Resubmissions
10/08/2026, 07:48
260810-jm4jbsyth1710/08/2026, 07:47
260810-jmz6xatflc724/07/2026, 22:22
260724-2amn6agk9x8Analysis
- max time kernel
899s - max time network
488s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
24/07/2026, 22:22
General
- Target 2/support/keyfiles/CustomHook/win/Cinema 4D Installer.exe
- Size 487.8MB
- Sample260724-2amn6agk9x
- SHA256 b79371b525bb9633b8c0f930746b9f8d916190eeb9d1fe93ce37b79dbedbc313
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 15 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 29 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2\support\keyfiles\CustomHook\win\Cinema 4D Installer.exe"C:\Users\Admin\AppData\Local\Temp\2\support\keyfiles\CustomHook\win\Cinema 4D Installer.exe"1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AVXDET~1.EXE"C:\Users\Admin\AppData\Local\Temp\AVXDET~1.EXE"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
BR7990.tmp
BR7A0E.tmp
BR7A8C.tmp
BR7AAC.tmp
BR7ACD.tmp
BR7AED.tmp
BR7AFD.tmp
BR7BBA.tmp
BR7DCE.tmp
BR7DDF.tmp
BR7DE0.tmp
BR7E4E.tmp
BR7E4F.tmp
BR7E60.tmp
BR7E70.tmp
avxdetectionwindows.exe
memory/3252-86-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-95-0x0000000066C00000-0x0000000066C1B000-memory.dmp
memory/3252-99-0x000000005CBB0000-0x000000005CBEE000-memory.dmp
memory/3252-98-0x000000005CBF0000-0x000000005CC03000-memory.dmp
memory/3252-97-0x000000005CC10000-0x000000005CC20000-memory.dmp
memory/3252-96-0x000000005CC20000-0x000000005CC52000-memory.dmp
memory/3252-94-0x0000000067380000-0x0000000067391000-memory.dmp
memory/3252-93-0x000000006CA00000-0x000000006CA0E000-memory.dmp
memory/3252-92-0x0000000070140000-0x000000007014F000-memory.dmp
memory/3252-91-0x000000006C580000-0x000000006C599000-memory.dmp
memory/3252-90-0x000000005CC60000-0x000000005CD38000-memory.dmp
memory/3252-89-0x00000000710C0000-0x00000000710F4000-memory.dmp
memory/3252-88-0x0000000066680000-0x0000000066695000-memory.dmp
memory/3252-87-0x000000005CD40000-0x000000005CD66000-memory.dmp
memory/3252-100-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-114-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-128-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-142-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-156-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-170-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-184-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-198-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-212-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-226-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-240-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-254-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-268-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-282-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-296-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-310-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-324-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-338-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-352-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-366-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-380-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-394-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-408-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-422-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-436-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-450-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-464-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-478-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-492-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-506-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-520-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-534-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-548-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-562-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-576-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-590-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-604-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-618-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-632-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-646-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-660-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-674-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-688-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-702-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-716-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-730-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-744-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-758-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-772-0x0000000000E70000-0x0000000001152000-memory.dmp
memory/3252-786-0x0000000000E70000-0x0000000001152000-memory.dmp