Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
02/07/2026, 14:29
General
- Target tmp6870_fnl.exe
- Size 8.3MB
- Sample260702-rtjfqsc17k
- SHA256 0c487c195ede1ed5a387c908c14e7b2e73a5cf57de9aaab80dadf72a6915f0e7
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 52 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp6870_fnl.exe"C:\Users\Admin\AppData\Local\Temp\tmp6870_fnl.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nsp506F.tmp\Downloader\Downloader.exe"C:\Users\Admin\AppData\Local\Temp\nsp506F.tmp\Downloader\Downloader.exe" --fileName="tmp6870_fnl.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Gryphline\d9f71f86325c5b9733268efda40413c8\tmp\downloader\download\240669828\tmp6870_fnl.exe"C:\Users\Admin\AppData\Local\Gryphline\d9f71f86325c5b9733268efda40413c8\tmp\downloader\download\240669828\tmp6870_fnl.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CrashSight64.dll
Downloader.exe
sdid_s
app.data
eld_Downloader.db
System.dll
Widget.dll
bg_mark.png
bg_toast.png
sys_res.dll
sdid_p
memory/1236-343-0x0000000003580000-0x0000000003581000-memory.dmp
memory/1236-442-0x0000000003580000-0x0000000003581000-memory.dmp
memory/1236-441-0x0000000003580000-0x0000000003581000-memory.dmp
memory/1236-437-0x0000000003580000-0x0000000003581000-memory.dmp
memory/1236-439-0x0000000003580000-0x0000000003581000-memory.dmp
memory/1236-440-0x0000000003580000-0x0000000003581000-memory.dmp
memory/1236-344-0x0000000003580000-0x0000000003581000-memory.dmp
memory/1236-438-0x0000000003580000-0x0000000003581000-memory.dmp
memory/1236-341-0x0000000003580000-0x0000000003581000-memory.dmp
memory/3992-28-0x000001FA2B130000-0x000001FA2B131000-memory.dmp
memory/3992-23-0x000001FA2B130000-0x000001FA2B131000-memory.dmp
memory/3992-22-0x000001FA2B130000-0x000001FA2B131000-memory.dmp
memory/3992-29-0x000001FA2B130000-0x000001FA2B131000-memory.dmp
memory/3992-30-0x000001FA2B130000-0x000001FA2B131000-memory.dmp
memory/3992-31-0x000001FA2B130000-0x000001FA2B131000-memory.dmp
memory/3992-32-0x000001FA2B130000-0x000001FA2B131000-memory.dmp
memory/3992-33-0x000001FA2B130000-0x000001FA2B131000-memory.dmp
memory/3992-39-0x000001FA281C0000-0x000001FA281D0000-memory.dmp
memory/3992-34-0x000001FA2B130000-0x000001FA2B131000-memory.dmp
memory/3992-24-0x000001FA2B130000-0x000001FA2B131000-memory.dmp
memory/3992-21-0x00007FFDE2190000-0x00007FFDE2191000-memory.dmp
memory/3992-54-0x000001FA281C0000-0x000001FA281D0000-memory.dmp