Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
24/07/2026, 09:21
General
- Target 登录成功后点击首页不知道为什么会退出.MP4.exe
- Size 3.3MB
- Sample260724-lbtabswtgt
- SHA256 40035c20a806cafa02a373da58b7f2cc13ff9d71d546258c879a487fa28091d4
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\登录成功后点击首页不知道为什么会退出.MP4.exe"C:\Users\Admin\AppData\Local\Temp\登录成功后点击首页不知道为什么会退出.MP4.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn Adobe_Update /tr C:\ProgramData\USOShared\FWConst.exe /sc minute /mo 100 /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeschtasks /run /tn Adobe_Update2⤵
-
-
C:\ProgramData\USOShared\FWConst.exeC:\ProgramData\USOShared\FWConst.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
FWConst.dll
FWConst.exe
FWConst.tlb
memory/1524-7-0x0000022DFBEE0000-0x0000022DFBF2C000-memory.dmp
memory/1524-8-0x0000022DFBF30000-0x0000022DFBF88000-memory.dmp
memory/1524-9-0x0000022DFC010000-0x0000022DFC012000-memory.dmp
memory/1524-11-0x0000022DFBEE0000-0x0000022DFBF2C000-memory.dmp
memory/3288-10-0x00007FFF37F80000-0x00007FFF37FC0000-memory.dmp
memory/3288-17-0x0000022392CC0000-0x0000022392D18000-memory.dmp
memory/3288-16-0x00000223911F0000-0x000002239123C000-memory.dmp
memory/3288-18-0x00000223912A0000-0x00000223912A2000-memory.dmp