fbc729be008c9c22de637f871877dce5366583a3206d5e484807184f11e38285

Analysis

user interaction
yes
max time kernel
8s
max time network
9s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 23:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MonoMod.exe
Size 65KB
Sample260722-3gnepsde49
SHA256 fbc729be008c9c22de637f871877dce5366583a3206d5e484807184f11e38285
MD5 fdd1a08c31e1a84c5474d8af2e5f711d
SHA1 a6cb1c7c89a65dd2da45c0e19bd7110c0e978001
SHA512 c991f217d0227e79e74c42cd33b6fe7b5c539f212f53fc836eeb965bc56031b0519207914590bc7ba00c2cf1c7fab15cafdd6a269fa083229a1af59650ca81a7
SSDEEP 768:qqx4QzKHMo3fSmi5uPnG1cnilIcXxdPdXmqynJ8G1cvPnZHv:dW652nilIchdlmJJ8Hvhv
TLSH
T12063190072F88748D97F1BB4B874254906B2AA06DA67D74C1C84B8EE5D533C79B82BF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeBackupPrivilege	2916	dw20.exe
Token: SeBackupPrivilege	2916	dw20.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2916	2552	MonoMod.exe	89

C:\Users\Admin\AppData\Local\Temp\MonoMod.exe
"C:\Users\Admin\AppData\Local\Temp\MonoMod.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 776
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:2916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2552-0-0x00007FFE0CD85000-0x00007FFE0CD86000-memory.dmp

Download

memory/2552-1-0x00007FFE0CAD0000-0x00007FFE0D471000-memory.dmp

Download

memory/2552-2-0x00007FFE0CAD0000-0x00007FFE0D471000-memory.dmp

Download

memory/2552-7-0x00007FFE0CAD0000-0x00007FFE0D471000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads