Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
01/07/2026, 04:16
General
- Target 1fa44041_.exe
- Size 22.5MB
- Sample260701-ev43lsd19k
- SHA256 1da6f290459efcf121d9a84d43bbe052488e615ca49d91ed736cddbbac1657a3
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 5 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fa44041_.exe"C:\Users\Admin\AppData\Local\Temp\1fa44041_.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\StorageExplorer\StorageExplorer.exe"C:\ProgramData\StorageExplorer\StorageExplorer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\cmd.exe"cmd /c cd /d "C:\System Volume Information\Heat" && start "" "C:\ProgramData\StorageExplorer\StorageExplorer.exe""1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Cache.pmt
MAsMlX32.dll
StorageExplorer.exe
memory/976-39-0x0000022BA6DA0000-0x0000022BA7147000-memory.dmp
memory/976-27-0x0000000180000000-0x00000001803AB000-memory.dmp
memory/976-38-0x0000000180000000-0x00000001803AB000-memory.dmp
memory/976-35-0x0000000180000000-0x00000001803AB000-memory.dmp
memory/976-36-0x0000000180000000-0x00000001803AB000-memory.dmp
memory/976-40-0x0000000180000000-0x00000001803AB000-memory.dmp
memory/976-37-0x0000000180000000-0x00000001803AB000-memory.dmp
memory/3880-23-0x0000000180000000-0x000000018090A000-memory.dmp
memory/3880-26-0x0000000000400000-0x0000000000637000-memory.dmp
memory/3880-25-0x0000000180000000-0x000000018090A000-memory.dmp
memory/3880-24-0x0000000180000000-0x000000018090A000-memory.dmp
memory/3880-20-0x0000000180000000-0x000000018090A000-memory.dmp
memory/3880-21-0x0000000180000000-0x000000018090A000-memory.dmp
memory/3880-79-0x0000000000400000-0x0000000000637000-memory.dmp
memory/3880-22-0x0000000180000000-0x000000018090A000-memory.dmp
memory/3880-13-0x0000000180000000-0x000000018090A000-memory.dmp
memory/3880-78-0x0000000180000000-0x000000018090A000-memory.dmp
memory/4788-41-0x0000000001010000-0x000000000128B000-memory.dmp
memory/4788-62-0x0000000010000000-0x0000000010281000-memory.dmp
memory/4788-55-0x0000000010000000-0x0000000010281000-memory.dmp
memory/4788-53-0x0000000010000000-0x0000000010281000-memory.dmp
memory/4788-50-0x0000000010000000-0x0000000010281000-memory.dmp
memory/4788-52-0x0000000010000000-0x0000000010281000-memory.dmp
memory/4788-51-0x0000000010000000-0x0000000010281000-memory.dmp
memory/4788-42-0x0000000010000000-0x0000000010281000-memory.dmp
memory/4788-63-0x0000000010000000-0x0000000010281000-memory.dmp
memory/4788-65-0x0000000010000000-0x0000000010281000-memory.dmp
memory/4788-74-0x0000000003430000-0x0000000003457000-memory.dmp
memory/4788-73-0x0000000003430000-0x0000000003457000-memory.dmp
memory/4788-72-0x0000000003430000-0x0000000003457000-memory.dmp
memory/4788-71-0x0000000003430000-0x0000000003457000-memory.dmp
memory/4788-66-0x0000000003430000-0x0000000003457000-memory.dmp
memory/4788-75-0x0000000003430000-0x0000000003457000-memory.dmp
memory/4788-76-0x0000000003430000-0x0000000003457000-memory.dmp
memory/4788-56-0x0000000010000000-0x0000000010281000-memory.dmp
memory/4788-54-0x0000000010000000-0x0000000010281000-memory.dmp