Analysis
- max time kernel
300s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
12/07/2026, 03:35
General
- Target ABDownloadManager.exe
- Size 541KB
- Sample260712-d5sa5aew9w
- SHA256 61ad36f768a7668f54262a6ed52645bcaeac8f295916a1d6d94109577e2af9a1
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ABDownloadManager.exe"C:\Users\Admin\AppData\Local\Temp\ABDownloadManager.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ABDownloadManager.exeC:\Users\Admin\AppData\Local\Temp\ABDownloadManager.exe2⤵
- Loads dropped DLL
- Adds Run key to start application
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\ABDownloadManager.exe"C:\Users\Admin\AppData\Local\Temp\ABDownloadManager.exe" --background1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ABDownloadManager.exeC:\Users\Admin\AppData\Local\Temp\ABDownloadManager.exe --background2⤵
- Checks processor information in registry
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
app.port
jna10336116286859655007.dll
tray_icon_9984823072512936987.ico
WinTray.dll
nucleus_windows_theme.dll
83aa4cc77f591dfc2374580bbd95f6ba_26c1aebe-42fe-413d-a497-f47c50f079d9
memory/3748-158-0x0000018CE0C10000-0x0000018CE0C20000-memory.dmp
memory/3748-15-0x0000018CE0900000-0x0000018CE0B70000-memory.dmp
memory/3748-58-0x0000018CE0BD0000-0x0000018CE0BE0000-memory.dmp
memory/3748-56-0x0000018CE0BC0000-0x0000018CE0BD0000-memory.dmp
memory/3748-55-0x0000018CE0BA0000-0x0000018CE0BB0000-memory.dmp
memory/3748-64-0x0000018CE0BE0000-0x0000018CE0BF0000-memory.dmp
memory/3748-63-0x0000018CE0900000-0x0000018CE0B70000-memory.dmp
memory/3748-62-0x0000018CE7E40000-0x0000018CE80B0000-memory.dmp
memory/3748-162-0x0000018CE0C20000-0x0000018CE0C30000-memory.dmp
memory/3748-70-0x0000018CE0C00000-0x0000018CE0C10000-memory.dmp
memory/3748-71-0x0000018CE0C10000-0x0000018CE0C20000-memory.dmp
memory/3748-69-0x0000018CE0BF0000-0x0000018CE0C00000-memory.dmp
memory/3748-73-0x0000018CE0C20000-0x0000018CE0C30000-memory.dmp
memory/3748-76-0x0000018CE0C30000-0x0000018CE0C40000-memory.dmp
memory/3748-78-0x0000018CE0B80000-0x0000018CE0B90000-memory.dmp
memory/3748-79-0x0000018CE0C40000-0x0000018CE0C50000-memory.dmp
memory/3748-75-0x0000018CE0B70000-0x0000018CE0B80000-memory.dmp
memory/3748-83-0x0000018CE0B90000-0x0000018CE0BA0000-memory.dmp
memory/3748-85-0x0000018CE0C50000-0x0000018CE0C60000-memory.dmp
memory/3748-92-0x0000018CE0BE0000-0x0000018CE0BF0000-memory.dmp
memory/3748-93-0x0000018CE0C80000-0x0000018CE0C90000-memory.dmp
memory/3748-91-0x0000018CE0BD0000-0x0000018CE0BE0000-memory.dmp
memory/3748-90-0x0000018CE0C70000-0x0000018CE0C80000-memory.dmp
memory/3748-89-0x0000018CE0BB0000-0x0000018CE0BC0000-memory.dmp
memory/3748-87-0x0000018CE0BA0000-0x0000018CE0BB0000-memory.dmp
memory/3748-16-0x0000018CE83D0000-0x0000018CE8640000-memory.dmp
memory/3748-84-0x0000018CE0BC0000-0x0000018CE0BD0000-memory.dmp
memory/3748-49-0x0000018CE0B90000-0x0000018CE0BA0000-memory.dmp
memory/3748-129-0x0000018CE0BF0000-0x0000018CE0C00000-memory.dmp
memory/3748-141-0x0000018CE0C00000-0x0000018CE0C10000-memory.dmp
memory/3748-47-0x0000018CE0B80000-0x0000018CE0B90000-memory.dmp
memory/3748-45-0x0000018CE0B70000-0x0000018CE0B80000-memory.dmp
memory/3748-377-0x0000018CDBB50000-0x0000018CDCAA5000-memory.dmp
memory/3748-5-0x0000018CE7E40000-0x0000018CE80B0000-memory.dmp
memory/3748-68-0x0000018CE83D0000-0x0000018CE8640000-memory.dmp
memory/3748-57-0x0000018CE0BB0000-0x0000018CE0BC0000-memory.dmp
memory/3748-86-0x0000018CE0C60000-0x0000018CE0C70000-memory.dmp
memory/3748-178-0x0000018CE0C30000-0x0000018CE0C40000-memory.dmp
memory/3748-225-0x0000018CE0C40000-0x0000018CE0C50000-memory.dmp
memory/3748-223-0x0000018CDBB50000-0x0000018CDCAA5000-memory.dmp
memory/3748-232-0x0000018CE0C60000-0x0000018CE0C70000-memory.dmp
memory/3748-231-0x0000018CE0C50000-0x0000018CE0C60000-memory.dmp
memory/3748-245-0x0000018CE0C70000-0x0000018CE0C80000-memory.dmp
memory/3748-251-0x0000018CE0C80000-0x0000018CE0C90000-memory.dmp
memory/3748-260-0x0000018CDBB50000-0x0000018CDCAA5000-memory.dmp
memory/3748-275-0x0000018CDBB50000-0x0000018CDCAA5000-memory.dmp
memory/3748-279-0x0000018CDBB50000-0x0000018CDCAA5000-memory.dmp
memory/3748-292-0x0000018CDBB50000-0x0000018CDCAA5000-memory.dmp
memory/3748-305-0x0000018CDBB50000-0x0000018CDCAA5000-memory.dmp
memory/3748-306-0x0000018CDBB50000-0x0000018CDCAA5000-memory.dmp
memory/3748-317-0x0000018CDBB50000-0x0000018CDCAA5000-memory.dmp
memory/3748-323-0x0000018CDBB50000-0x0000018CDCAA5000-memory.dmp
memory/3748-325-0x0000018CDBB50000-0x0000018CDCAA5000-memory.dmp
memory/3748-332-0x0000018CDBB50000-0x0000018CDCAA5000-memory.dmp
memory/3748-335-0x0000018CDBB50000-0x0000018CDCAA5000-memory.dmp
memory/3748-336-0x0000018CDBB50000-0x0000018CDCAA5000-memory.dmp
memory/3748-342-0x0000018CDBB50000-0x0000018CDCAA5000-memory.dmp
memory/3748-348-0x0000018CDBB50000-0x0000018CDCAA5000-memory.dmp
memory/3748-349-0x0000018CDBB50000-0x0000018CDCAA5000-memory.dmp
memory/3748-350-0x0000018CDBB50000-0x0000018CDCAA5000-memory.dmp
memory/3748-352-0x0000018CDBB50000-0x0000018CDCAA5000-memory.dmp
memory/3748-353-0x0000018CDBB50000-0x0000018CDCAA5000-memory.dmp
memory/3748-354-0x0000018CDBB50000-0x0000018CDCAA5000-memory.dmp
memory/3748-357-0x0000018CDBB50000-0x0000018CDCAA5000-memory.dmp
memory/3748-359-0x0000018CDBB50000-0x0000018CDCAA5000-memory.dmp
memory/3748-362-0x0000018CDBB50000-0x0000018CDCAA5000-memory.dmp
memory/3748-364-0x0000018CDBB50000-0x0000018CDCAA5000-memory.dmp
memory/3748-366-0x0000018CDBB50000-0x0000018CDCAA5000-memory.dmp
memory/3748-370-0x0000018CDBB50000-0x0000018CDCAA5000-memory.dmp
memory/3748-373-0x0000018CDBB50000-0x0000018CDCAA5000-memory.dmp
memory/3748-374-0x0000018CDBB50000-0x0000018CDCAA5000-memory.dmp
memory/5108-157-0x0000027CD63F0000-0x0000027CD7345000-memory.dmp