Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/07/2026, 21:44
General
- Target tmpm5oc686g.exe
- Size 85.5MB
- Sample260704-1lpr8aet3w
- SHA256 4e697a35dfe65c975bf549fb3bc13828e26d35beaadef52a4e62079153e07abc
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 3 IoCs
- Modifies registry class 7 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmpm5oc686g.exe"C:\Users\Admin\AppData\Local\Temp\tmpm5oc686g.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies registry class
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
av_libglesv2.dll
libHarfBuzzSharp.dll
libSkiaSharp.dll
memory/4624-113-0x00000274D2F30000-0x00000274D2F50000-memory.dmp
memory/4624-180-0x00000274D4680000-0x00000274D46B0000-memory.dmp
memory/4624-38-0x0000026CB5040000-0x0000026CB5090000-memory.dmp
memory/4624-34-0x0000026CB4E70000-0x0000026CB4EA0000-memory.dmp
memory/4624-26-0x0000026CB2B50000-0x0000026CB2B80000-memory.dmp
memory/4624-18-0x0000026CB23F0000-0x0000026CB2420000-memory.dmp
memory/4624-42-0x0000026CB50D0000-0x0000026CB50F0000-memory.dmp
memory/4624-46-0x0000026CB51A0000-0x0000026CB51E0000-memory.dmp
memory/4624-50-0x0000026CB52F0000-0x0000026CB53A0000-memory.dmp
memory/4624-22-0x0000026CB2980000-0x0000026CB29C0000-memory.dmp
memory/4624-56-0x0000026CB22F0000-0x0000026CB2300000-memory.dmp
memory/4624-10-0x0000026CB2330000-0x0000026CB2350000-memory.dmp
memory/4624-66-0x00000274CE560000-0x00000274CE620000-memory.dmp
memory/4624-62-0x0000026CB7460000-0x0000026CB7490000-memory.dmp
memory/4624-70-0x00000274D14C0000-0x00000274D1540000-memory.dmp
memory/4624-74-0x00000274D16D0000-0x00000274D17D0000-memory.dmp
memory/4624-86-0x00000274D1880000-0x00000274D18C0000-memory.dmp
memory/4624-82-0x00000274D1F20000-0x00000274D20D0000-memory.dmp
memory/4624-94-0x00000274D1900000-0x00000274D1920000-memory.dmp
memory/4624-90-0x00000274D18C0000-0x00000274D1900000-memory.dmp
memory/4624-78-0x00000274D1580000-0x00000274D15B0000-memory.dmp
memory/4624-98-0x00000274D25F0000-0x00000274D2620000-memory.dmp
memory/4624-102-0x00000274D25A0000-0x00000274D25C0000-memory.dmp
memory/4624-7-0x0000026CB3AF0000-0x0000026CB4A40000-memory.dmp
memory/4624-30-0x0000026CB2420000-0x0000026CB2440000-memory.dmp
memory/4624-140-0x00000274D30E0000-0x00000274D3100000-memory.dmp
memory/4624-121-0x00000274D3050000-0x00000274D3070000-memory.dmp
memory/4624-136-0x00000274D3A00000-0x00000274D3C70000-memory.dmp
memory/4624-132-0x00000274D35D0000-0x00000274D3670000-memory.dmp
memory/4624-125-0x00000274D3090000-0x00000274D30B0000-memory.dmp
memory/4624-109-0x00000274D2FE0000-0x00000274D3050000-memory.dmp
memory/4624-117-0x00000274D32F0000-0x00000274D34C0000-memory.dmp
memory/4624-148-0x00000274D36E0000-0x00000274D3700000-memory.dmp
memory/4624-144-0x00000274D3C70000-0x00000274D3CF0000-memory.dmp
memory/4624-152-0x00000274D2640000-0x00000274D2660000-memory.dmp
memory/4624-156-0x00000274D4230000-0x00000274D45B0000-memory.dmp
memory/4624-168-0x00000274D49A0000-0x00000274D4C50000-memory.dmp
memory/4624-164-0x00000274D3D30000-0x00000274D3D40000-memory.dmp
memory/4624-160-0x00000274D3E10000-0x00000274D3E70000-memory.dmp
memory/4624-172-0x00000274D5720000-0x00000274D5E90000-memory.dmp
memory/4624-176-0x00000274D45D0000-0x00000274D45F0000-memory.dmp
memory/4624-14-0x0000026CB2380000-0x0000026CB23A0000-memory.dmp
memory/4624-188-0x00000274D4630000-0x00000274D4650000-memory.dmp
memory/4624-184-0x00000274D3D40000-0x00000274D3D50000-memory.dmp
memory/4624-192-0x00000274D4D00000-0x00000274D4D50000-memory.dmp
memory/4624-196-0x00000274E4540000-0x00000274E45A0000-memory.dmp
memory/4624-385-0x00000274E8870000-0x00000274E8960000-memory.dmp
memory/4624-382-0x00000274E4740000-0x00000274E4860000-memory.dmp
memory/4624-377-0x00000274E2D30000-0x00000274E2D40000-memory.dmp