Analysis
- max time kernel
148s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
19/07/2026, 17:32
General
- Target s.exe
- Size 45.1MB
- Sample260719-v4mspaav21
- SHA256 67c86a34fef4fdfd28bd5b88cbfabb3b10137b7acf7992675900af6642a5cdbe
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\s.exe"C:\Users\Admin\AppData\Local\Temp\s.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Monero GUI Wallet\monero-wallet-gui.exe"C:\Program Files\Monero GUI Wallet\monero-wallet-gui.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2092-37-0x0000000000400000-0x0000000000457000-memory.dmp
memory/3764-51-0x000000000B300000-0x000000000B301000-memory.dmp
memory/3764-63-0x00000000070D0000-0x00000000070D1000-memory.dmp
memory/3764-31-0x0000000004DB0000-0x0000000004DB1000-memory.dmp
memory/3764-30-0x0000000004DB0000-0x0000000004DB1000-memory.dmp
memory/3764-29-0x0000000004DB0000-0x0000000004DB1000-memory.dmp
memory/3764-28-0x0000000004DB0000-0x0000000004DB1000-memory.dmp
memory/3764-27-0x0000000004DB0000-0x0000000004DB1000-memory.dmp
memory/3764-26-0x0000000004DB0000-0x0000000004DB1000-memory.dmp
memory/3764-25-0x0000000004DB0000-0x0000000004DB1000-memory.dmp
memory/3764-24-0x0000000004DB0000-0x0000000004DB1000-memory.dmp
memory/3764-36-0x00000000070D0000-0x00000000070D1000-memory.dmp
memory/3764-35-0x00000000070D0000-0x00000000070D1000-memory.dmp
memory/3764-38-0x00000000070D0000-0x00000000070D1000-memory.dmp
memory/3764-42-0x000000000B300000-0x000000000B301000-memory.dmp
memory/3764-40-0x0000000007060000-0x0000000007061000-memory.dmp
memory/3764-62-0x000000000C520000-0x000000000C521000-memory.dmp
memory/3764-20-0x0000000007940000-0x0000000007D82000-memory.dmp
memory/3764-43-0x000000000B300000-0x000000000B301000-memory.dmp
memory/3764-44-0x00000000070D0000-0x00000000070D1000-memory.dmp
memory/3764-48-0x00000000070D0000-0x00000000070D1000-memory.dmp
memory/3764-47-0x00000000070D0000-0x00000000070D1000-memory.dmp
memory/3764-46-0x00000000070D0000-0x00000000070D1000-memory.dmp
memory/3764-45-0x00000000070D0000-0x00000000070D1000-memory.dmp
memory/3764-50-0x000000000C520000-0x000000000C521000-memory.dmp
memory/3764-60-0x000000000C780000-0x000000000C781000-memory.dmp
memory/3764-59-0x000000000C780000-0x000000000C781000-memory.dmp
memory/3764-58-0x000000000C7C0000-0x000000000C7C3000-memory.dmp
memory/3764-57-0x000000000C7C0000-0x000000000C7C3000-memory.dmp
memory/3764-56-0x000000000C7B0000-0x000000000C7B1000-memory.dmp
memory/3764-54-0x000000000C780000-0x000000000C781000-memory.dmp
memory/3764-33-0x0000000007060000-0x0000000007061000-memory.dmp
memory/3764-53-0x000000000C780000-0x000000000C781000-memory.dmp
memory/3764-39-0x00000000070D0000-0x00000000070D1000-memory.dmp
memory/3764-61-0x000000000C520000-0x000000000C521000-memory.dmp
memory/3764-22-0x0000000007D90000-0x0000000007F92000-memory.dmp
memory/3764-64-0x000000000C520000-0x000000000C521000-memory.dmp
memory/3764-66-0x000000000DE30000-0x000000000DE31000-memory.dmp
memory/3764-68-0x000000000DEE0000-0x000000000DEE1000-memory.dmp
memory/3764-69-0x000000000DEE0000-0x000000000DEE1000-memory.dmp
memory/3764-71-0x000000000DEE0000-0x000000000DEE1000-memory.dmp
memory/3764-72-0x000000000DEE0000-0x000000000DEE1000-memory.dmp
memory/3764-70-0x000000000DEE0000-0x000000000DEE1000-memory.dmp
memory/3764-73-0x0000000007060000-0x0000000007061000-memory.dmp
memory/3764-75-0x000000000C7C0000-0x000000000C7C3000-memory.dmp
memory/3764-76-0x0000000007060000-0x0000000007061000-memory.dmp
memory/3764-74-0x000000000DE30000-0x000000000DE31000-memory.dmp
memory/3764-78-0x000000000C7C0000-0x000000000C7C3000-memory.dmp
memory/3764-77-0x000000000C7C0000-0x000000000C7C3000-memory.dmp
memory/3764-79-0x000000000C7C0000-0x000000000C7C3000-memory.dmp
memory/3764-94-0x00000000110A0000-0x00000000110A1000-memory.dmp
memory/3764-93-0x000000000B300000-0x000000000B301000-memory.dmp
memory/3764-92-0x00000000110A0000-0x00000000110A1000-memory.dmp
memory/3764-90-0x000000000C780000-0x000000000C781000-memory.dmp
memory/3764-89-0x000000000C7C0000-0x000000000C7C3000-memory.dmp
memory/3764-88-0x000000000C7B0000-0x000000000C7B1000-memory.dmp
memory/3764-87-0x000000000C7B0000-0x000000000C7B1000-memory.dmp
memory/3764-86-0x000000000C7B0000-0x000000000C7B1000-memory.dmp
memory/3764-85-0x000000000C7B0000-0x000000000C7B1000-memory.dmp
memory/3764-84-0x000000000C7B0000-0x000000000C7B1000-memory.dmp
memory/3764-83-0x000000000C7B0000-0x000000000C7B1000-memory.dmp
memory/3764-82-0x000000000C7B0000-0x000000000C7B1000-memory.dmp
memory/3764-81-0x000000000C7B0000-0x000000000C7B1000-memory.dmp
memory/3764-80-0x000000000C7C0000-0x000000000C7C3000-memory.dmp