Analysis
- max time kernel
150s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
19/07/2026, 17:32
General
- Target s.exe
- Size 45.1MB
- Sample260719-v4mspaav21
- SHA256 67c86a34fef4fdfd28bd5b88cbfabb3b10137b7acf7992675900af6642a5cdbe
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\s.exe"C:\Users\Admin\AppData\Local\Temp\s.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Monero GUI Wallet\monero-wallet-gui.exe"C:\Program Files\Monero GUI Wallet\monero-wallet-gui.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1352-22-0x0000000007950000-0x0000000007D92000-memory.dmp
memory/1352-24-0x0000000007DA0000-0x0000000007FA2000-memory.dmp
memory/1352-27-0x0000000006500000-0x0000000006501000-memory.dmp
memory/1352-28-0x0000000006500000-0x0000000006501000-memory.dmp
memory/1352-26-0x0000000006500000-0x0000000006501000-memory.dmp
memory/1352-35-0x0000000006590000-0x0000000006591000-memory.dmp
memory/1352-33-0x0000000006500000-0x0000000006501000-memory.dmp
memory/1352-31-0x0000000006500000-0x0000000006501000-memory.dmp
memory/1352-29-0x0000000006500000-0x0000000006501000-memory.dmp
memory/1352-32-0x0000000006500000-0x0000000006501000-memory.dmp
memory/1352-30-0x0000000006500000-0x0000000006501000-memory.dmp
memory/1352-39-0x0000000009C80000-0x0000000009C81000-memory.dmp
memory/1352-38-0x0000000009C80000-0x0000000009C81000-memory.dmp
memory/1352-37-0x0000000009C80000-0x0000000009C81000-memory.dmp
memory/1352-51-0x000000000C5E0000-0x000000000C5E1000-memory.dmp
memory/1352-45-0x0000000009C80000-0x0000000009C81000-memory.dmp
memory/1352-44-0x000000000B3C0000-0x000000000B3C1000-memory.dmp
memory/1352-43-0x000000000B3C0000-0x000000000B3C1000-memory.dmp
memory/1352-41-0x0000000006590000-0x0000000006591000-memory.dmp
memory/1352-40-0x0000000009C80000-0x0000000009C81000-memory.dmp
memory/1352-60-0x000000000C840000-0x000000000C841000-memory.dmp
memory/1352-57-0x000000000C870000-0x000000000C871000-memory.dmp
memory/1352-49-0x0000000009C80000-0x0000000009C81000-memory.dmp
memory/1352-61-0x000000000C840000-0x000000000C841000-memory.dmp
memory/1352-59-0x000000000C880000-0x000000000C883000-memory.dmp
memory/1352-58-0x000000000C880000-0x000000000C883000-memory.dmp
memory/1352-55-0x000000000C840000-0x000000000C841000-memory.dmp
memory/1352-54-0x000000000C840000-0x000000000C841000-memory.dmp
memory/1352-52-0x000000000B3C0000-0x000000000B3C1000-memory.dmp
memory/1352-48-0x0000000009C80000-0x0000000009C81000-memory.dmp
memory/1352-47-0x0000000009C80000-0x0000000009C81000-memory.dmp
memory/1352-46-0x0000000009C80000-0x0000000009C81000-memory.dmp
memory/1352-63-0x000000000C5E0000-0x000000000C5E1000-memory.dmp
memory/1352-64-0x0000000009C80000-0x0000000009C81000-memory.dmp
memory/1352-62-0x000000000C5E0000-0x000000000C5E1000-memory.dmp
memory/1352-67-0x000000000DEF0000-0x000000000DEF1000-memory.dmp
memory/1352-65-0x000000000C5E0000-0x000000000C5E1000-memory.dmp
memory/1352-69-0x000000000DFA0000-0x000000000DFA1000-memory.dmp
memory/1352-70-0x000000000DFA0000-0x000000000DFA1000-memory.dmp
memory/1352-71-0x000000000DFA0000-0x000000000DFA1000-memory.dmp
memory/1352-73-0x000000000DFA0000-0x000000000DFA1000-memory.dmp
memory/1352-72-0x000000000DFA0000-0x000000000DFA1000-memory.dmp
memory/1352-74-0x0000000006590000-0x0000000006591000-memory.dmp
memory/1352-75-0x000000000DEF0000-0x000000000DEF1000-memory.dmp
memory/1352-76-0x000000000C880000-0x000000000C883000-memory.dmp
memory/1352-77-0x0000000006590000-0x0000000006591000-memory.dmp
memory/1352-83-0x000000000C870000-0x000000000C871000-memory.dmp
memory/1352-82-0x000000000C870000-0x000000000C871000-memory.dmp
memory/1352-78-0x000000000C880000-0x000000000C883000-memory.dmp
memory/1352-84-0x000000000C870000-0x000000000C871000-memory.dmp
memory/1352-95-0x0000000011160000-0x0000000011161000-memory.dmp
memory/1352-94-0x000000000B3C0000-0x000000000B3C1000-memory.dmp
memory/1352-93-0x0000000011160000-0x0000000011161000-memory.dmp
memory/1352-91-0x000000000C840000-0x000000000C841000-memory.dmp
memory/1352-90-0x000000000C880000-0x000000000C883000-memory.dmp
memory/1352-89-0x000000000C870000-0x000000000C871000-memory.dmp
memory/1352-88-0x000000000C870000-0x000000000C871000-memory.dmp
memory/1352-81-0x000000000C880000-0x000000000C883000-memory.dmp
memory/1352-80-0x000000000C880000-0x000000000C883000-memory.dmp
memory/1352-79-0x000000000C880000-0x000000000C883000-memory.dmp
memory/1352-87-0x000000000C870000-0x000000000C871000-memory.dmp
memory/1352-86-0x000000000C870000-0x000000000C871000-memory.dmp
memory/1352-85-0x000000000C870000-0x000000000C871000-memory.dmp
memory/3212-18-0x0000000000400000-0x0000000000457000-memory.dmp