Analysis
- user interaction
yes - max time kernel
37s - max time network
67s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
14/07/2026, 12:20
Errors
General
- Target ALrH2bBByHH.rar
- Size 3.8MB
- Sample260714-ph8kdaev8s
- SHA256 a8cfeb1cb3cf0278093fb09d79453c77d8ffd51617a638e7b52f4271bb66d388
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Program crash 1 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\ALrH2bBByHH.rar"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zO4F434799\Virus NahSmi.exe"C:\Users\Admin\AppData\Local\Temp\7zO4F434799\Virus NahSmi.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Naيببشمي.exe"C:\Users\Admin\AppData\Roaming\Naيببشمي.exe"3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k reg delete HKCR /f4⤵
-
C:\Windows\system32\reg.exereg delete HKCR /f5⤵
-
-
-
-
C:\Users\Admin\AppData\Roaming\Viurs ByDRX1 ALHB Group.exe"C:\Users\Admin\AppData\Roaming\Viurs ByDRX1 ALHB Group.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Viurs DRX1.exe"C:\Users\Admin\AppData\Local\Temp\Viurs DRX1.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Virus.exe"C:\Users\Admin\AppData\Roaming\Virus.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Virus REvi DRX1.exe"C:\Users\Admin\AppData\Local\Temp\Virus REvi DRX1.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\Virus REvi DRX1.exe"C:\Users\Admin\AppData\Local\Temp\Virus REvi DRX1.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 13446⤵
- Program crash
-
-
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x000000000000050C 0x00000000000005141⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1564 -ip 15641⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
Virus NahSmi.exe
sByte.dll
Virus REvi DRX1.exe
Viurs DRX1.exe
Naيببشمي.exe
Virus.exe
Viurs ByDRX1 ALHB Group.exe
memory/1564-70-0x0000000000400000-0x0000000000430000-memory.dmp
memory/1564-74-0x00000000052B0000-0x00000000052BA000-memory.dmp
memory/1564-73-0x00000000051F0000-0x0000000005282000-memory.dmp
memory/1564-72-0x00000000056C0000-0x0000000005C7A000-memory.dmp
memory/2840-69-0x0000000000100000-0x00000000001A2000-memory.dmp
memory/4608-30-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp
memory/4608-39-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp
memory/4608-13-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp
memory/4608-49-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp
memory/4608-12-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp
memory/4608-52-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp
memory/4608-10-0x0000000000670000-0x00000000007C6000-memory.dmp
memory/4608-9-0x00007FFAFD4FF000-0x00007FFAFD500000-memory.dmp
memory/4944-56-0x000000001AF00000-0x000000001AFA2000-memory.dmp
memory/4944-51-0x0000000000B30000-0x0000000000B3C000-memory.dmp
memory/4944-50-0x00000000001A0000-0x000000000028C000-memory.dmp
memory/4964-40-0x0000000000C70000-0x0000000000CB6000-memory.dmp
memory/5220-60-0x00000000007D0000-0x00000000007DA000-memory.dmp
memory/5716-26-0x0000000000870000-0x000000000087A000-memory.dmp