Analysis
- max time kernel
150s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/07/2026, 22:28
General
- Target 62d8ac1b5cabeabe473a95a0c23132017e471d43cee59b7578663ca2f804295e.exe
- Size 3.2MB
- Sample260712-2d2bqahv2l
- SHA256 62d8ac1b5cabeabe473a95a0c23132017e471d43cee59b7578663ca2f804295e
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Costura .NET executable packer 1 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 6 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\62d8ac1b5cabeabe473a95a0c23132017e471d43cee59b7578663ca2f804295e.exe"C:\Users\Admin\AppData\Local\Temp\62d8ac1b5cabeabe473a95a0c23132017e471d43cee59b7578663ca2f804295e.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c set2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\62d8ac1b5cabeabe473a95a0c23132017e471d43cee59b7578663ca2f804295e.exePECMD**pecmd-cmd* PUTF -dd -skipb=1133568 -len=2243432 "C:\Users\Admin\AppData\Local\Temp\~5201143508335435207.tmp",,C:\Users\Admin\AppData\Local\Temp\62d8ac1b5cabeabe473a95a0c23132017e471d43cee59b7578663ca2f804295e.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\~5953736272043376247~\sg.tmp7zG_exe x "C:\Users\Admin\AppData\Local\Temp\~5201143508335435207.tmp" -y -aoa -o"C:\Users\Admin\AppData\Local\Temp\~3130490664583064060"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\~3130490664583064060\Frpclient.exe"C:\Users\Admin\AppData\Local\Temp\~3130490664583064060\Frpclient.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Frpclient.exe
Frpclient.exe.Config
~5201143508335435207.tmp
sg.tmp
~~6481873590513336630.tmp
memory/4856-7-0x0000000000400000-0x0000000000596000-memory.dmp
memory/5068-0-0x0000000000400000-0x0000000000596000-memory.dmp
memory/5068-40-0x0000000000400000-0x0000000000596000-memory.dmp
memory/5772-34-0x0000000000C20000-0x0000000000CAC000-memory.dmp
memory/5772-35-0x0000000005F00000-0x00000000064BA000-memory.dmp
memory/5772-36-0x0000000005840000-0x00000000058D2000-memory.dmp
memory/5772-37-0x0000000073470000-0x0000000073C2C000-memory.dmp
memory/5772-38-0x0000000003250000-0x0000000003272000-memory.dmp
memory/5772-39-0x00000000058F0000-0x00000000058FA000-memory.dmp
memory/5772-33-0x0000000073482000-0x0000000073483000-memory.dmp
memory/5772-42-0x0000000073482000-0x0000000073483000-memory.dmp
memory/5772-43-0x0000000073470000-0x0000000073C2C000-memory.dmp