Resubmissions
10/08/2026, 07:48
260810-jm4jbsyth1710/08/2026, 07:47
260810-jmz6xatflc724/07/2026, 22:22
260724-2amn6agk9x8Analysis
- max time kernel
902s - max time network
477s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/07/2026, 22:22
General
- Target 2/support/keyfiles/CustomHook/win/Cinema 4D Installer.exe
- Size 487.8MB
- Sample260724-2amn6agk9x
- SHA256 b79371b525bb9633b8c0f930746b9f8d916190eeb9d1fe93ce37b79dbedbc313
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 15 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 29 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2\support\keyfiles\CustomHook\win\Cinema 4D Installer.exe"C:\Users\Admin\AppData\Local\Temp\2\support\keyfiles\CustomHook\win\Cinema 4D Installer.exe"1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AVXDET~1.EXE"C:\Users\Admin\AppData\Local\Temp\AVXDET~1.EXE"2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
BR2A2E.tmp
BR2A8D.tmp
BR2AFB.tmp
BR2B2B.tmp
BR2B4B.tmp
BR2B7B.tmp
BR2B8C.tmp
BR2C58.tmp
BR2E5D.tmp
BR2E7D.tmp
BR2EAD.tmp
BR2F1B.tmp
BR2F3B.tmp
BR2F4C.tmp
BR2F5D.tmp
avxdetectionwindows.exe
memory/2544-87-0x000000006D660000-0x000000006D686000-memory.dmp
memory/2544-90-0x000000006D580000-0x000000006D658000-memory.dmp
memory/2544-99-0x000000006D4D0000-0x000000006D50E000-memory.dmp
memory/2544-98-0x000000006D510000-0x000000006D523000-memory.dmp
memory/2544-97-0x000000006D530000-0x000000006D540000-memory.dmp
memory/2544-96-0x000000006D540000-0x000000006D572000-memory.dmp
memory/2544-95-0x0000000066C00000-0x0000000066C1B000-memory.dmp
memory/2544-94-0x0000000067380000-0x0000000067391000-memory.dmp
memory/2544-93-0x000000006CA00000-0x000000006CA0E000-memory.dmp
memory/2544-92-0x0000000070140000-0x000000007014F000-memory.dmp
memory/2544-91-0x000000006C580000-0x000000006C599000-memory.dmp
memory/2544-89-0x00000000710C0000-0x00000000710F4000-memory.dmp
memory/2544-88-0x0000000066680000-0x0000000066695000-memory.dmp
memory/2544-86-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-100-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-114-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-128-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-142-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-156-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-170-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-184-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-198-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-212-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-226-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-240-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-254-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-268-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-282-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-296-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-310-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-324-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-338-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-352-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-366-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-380-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-394-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-408-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-422-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-436-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-450-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-464-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-478-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-492-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-506-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-520-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-536-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-550-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-564-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-578-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-592-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-606-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-620-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-634-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-648-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-662-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-676-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-690-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-704-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-718-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-732-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-746-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-760-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-774-0x0000000000C80000-0x0000000000F62000-memory.dmp
memory/2544-788-0x0000000000C80000-0x0000000000F62000-memory.dmp