Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
07/07/2026, 04:46
General
- Target Nv2-PC.exe
- Size 10.3MB
- Sample260707-fdypyah14x
- SHA256 ea38bc7318f7dc18ee61cbdb73eba73bb7969c31ebbfccb0dfe3bda5f6d3a270
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nv2-PC.exe"C:\Users\Admin\AppData\Local\Temp\Nv2-PC.exe"1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x0000000000000500 0x00000000000004FC1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
settings.sxx
memory/424-0-0x00000000034E0000-0x00000000034E1000-memory.dmp
memory/424-4-0x0000000006960000-0x0000000006B60000-memory.dmp
memory/424-5-0x0000000006960000-0x0000000006B60000-memory.dmp
memory/424-14-0x0000000006CA0000-0x0000000006EA0000-memory.dmp
memory/424-15-0x0000000006CA0000-0x0000000006EA0000-memory.dmp
memory/424-16-0x00000000070A0000-0x00000000072A0000-memory.dmp
memory/424-25-0x00000000070A0000-0x00000000072A0000-memory.dmp
memory/424-26-0x0000000006CA0000-0x0000000006EA0000-memory.dmp
memory/424-22-0x0000000006CA0000-0x0000000006EA0000-memory.dmp
memory/424-21-0x0000000006CA0000-0x0000000006EA0000-memory.dmp
memory/424-20-0x00000000070A0000-0x00000000072A0000-memory.dmp
memory/424-19-0x0000000006CA0000-0x0000000006EA0000-memory.dmp
memory/424-18-0x0000000006CA0000-0x0000000006EA0000-memory.dmp
memory/424-24-0x0000000006CA0000-0x0000000006EA0000-memory.dmp
memory/424-23-0x0000000006CA0000-0x0000000006EA0000-memory.dmp
memory/424-121-0x0000000006960000-0x0000000006B60000-memory.dmp
memory/424-145-0x0000000006960000-0x0000000006B60000-memory.dmp
memory/424-221-0x0000000006960000-0x0000000006B60000-memory.dmp
memory/424-286-0x000000000A510000-0x000000000A710000-memory.dmp
memory/424-288-0x000000000A510000-0x000000000A710000-memory.dmp
memory/424-287-0x000000000A510000-0x000000000A710000-memory.dmp
memory/424-285-0x000000000A510000-0x000000000A710000-memory.dmp
memory/424-284-0x000000000A510000-0x000000000A710000-memory.dmp
memory/424-283-0x000000000A510000-0x000000000A710000-memory.dmp
memory/424-278-0x00000000070A0000-0x00000000072A0000-memory.dmp
memory/424-277-0x00000000070A0000-0x00000000072A0000-memory.dmp
memory/424-276-0x00000000070A0000-0x00000000072A0000-memory.dmp
memory/424-275-0x00000000070A0000-0x00000000072A0000-memory.dmp
memory/424-274-0x00000000070A0000-0x00000000072A0000-memory.dmp
memory/424-273-0x00000000070A0000-0x00000000072A0000-memory.dmp
memory/424-272-0x00000000070A0000-0x00000000072A0000-memory.dmp
memory/424-267-0x0000000006960000-0x0000000006B60000-memory.dmp
memory/424-264-0x00000000070A0000-0x00000000072A0000-memory.dmp
memory/424-263-0x00000000070A0000-0x00000000072A0000-memory.dmp
memory/424-262-0x0000000006960000-0x0000000006B60000-memory.dmp
memory/424-258-0x00000000070A0000-0x00000000072A0000-memory.dmp
memory/424-253-0x0000000006CA0000-0x0000000006EA0000-memory.dmp
memory/424-252-0x0000000006CA0000-0x0000000006EA0000-memory.dmp
memory/424-248-0x00000000070A0000-0x00000000072A0000-memory.dmp
memory/424-242-0x00000000070A0000-0x00000000072A0000-memory.dmp
memory/424-227-0x0000000006CA0000-0x0000000006EA0000-memory.dmp
memory/424-226-0x00000000070A0000-0x00000000072A0000-memory.dmp
memory/424-281-0x000000000A510000-0x000000000A710000-memory.dmp
memory/424-280-0x000000000A510000-0x000000000A710000-memory.dmp
memory/424-279-0x00000000070A0000-0x00000000072A0000-memory.dmp
memory/424-259-0x00000000070A0000-0x00000000072A0000-memory.dmp
memory/424-209-0x0000000006960000-0x0000000006B60000-memory.dmp
memory/424-208-0x0000000006960000-0x0000000006B60000-memory.dmp
memory/424-199-0x0000000006960000-0x0000000006B60000-memory.dmp
memory/424-182-0x0000000006960000-0x0000000006B60000-memory.dmp
memory/424-180-0x0000000006960000-0x0000000006B60000-memory.dmp
memory/424-138-0x0000000006960000-0x0000000006B60000-memory.dmp
memory/424-139-0x0000000006960000-0x0000000006B60000-memory.dmp
memory/424-137-0x0000000006960000-0x0000000006B60000-memory.dmp
memory/424-136-0x0000000006960000-0x0000000006B60000-memory.dmp
memory/424-135-0x0000000006960000-0x0000000006B60000-memory.dmp
memory/424-133-0x0000000006960000-0x0000000006B60000-memory.dmp
memory/424-132-0x0000000006960000-0x0000000006B60000-memory.dmp
memory/424-131-0x0000000006960000-0x0000000006B60000-memory.dmp
memory/424-130-0x0000000006960000-0x0000000006B60000-memory.dmp
memory/424-129-0x0000000006960000-0x0000000006B60000-memory.dmp
memory/424-122-0x0000000006960000-0x0000000006B60000-memory.dmp
memory/424-115-0x0000000006960000-0x0000000006B60000-memory.dmp
memory/424-134-0x0000000006960000-0x0000000006B60000-memory.dmp
memory/424-128-0x0000000006960000-0x0000000006B60000-memory.dmp
memory/424-909-0x00000000034E0000-0x00000000034E1000-memory.dmp