Analysis
- max time kernel
149s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/07/2026, 13:33
General
- Target 26474738933741ab33657e3b9fbe17970a2634433de5943a219e3edc2f0c4585.exe
- Size 12.4MB
- Sample260720-qtkhcsdz4v
- SHA256 26474738933741ab33657e3b9fbe17970a2634433de5943a219e3edc2f0c4585
Malware Config
Signatures
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\26474738933741ab33657e3b9fbe17970a2634433de5943a219e3edc2f0c4585.exe"C:\Users\Admin\AppData\Local\Temp\26474738933741ab33657e3b9fbe17970a2634433de5943a219e3edc2f0c4585.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 17762⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3576 -ip 35761⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3576-0-0x0000000000551000-0x0000000000C33000-memory.dmp
memory/3576-3-0x0000000003880000-0x0000000003881000-memory.dmp
memory/3576-4-0x00000000038D0000-0x00000000038D1000-memory.dmp
memory/3576-2-0x0000000003870000-0x0000000003871000-memory.dmp
memory/3576-1-0x0000000003750000-0x0000000003751000-memory.dmp
memory/3576-8-0x0000000003910000-0x0000000003911000-memory.dmp
memory/3576-7-0x0000000003900000-0x0000000003901000-memory.dmp
memory/3576-12-0x0000000000400000-0x0000000001895000-memory.dmp
memory/3576-10-0x0000000000400000-0x0000000001895000-memory.dmp
memory/3576-6-0x00000000038F0000-0x00000000038F1000-memory.dmp
memory/3576-5-0x00000000038E0000-0x00000000038E1000-memory.dmp
memory/3576-13-0x0000000000400000-0x0000000001895000-memory.dmp
memory/3576-14-0x0000000010000000-0x0000000010041000-memory.dmp
memory/3576-18-0x0000000004C90000-0x0000000004CD1000-memory.dmp
memory/3576-23-0x0000000000551000-0x0000000000C33000-memory.dmp
memory/3576-24-0x0000000000400000-0x0000000001895000-memory.dmp