Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/07/2026, 17:08
General
- Target 401883ee8334db650bbd0363335ee46a35492ef1842261341cd1f737f091678a.exe
- Size 948KB
- Sample260720-vnnp2sg16j
- SHA256 401883ee8334db650bbd0363335ee46a35492ef1842261341cd1f737f091678a
Malware Config
Signatures
- Badlisted process makes network request 11 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\401883ee8334db650bbd0363335ee46a35492ef1842261341cd1f737f091678a.exe"C:\Users\Admin\AppData\Local\Temp\401883ee8334db650bbd0363335ee46a35492ef1842261341cd1f737f091678a.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " $Forjagetheden107=cat -raw 'C:\Users\Admin\AppData\Local\Temp\subcycles\instantiating\Tracelessly\Blodsporene204.Ska';$Radiotelegrafists=$Forjagetheden107.substring(80056,3); .$Radiotelegrafists($Forjagetheden107)"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Blodsporene204.Ska
unrecking.Dek
nedbringelsens.ini
memory/1536-217-0x0000000000400000-0x00000000016E6000-memory.dmp
memory/1732-191-0x00000000071E0000-0x0000000007283000-memory.dmp
memory/1732-196-0x0000000007450000-0x0000000007461000-memory.dmp
memory/1732-171-0x0000000004F80000-0x0000000004FA2000-memory.dmp
memory/1732-173-0x00000000057F0000-0x0000000005856000-memory.dmp
memory/1732-172-0x0000000005780000-0x00000000057E6000-memory.dmp
memory/1732-176-0x0000000005970000-0x0000000005CCB000-memory.dmp
memory/1732-177-0x0000000005D30000-0x0000000005D4E000-memory.dmp
memory/1732-178-0x0000000005D80000-0x0000000005DCC000-memory.dmp
memory/1732-179-0x0000000007010000-0x00000000070A6000-memory.dmp
memory/1732-180-0x0000000006270000-0x000000000628A000-memory.dmp
memory/1732-181-0x00000000062D0000-0x00000000062F2000-memory.dmp
memory/1732-182-0x0000000007670000-0x0000000007C2A000-memory.dmp
memory/1732-170-0x0000000073AE0000-0x000000007429C000-memory.dmp
memory/1732-184-0x00000000082B0000-0x000000000892C000-memory.dmp
memory/1732-186-0x0000000007170000-0x00000000071A6000-memory.dmp
memory/1732-185-0x0000000073AE0000-0x000000007429C000-memory.dmp
memory/1732-187-0x0000000070500000-0x000000007054C000-memory.dmp
memory/1732-195-0x00000000072E0000-0x00000000072EA000-memory.dmp
memory/1732-169-0x0000000005130000-0x000000000577A000-memory.dmp
memory/1732-192-0x0000000073AE0000-0x000000007429C000-memory.dmp
memory/1732-168-0x0000000073AE0000-0x000000007429C000-memory.dmp
memory/1732-194-0x0000000073AE0000-0x000000007429C000-memory.dmp
memory/1732-190-0x00000000071B0000-0x00000000071D0000-memory.dmp
memory/1732-197-0x0000000007470000-0x0000000007480000-memory.dmp
memory/1732-198-0x00000000074A0000-0x00000000074B5000-memory.dmp
memory/1732-199-0x00000000074E0000-0x00000000074FC000-memory.dmp
memory/1732-200-0x00000000074D0000-0x00000000074D8000-memory.dmp
memory/1732-202-0x0000000007520000-0x0000000007544000-memory.dmp
memory/1732-201-0x00000000074E0000-0x000000000750A000-memory.dmp
memory/1732-203-0x0000000073AF2000-0x0000000073AF3000-memory.dmp
memory/1732-204-0x0000000073AE0000-0x000000007429C000-memory.dmp
memory/1732-205-0x0000000073AE0000-0x000000007429C000-memory.dmp
memory/1732-206-0x0000000073AE0000-0x000000007429C000-memory.dmp
memory/1732-167-0x00000000024E0000-0x0000000002516000-memory.dmp
memory/1732-208-0x0000000073AE0000-0x000000007429C000-memory.dmp
memory/1732-210-0x0000000073AE0000-0x000000007429C000-memory.dmp
memory/1732-209-0x0000000008930000-0x0000000009C0A000-memory.dmp
memory/1732-211-0x0000000073AE0000-0x000000007429C000-memory.dmp
memory/1732-212-0x0000000073AE0000-0x000000007429C000-memory.dmp
memory/1732-213-0x0000000073AE0000-0x000000007429C000-memory.dmp
memory/1732-215-0x0000000073AE0000-0x000000007429C000-memory.dmp
memory/1732-216-0x0000000073AE0000-0x000000007429C000-memory.dmp
memory/1732-166-0x0000000073AF2000-0x0000000073AF3000-memory.dmp