Analysis
- max time kernel
149s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
- submitted
03/07/2026, 02:21
General
- Target Celestial.exe
- Size 900KB
- Sample260703-cteefsez7l
- SHA256 27146c0a0ff2677326a164b923f9a67ba6dd669721e3040accdfda0835611b2b
Malware Config
Signatures
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Celestial.exe"C:\Users\Admin\AppData\Local\Temp\Celestial.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3360-0-0x00007FFEC547F000-0x00007FFEC5480000-memory.dmp
memory/3360-1-0x00000163C1860000-0x00000163C1946000-memory.dmp
memory/3360-2-0x00007FFEC52F0000-0x00007FFEC5C94000-memory.dmp
memory/3360-4-0x00007FFEC52F0000-0x00007FFEC5C94000-memory.dmp
memory/3360-3-0x00007FFEC52F0000-0x00007FFEC5C94000-memory.dmp
memory/3360-5-0x00007FFEC52F0000-0x00007FFEC5C94000-memory.dmp
memory/3360-6-0x00007FFEC52F0000-0x00007FFEC5C94000-memory.dmp
memory/3360-7-0x00007FFEC52F0000-0x00007FFEC5C94000-memory.dmp
memory/3360-8-0x00007FFEC52F0000-0x00007FFEC5C94000-memory.dmp
memory/3360-9-0x00007FFEC52F0000-0x00007FFEC5C94000-memory.dmp
memory/3360-10-0x00007FFEC52F0000-0x00007FFEC5C94000-memory.dmp
memory/3360-11-0x00007FFEC52F0000-0x00007FFEC5C94000-memory.dmp
memory/3360-12-0x00007FFEC52F0000-0x00007FFEC5C94000-memory.dmp