Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
04/07/2026, 00:31
General
- Target file.exe
- Size 686KB
- Sample260704-at32pshy21
- SHA256 ffc708aed38519ea8799e0cabebf6444934d1aa7db9f83a3c31b6847ed139b6d
Malware Config
Signatures
- Adds policy Run key to start application 2 TTPs 2 IoCs
- Executes dropped EXE 1 IoCs
- Drops file in Windows directory 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Adds policy Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\RuntimeBroker.exe"C:\Windows\System32\RuntimeBroker.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\setup_649a66c8\setup_649a66c8.exe"C:\Users\Admin\AppData\Local\Temp\setup_649a66c8\setup_649a66c8.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\RuntimeBroker.exe"C:\Windows\System32\RuntimeBroker.exe"3⤵
-
-
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" -wdenable1⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
TmpEAB9.tmp
setup_649a66c8.exe
memory/1220-900-0x0000025F25390000-0x0000025F253DC000-memory.dmp
memory/1220-899-0x0000025F0CAC0000-0x0000025F0CAD8000-memory.dmp
memory/1220-898-0x0000025F0CA60000-0x0000025F0CAB4000-memory.dmp
memory/1220-888-0x0000025F0C830000-0x0000025F0C83B000-memory.dmp
memory/1344-445-0x0000013B268A0000-0x0000013B268C4000-memory.dmp
memory/1344-446-0x0000013B268A0000-0x0000013B268C4000-memory.dmp
memory/1344-442-0x0000013B268A0000-0x0000013B268C4000-memory.dmp
memory/1344-449-0x0000013B268A0000-0x0000013B268C4000-memory.dmp
memory/1344-444-0x0000013B268A0000-0x0000013B268C4000-memory.dmp
memory/1344-441-0x0000013B266E0000-0x0000013B266FE000-memory.dmp
memory/1344-443-0x0000013B268A0000-0x0000013B268C4000-memory.dmp
memory/1356-0-0x0000019CD8D60000-0x0000019CD8E4D000-memory.dmp
memory/1356-438-0x0000019CD8C80000-0x0000019CD8C8B000-memory.dmp
memory/3796-893-0x0000016CB4740000-0x0000016CB4764000-memory.dmp
memory/3796-892-0x0000016CB4740000-0x0000016CB4764000-memory.dmp
memory/3796-895-0x0000016CB4740000-0x0000016CB4764000-memory.dmp
memory/3796-894-0x0000016CB4740000-0x0000016CB4764000-memory.dmp
memory/3796-896-0x0000016CB4740000-0x0000016CB4764000-memory.dmp
memory/3796-905-0x0000016CB4740000-0x0000016CB4764000-memory.dmp