Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
02/07/2026, 07:43
General
- Target 2c1942a6ffaf62eb48af3c463c0877c8f37f0770f8ec0d89bd300b47541c823f.exe
- Size 11.3MB
- Sample260702-jkrfzscv2l
- SHA256 2c1942a6ffaf62eb48af3c463c0877c8f37f0770f8ec0d89bd300b47541c823f
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 23 IoCs
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 6 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 14 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c1942a6ffaf62eb48af3c463c0877c8f37f0770f8ec0d89bd300b47541c823f.exe"C:\Users\Admin\AppData\Local\Temp\2c1942a6ffaf62eb48af3c463c0877c8f37f0770f8ec0d89bd300b47541c823f.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c set2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\~4795042940827322288~\sg.tmp7zG_exe x "C:\Users\Admin\AppData\Local\Temp\2c1942a6ffaf62eb48af3c463c0877c8f37f0770f8ec0d89bd300b47541c823f.exe" -y -aoa -o"C:\Users\Admin\AppData\Local\Temp\~135669491049152943"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\~135669491049152943\ESET官服数据库下载工具.exe"C:\Users\Admin\AppData\Local\Temp\~135669491049152943\ESET官服数据库下载工具.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ESET官服数据库下载工具.exe
Qt5Core.dll
Qt5Gui.dll
Qt5Network.dll
Qt5Svg.dll
Qt5Widgets.dll
qgenericbearer.dll
qsvgicon.dll
qgif.dll
qicns.dll
qico.dll
qjpeg.dll
qsvg.dll
qtga.dll
qtiff.dll
qwbmp.dll
qwebp.dll
libgcc_s_dw2-1.dll
libstdc++-6.dll
libwinpthread-1.dll
qwindows.dll
qwindowsvistastyle.dll
sg.tmp
memory/1584-166-0x0000000000400000-0x000000000057D000-memory.dmp
memory/1584-0-0x0000000000400000-0x000000000057D000-memory.dmp
memory/1700-177-0x000000006CE40000-0x000000006CE78000-memory.dmp
memory/1700-174-0x0000000069900000-0x0000000069AD5000-memory.dmp
memory/1700-184-0x000000006B840000-0x000000006B84F000-memory.dmp
memory/1700-130-0x0000000000930000-0x0000000000957000-memory.dmp
memory/1700-133-0x0000000068A80000-0x00000000690DC000-memory.dmp
memory/1700-128-0x0000000001E10000-0x0000000002421000-memory.dmp
memory/1700-149-0x00000000024D0000-0x00000000024E2000-memory.dmp
memory/1700-132-0x00000000690BD000-0x00000000690BE000-memory.dmp
memory/1700-126-0x0000000001E10000-0x0000000002421000-memory.dmp
memory/1700-169-0x0000000074250000-0x0000000074289000-memory.dmp
memory/1700-179-0x000000006C800000-0x000000006C814000-memory.dmp
memory/1700-175-0x0000000001E10000-0x0000000002421000-memory.dmp
memory/1700-172-0x0000000073FE0000-0x000000007424B000-memory.dmp
memory/1700-187-0x00000000677C0000-0x000000006783A000-memory.dmp
memory/1700-188-0x0000000067780000-0x00000000677A2000-memory.dmp
memory/1700-186-0x0000000066CC0000-0x0000000066CD0000-memory.dmp
memory/1700-185-0x000000006D100000-0x000000006D18D000-memory.dmp
memory/1700-171-0x0000000061B40000-0x00000000621EE000-memory.dmp
memory/1700-178-0x00000000024D0000-0x00000000024E2000-memory.dmp
memory/1700-163-0x0000000067780000-0x00000000677A2000-memory.dmp
memory/1700-164-0x0000000068A80000-0x00000000690DC000-memory.dmp
memory/1700-176-0x000000006AA80000-0x000000006AC6D000-memory.dmp
memory/1700-165-0x0000000068A80000-0x00000000690DC000-memory.dmp
memory/1700-183-0x0000000067940000-0x00000000679A3000-memory.dmp
memory/1700-182-0x00000000024F0000-0x0000000002500000-memory.dmp
memory/1700-181-0x00000000628C0000-0x000000006292B000-memory.dmp
memory/1700-180-0x000000006EA40000-0x000000006EA52000-memory.dmp
memory/1700-173-0x0000000073F10000-0x0000000073F29000-memory.dmp
memory/1700-168-0x0000000000930000-0x0000000000957000-memory.dmp
memory/1700-189-0x0000000068A80000-0x00000000690DC000-memory.dmp
memory/1700-215-0x0000000068A80000-0x00000000690DC000-memory.dmp
memory/1700-237-0x0000000068A80000-0x00000000690DC000-memory.dmp
memory/1700-259-0x0000000068A80000-0x00000000690DC000-memory.dmp
memory/1700-282-0x0000000068A80000-0x00000000690DC000-memory.dmp
memory/1700-304-0x0000000068A80000-0x00000000690DC000-memory.dmp
memory/1700-326-0x0000000068A80000-0x00000000690DC000-memory.dmp
memory/1700-348-0x0000000068A80000-0x00000000690DC000-memory.dmp
memory/1700-370-0x0000000068A80000-0x00000000690DC000-memory.dmp
memory/1700-392-0x0000000068A80000-0x00000000690DC000-memory.dmp
memory/1700-414-0x0000000068A80000-0x00000000690DC000-memory.dmp
memory/1700-436-0x0000000068A80000-0x00000000690DC000-memory.dmp
memory/1700-458-0x0000000068A80000-0x00000000690DC000-memory.dmp