Analysis
- max time kernel
150s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/07/2026, 04:25
General
- Target LilithClicker.exe
- Size 38KB
- Sample260712-e1yssacy5m
- SHA256 4ede4ad767b52468b9f5843e93fbd6b59f75849965528b5a6f6b5a37dd351111
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\LilithClicker.exe"C:\Users\Admin\AppData\Local\Temp\LilithClicker.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rgmoqavz\rgmoqavz.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7332.tmp" "c:\Users\Admin\AppData\Local\Temp\rgmoqavz\CSCDE73AC0440B347478FA2AF7C4EA1248.TMP"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
RES7332.tmp
rgmoqavz.dll
CSCDE73AC0440B347478FA2AF7C4EA1248.TMP
rgmoqavz.0.cs
rgmoqavz.cmdline
memory/5608-11-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/5608-23-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/5608-7-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/5608-6-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/5608-5-0x0000000002740000-0x0000000002762000-memory.dmp
memory/5608-4-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/5608-21-0x0000000002620000-0x0000000002628000-memory.dmp
memory/5608-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5608-22-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/5608-0-0x00007FFF2469F000-0x00007FFF246A0000-memory.dmp
memory/5608-24-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/5608-25-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/5608-26-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/5608-27-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/5608-28-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/5608-29-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/5608-30-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/5608-31-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/5608-32-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/5608-33-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp