000-memory.dmp
memory/5072-1160-0x00007FFE8CD30000-0x00007FFE8CD59000-memory.dmp