Analysis
- max time kernel
149s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
02/07/2026, 11:55
General
- Target tmpjyr6hbop.exe
- Size 228KB
- Sample260702-n3khlsfy4l
- SHA256 696b2e8b23219a1631c1393d071f08bd8418c1af97f6614e2ee1be99546c07f9
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmpjyr6hbop.exe"C:\Users\Admin\AppData\Local\Temp\tmpjyr6hbop.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "Microsoft\Windows\WinThemeHelper" /XML "C:\Users\Admin\AppData\Local\Temp\tmp73F3.tmp.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\WinThemeHelper.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\WinThemeHelper.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\WinThemeHelper.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\WinThemeHelper.exe" --hidden1⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
RuntimeBroker.exe
tmp73F3.tmp.xml
screen_20260702_125721.png
memory/4128-21-0x0000000000DC0000-0x0000000000DCE000-memory.dmp
memory/4128-22-0x000000001C570000-0x000000001C580000-memory.dmp
memory/4128-27-0x000000001C570000-0x000000001C580000-memory.dmp
memory/5040-0-0x00000000007E0000-0x0000000000822000-memory.dmp
memory/5040-1-0x00000000010D0000-0x00000000010D6000-memory.dmp
memory/5040-2-0x000000001B530000-0x000000001B540000-memory.dmp
memory/5040-18-0x000000001B530000-0x000000001B540000-memory.dmp
memory/5040-25-0x000000001B530000-0x000000001B540000-memory.dmp
memory/5040-26-0x000000001B530000-0x000000001B540000-memory.dmp