Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/07/2026, 12:19
General
- Target 99bda4887c96cedec4140e766e98d167dad52fdd85135a97b32cd68aae64c6a3.exe
- Size 343KB
- Sample260709-phfvcsbt4s
- SHA256 99bda4887c96cedec4140e766e98d167dad52fdd85135a97b32cd68aae64c6a3
Score
8/10
Malware Config
Signatures
- Modifies RDP port number used by Windows 1 TTPs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\99bda4887c96cedec4140e766e98d167dad52fdd85135a97b32cd68aae64c6a3.exe"C:\Users\Admin\AppData\Local\Temp\99bda4887c96cedec4140e766e98d167dad52fdd85135a97b32cd68aae64c6a3.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\lazau8nr1q\active_desktop_launcher_x64.exe"C:\Users\Public\lazau8nr1q\active_desktop_launcher_x64.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Public\lazau8nr1q\active_desktop_launcher_x64.exeC:\Users\Public\lazau8nr1q\active_desktop_launcher_x64.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
GROUP
INSTALL_TIME
index.dat
index.dat
REMARK
active_desktop_launcher_x64.exe
active_desktop_render_x64.dll
hzgnf.log
memory/2036-48-0x0000022F21AC0000-0x0000022F21B7A000-memory.dmp
memory/2036-43-0x0000022F21AC0000-0x0000022F21B7A000-memory.dmp
memory/2064-10-0x0000019634CA0000-0x0000019634CA5000-memory.dmp
memory/2064-31-0x0000019636E50000-0x0000019636F0A000-memory.dmp
memory/2064-30-0x0000019636E50000-0x0000019636F0A000-memory.dmp
memory/2064-26-0x0000019636E50000-0x0000019636F0A000-memory.dmp
memory/2064-15-0x0000019636E50000-0x0000019636F0A000-memory.dmp
memory/2064-46-0x0000019636E50000-0x0000019636F0A000-memory.dmp
memory/2064-47-0x0000019636E50000-0x0000019636F0A000-memory.dmp
memory/2064-9-0x0000019634CA0000-0x0000019634CA5000-memory.dmp