Analysis
- max time kernel
164s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
14/07/2026, 10:51
General
- Target d8502c066568eafc5d0a99dc081ce8182563e2d09be7cc4058e3fb2796bbbdc7.exe
- Size 65.7MB
- Sample260714-mx2dhadv7w
- SHA256 d8502c066568eafc5d0a99dc081ce8182563e2d09be7cc4058e3fb2796bbbdc7
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8502c066568eafc5d0a99dc081ce8182563e2d09be7cc4058e3fb2796bbbdc7.exe"C:\Users\Admin\AppData\Local\Temp\d8502c066568eafc5d0a99dc081ce8182563e2d09be7cc4058e3fb2796bbbdc7.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
wpfgfx_cor3.dll
memory/3012-5-0x0000000007790000-0x0000000008580000-memory.dmp
memory/3012-9-0x0000000007790000-0x0000000008580000-memory.dmp
memory/3012-10-0x000000000A640000-0x000000000B4B0000-memory.dmp
memory/3012-14-0x000000000A640000-0x000000000B4B0000-memory.dmp
memory/3012-19-0x0000000009380000-0x0000000009580000-memory.dmp
memory/3012-35-0x000000000C010000-0x000000000C7D0000-memory.dmp
memory/3012-44-0x0000000006970000-0x0000000006990000-memory.dmp
memory/3012-45-0x000000000B5B0000-0x000000000B620000-memory.dmp
memory/3012-74-0x000000000E580000-0x000000000E5D0000-memory.dmp
memory/3012-89-0x000000000B830000-0x000000000B840000-memory.dmp
memory/3012-98-0x000000000E8F0000-0x000000000E9E0000-memory.dmp
memory/3012-108-0x000000000F480000-0x000000000FB90000-memory.dmp
memory/3012-39-0x000000000C010000-0x000000000C7D0000-memory.dmp
memory/3012-143-0x000000000FF90000-0x000000000FFD0000-memory.dmp
memory/3012-163-0x00000000101B0000-0x00000000101C0000-memory.dmp
memory/3012-168-0x00000000105A0000-0x0000000010700000-memory.dmp
memory/3012-164-0x00000000105A0000-0x0000000010700000-memory.dmp
memory/3012-159-0x00000000101B0000-0x00000000101C0000-memory.dmp
memory/3012-158-0x0000000010070000-0x00000000100B0000-memory.dmp
memory/3012-154-0x0000000010070000-0x00000000100B0000-memory.dmp
memory/3012-153-0x0000000010110000-0x0000000010170000-memory.dmp
memory/3012-149-0x0000000010110000-0x0000000010170000-memory.dmp
memory/3012-148-0x000000000FDC0000-0x000000000FDD0000-memory.dmp
memory/3012-144-0x000000000FDC0000-0x000000000FDD0000-memory.dmp
memory/3012-128-0x000000000FEA0000-0x000000000FF50000-memory.dmp
memory/3012-124-0x000000000FEA0000-0x000000000FF50000-memory.dmp
memory/3012-139-0x000000000FF90000-0x000000000FFD0000-memory.dmp
memory/3012-138-0x000000000FD90000-0x000000000FDA0000-memory.dmp
memory/3012-134-0x000000000FD90000-0x000000000FDA0000-memory.dmp
memory/3012-133-0x000000000ED30000-0x000000000ED50000-memory.dmp
memory/3012-129-0x000000000ED30000-0x000000000ED50000-memory.dmp
memory/3012-123-0x000000000ED00000-0x000000000ED20000-memory.dmp
memory/3012-119-0x000000000ED00000-0x000000000ED20000-memory.dmp
memory/3012-118-0x000000000EC00000-0x000000000EC90000-memory.dmp
memory/3012-114-0x000000000EC00000-0x000000000EC90000-memory.dmp
memory/3012-104-0x000000000F480000-0x000000000FB90000-memory.dmp
memory/3012-113-0x000000000EAC0000-0x000000000EAF0000-memory.dmp
memory/3012-109-0x000000000EAC0000-0x000000000EAF0000-memory.dmp
memory/3012-95-0x000000000E8F0000-0x000000000E9E0000-memory.dmp
memory/3012-103-0x000000000E6A0000-0x000000000E6F0000-memory.dmp
memory/3012-99-0x000000000E6A0000-0x000000000E6F0000-memory.dmp
memory/3012-85-0x000000000B830000-0x000000000B840000-memory.dmp
memory/3012-84-0x000000000E620000-0x000000000E650000-memory.dmp
memory/3012-80-0x000000000E620000-0x000000000E650000-memory.dmp
memory/3012-79-0x000000000B7C0000-0x000000000B7E0000-memory.dmp
memory/3012-75-0x000000000B7C0000-0x000000000B7E0000-memory.dmp
memory/3012-70-0x000000000E580000-0x000000000E5D0000-memory.dmp
memory/3012-69-0x000000000B780000-0x000000000B7A0000-memory.dmp
memory/3012-65-0x000000000B780000-0x000000000B7A0000-memory.dmp
memory/3012-64-0x000000000B690000-0x000000000B6B0000-memory.dmp
memory/3012-60-0x000000000B690000-0x000000000B6B0000-memory.dmp
memory/3012-59-0x000000000B640000-0x000000000B660000-memory.dmp
memory/3012-55-0x000000000B640000-0x000000000B660000-memory.dmp
memory/3012-54-0x000000000B620000-0x000000000B630000-memory.dmp
memory/3012-50-0x000000000B620000-0x000000000B630000-memory.dmp
memory/3012-49-0x000000000B5B0000-0x000000000B620000-memory.dmp
memory/3012-40-0x0000000006970000-0x0000000006990000-memory.dmp
memory/3012-24-0x0000000008700000-0x0000000008840000-memory.dmp
memory/3012-20-0x0000000008700000-0x0000000008840000-memory.dmp
memory/3012-34-0x000000000B4B0000-0x000000000B4F0000-memory.dmp
memory/3012-30-0x000000000B4B0000-0x000000000B4F0000-memory.dmp
memory/3012-25-0x0000000009710000-0x0000000009760000-memory.dmp
memory/3012-15-0x0000000009380000-0x0000000009580000-memory.dmp
memory/3012-29-0x0000000009710000-0x0000000009760000-memory.dmp