Analysis
- user interaction
yes - max time kernel
149s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
13/07/2026, 17:13
General
- Target build2.exe
- Size 2.0MB
- Sample260713-vrfhvaev41
- SHA256 fce05da105a7f3478fc43633196ebfebe27f6cfd117e93e02d84e06f56482a38
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\build2.exe"C:\Users\Admin\AppData\Local\Temp\build2.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dotnet_5540.exeC:\Users\Admin\AppData\Local\Temp\dotnet_5540.exe2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\6vmjrx.exe"C:\Windows\System32\6vmjrx.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
dotnet_5540.exe
memory/708-5-0x0000000074FF2000-0x0000000074FF3000-memory.dmp
memory/708-6-0x0000000000790000-0x00000000007FE000-memory.dmp
memory/708-7-0x0000000074FE0000-0x000000007579C000-memory.dmp
memory/708-8-0x0000000002D40000-0x0000000002D5A000-memory.dmp
memory/708-9-0x0000000002EA0000-0x0000000002ECC000-memory.dmp
memory/708-15-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-41-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-61-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-133-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-131-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-129-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-127-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-125-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-123-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-121-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-119-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-117-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-115-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-111-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-109-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-107-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-105-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-103-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-101-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-99-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-97-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-95-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-91-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-89-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-87-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-85-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-83-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-81-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-79-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-77-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-75-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-73-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-71-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-67-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-65-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-63-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-59-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-57-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-55-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-53-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-51-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-49-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-47-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-45-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-43-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-39-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-37-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-35-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-33-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-31-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-29-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-25-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-23-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-21-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-137-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-113-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-93-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-17-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-69-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-13-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-27-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-11-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-19-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-10-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
memory/708-638-0x0000000005610000-0x0000000005676000-memory.dmp
memory/708-639-0x0000000006470000-0x0000000006502000-memory.dmp
memory/708-640-0x0000000006AD0000-0x000000000708A000-memory.dmp
memory/708-641-0x0000000074FF2000-0x0000000074FF3000-memory.dmp
memory/708-642-0x0000000074FE0000-0x000000007579C000-memory.dmp