Analysis
- max time kernel
149s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
- submitted
01/07/2026, 07:52
General
- Target 85c8e3107a48af00387d80b7f0d7624bcbe2cbbd7fcb49d979cec376c56962ec.exe
- Size 10.7MB
- Sample260701-jqq3eaht5n
- SHA256 85c8e3107a48af00387d80b7f0d7624bcbe2cbbd7fcb49d979cec376c56962ec
Malware Config
Signatures
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Suspicious behavior: EnumeratesProcesses 32 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\85c8e3107a48af00387d80b7f0d7624bcbe2cbbd7fcb49d979cec376c56962ec.exe"C:\Users\Admin\AppData\Local\Temp\85c8e3107a48af00387d80b7f0d7624bcbe2cbbd7fcb49d979cec376c56962ec.exe"1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regini.exeC:\Windows\SysWOW64\regini.exe2⤵
-
-
C:\Windows\SysWOW64\rasdial.exeC:\Windows\SysWOW64\rasdial.exe2⤵
-
-
C:\Windows\SysWOW64\SystemPropertiesProtection.exeC:\Windows\SysWOW64\SystemPropertiesProtection.exe2⤵
-
-
C:\Windows\SysWOW64\perfmon.exeC:\Windows\SysWOW64\perfmon.exe2⤵
-
-
C:\Windows\SysWOW64\calc.exeC:\Windows\SysWOW64\calc.exe2⤵
-
-
C:\Windows\SysWOW64\diskpart.exeC:\Windows\SysWOW64\diskpart.exe2⤵
-
-
C:\Windows\SysWOW64\RunLegacyCPLElevated.exeC:\Windows\SysWOW64\RunLegacyCPLElevated.exe2⤵
-
-
C:\Windows\SysWOW64\AppVDllSurrogate.exeC:\Windows\SysWOW64\AppVDllSurrogate.exe2⤵
-
-
C:\Windows\SysWOW64\shutdown.exeC:\Windows\SysWOW64\shutdown.exe2⤵
-
-
C:\Windows\SysWOW64\perfmon.exeC:\Windows\SysWOW64\perfmon.exe2⤵
-
-
C:\Windows\SysWOW64\finger.exeC:\Windows\SysWOW64\finger.exe2⤵
-
-
C:\Windows\SysWOW64\RpcPing.exeC:\Windows\SysWOW64\RpcPing.exe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\SysWOW64\fontview.exeC:\Windows\SysWOW64\fontview.exe2⤵
-
-
C:\Windows\SysWOW64\HOSTNAME.EXEC:\Windows\SysWOW64\HOSTNAME.EXE2⤵
-
-
C:\Windows\SysWOW64\getmac.exeC:\Windows\SysWOW64\getmac.exe2⤵
-
-
C:\Windows\SysWOW64\SystemPropertiesRemote.exeC:\Windows\SysWOW64\SystemPropertiesRemote.exe2⤵
-
-
C:\Windows\SysWOW64\Dism.exeC:\Windows\SysWOW64\Dism.exe2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
DPRPHrpA.exe
lolhfzs.ini
time.ini
memory/1164-22-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-26-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-24-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-23-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-21-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-20-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-36-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-34-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-37-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-35-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-31-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-28-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-27-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-42-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-41-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-61-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-80-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-77-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-84-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-83-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-82-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-81-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-72-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-69-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-68-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-67-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-65-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-64-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-63-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-62-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-59-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-45-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-78-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-79-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-75-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-76-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-74-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-73-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-71-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-70-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-66-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-60-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-58-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-57-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-56-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-54-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-51-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-48-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-46-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-55-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-53-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-52-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-50-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-47-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-49-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-43-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-40-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-39-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-38-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-33-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-32-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-30-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-29-0x0000000000400000-0x0000000000F04000-memory.dmp
memory/1164-44-0x0000000000400000-0x0000000000F04000-memory.dmp