Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
02/07/2026, 12:15
General
- Target vanish.exe
- Size 1.4MB
- Sample260702-pe2bwsgs7k
- SHA256 5494b5da11d312fe2244984050664e4614248e48a5dd14fbf9ac5661818bbdf2
Malware Config
Signatures
- Costura .NET executable packer 1 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\vanish.exe"C:\Users\Admin\AppData\Local\Temp\vanish.exe"1⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2536-0-0x00007FFAC13AF000-0x00007FFAC13B0000-memory.dmp
memory/2536-1-0x000002332C010000-0x000002332C16E000-memory.dmp
memory/2536-2-0x00007FFAC1220000-0x00007FFAC1BC4000-memory.dmp
memory/2536-3-0x00007FFAC1220000-0x00007FFAC1BC4000-memory.dmp
memory/2536-4-0x00007FFAC1220000-0x00007FFAC1BC4000-memory.dmp
memory/2536-5-0x00007FFAC1220000-0x00007FFAC1BC4000-memory.dmp
memory/2536-7-0x00007FFAC1220000-0x00007FFAC1BC4000-memory.dmp
memory/2536-6-0x0000023347700000-0x00000233477D4000-memory.dmp
memory/2536-8-0x00000233478B0000-0x0000023347AA6000-memory.dmp
memory/2536-9-0x00007FFAC1220000-0x00007FFAC1BC4000-memory.dmp
memory/2536-10-0x00007FFAC1220000-0x00007FFAC1BC4000-memory.dmp
memory/2536-12-0x00007FFAC1220000-0x00007FFAC1BC4000-memory.dmp
memory/2536-11-0x00007FFAC1220000-0x00007FFAC1BC4000-memory.dmp
memory/2536-13-0x00007FFAC1220000-0x00007FFAC1BC4000-memory.dmp
memory/2536-14-0x00007FFAC1220000-0x00007FFAC1BC4000-memory.dmp
memory/2536-15-0x00007FFAC1220000-0x00007FFAC1BC4000-memory.dmp
memory/2536-16-0x00007FFAC1220000-0x00007FFAC1BC4000-memory.dmp
memory/2536-17-0x00007FFAC1220000-0x00007FFAC1BC4000-memory.dmp