Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
23/07/2026, 00:56
General
- Target ByrdOpti.exe
- Size 246KB
- Sample260723-bas8tsbq81
- SHA256 78909b642cb67f5e6082f5c1236dfe211099c520aa1058883f6a389e8b85d6fa
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ByrdOpti.exe"C:\Users\Admin\AppData\Local\Temp\ByrdOpti.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jehxbtzd\jehxbtzd.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAFDE.tmp" "c:\Users\Admin\AppData\Local\Temp\jehxbtzd\CSC5FDEC5C1714C49749218AF6D641DA73E.TMP"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
RESAFDE.tmp
jehxbtzd.dll
CSC5FDEC5C1714C49749218AF6D641DA73E.TMP
jehxbtzd.0.cs
jehxbtzd.cmdline
memory/1052-23-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/1052-1-0x0000000000BC0000-0x0000000000C02000-memory.dmp
memory/1052-9-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/1052-10-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/1052-11-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/1052-12-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/1052-13-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/1052-14-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/1052-15-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/1052-16-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/1052-17-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/1052-7-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/1052-6-0x0000000002E30000-0x0000000002E52000-memory.dmp
memory/1052-0-0x00007FFD1E61F000-0x00007FFD1E620000-memory.dmp
memory/1052-5-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/1052-4-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/1052-31-0x000000001D180000-0x000000001D188000-memory.dmp
memory/1052-8-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/1052-34-0x000000001D590000-0x000000001D5AE000-memory.dmp
memory/1052-36-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/1052-35-0x000000001D5B0000-0x000000001D662000-memory.dmp
memory/1052-37-0x000000001D670000-0x000000001D67A000-memory.dmp
memory/1052-39-0x000000001D6B0000-0x000000001D6D4000-memory.dmp
memory/1052-38-0x000000001D6B0000-0x000000001D6DA000-memory.dmp
memory/1052-40-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/1052-41-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/1052-42-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/1052-43-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/1052-44-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/1052-45-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/1052-46-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/1052-47-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/1052-48-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/1052-50-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp