Analysis
- max time kernel
151s - max time network
17s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
19/07/2026, 22:25
General
- Target ToX Free Utility NEW ERA.exe
- Size 37.7MB
- Sample260719-2b1bmsgz2t
- SHA256 5804e4661f3a752725a60a90cdb2b92d18db03a957167940ff4d9c85e558bb20
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ToX Free Utility NEW ERA.exe"C:\Users\Admin\AppData\Local\Temp\ToX Free Utility NEW ERA.exe"1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2868-0-0x00000000743B2000-0x00000000743B3000-memory.dmp
memory/2868-1-0x0000000000B70000-0x000000000312E000-memory.dmp
memory/2868-2-0x00000000081A0000-0x000000000875A000-memory.dmp
memory/2868-3-0x0000000007BE0000-0x0000000007C72000-memory.dmp
memory/2868-4-0x0000000007B50000-0x0000000007BB6000-memory.dmp
memory/2868-5-0x00000000743A0000-0x0000000074B5C000-memory.dmp
memory/2868-6-0x0000000007C90000-0x0000000007C9A000-memory.dmp
memory/2868-7-0x000000000BAC0000-0x000000000BB82000-memory.dmp
memory/2868-8-0x000000000BAB0000-0x000000000BABA000-memory.dmp
memory/2868-9-0x000000000BB90000-0x000000000BBB8000-memory.dmp
memory/2868-10-0x00000000743B2000-0x00000000743B3000-memory.dmp
memory/2868-11-0x00000000743A0000-0x0000000074B5C000-memory.dmp
memory/2868-12-0x00000000743A0000-0x0000000074B5C000-memory.dmp
memory/2868-13-0x00000000743A0000-0x0000000074B5C000-memory.dmp
memory/2868-14-0x00000000743A0000-0x0000000074B5C000-memory.dmp
memory/2868-15-0x00000000743A0000-0x0000000074B5C000-memory.dmp
memory/2868-16-0x00000000743A0000-0x0000000074B5C000-memory.dmp
memory/2868-17-0x00000000743A0000-0x0000000074B5C000-memory.dmp
memory/2868-18-0x00000000743A0000-0x0000000074B5C000-memory.dmp
memory/2868-19-0x00000000743A0000-0x0000000074B5C000-memory.dmp
memory/2868-20-0x00000000743A0000-0x0000000074B5C000-memory.dmp
memory/2868-21-0x00000000743A0000-0x0000000074B5C000-memory.dmp