Analysis
- user interaction
yes - max time kernel
330s - max time network
290s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
05/07/2026, 17:29
General
- Target EMULATOR.exe
- Size 20.1MB
- Sample260705-v2v2aaas8n
- SHA256 324b5844650ee36391f527880502a7eac8c9d0a605988951fb6bd294e5ff41d2
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\EMULATOR.exe"C:\Users\Admin\AppData\Local\Temp\EMULATOR.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
- Suspicious behavior: AddClipboardFormatListener
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
- Suspicious behavior: AddClipboardFormatListener
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1824-0-0x0000000140161000-0x0000000140D71000-memory.dmp
memory/1824-2-0x00007FFB0FB40000-0x00007FFB0FB42000-memory.dmp
memory/1824-1-0x00007FFB0FB30000-0x00007FFB0FB32000-memory.dmp
memory/1824-3-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-7-0x00000000008B0000-0x00000000008B1000-memory.dmp
memory/1824-8-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-9-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-10-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-11-0x0000000140161000-0x0000000140D71000-memory.dmp
memory/1824-12-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-13-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-14-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-15-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-16-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-17-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-18-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-19-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-20-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-21-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-22-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-23-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-24-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-25-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-26-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-27-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-28-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-29-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-30-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-31-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-32-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-33-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-34-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-35-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-36-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-37-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-38-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-39-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-40-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-41-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-42-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-43-0x0000000140000000-0x0000000142187000-memory.dmp
memory/1824-44-0x0000000140000000-0x0000000142187000-memory.dmp