Analysis
- max time kernel
150s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/07/2026, 12:23
General
- Target s.exe
- Size 45.1MB
- Sample260724-pkg57sgb32
- SHA256 67c86a34fef4fdfd28bd5b88cbfabb3b10137b7acf7992675900af6642a5cdbe
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\s.exe"C:\Users\Admin\AppData\Local\Temp\s.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Monero GUI Wallet\monero-wallet-gui.exe"C:\Program Files\Monero GUI Wallet\monero-wallet-gui.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2392-23-0x0000000007C20000-0x0000000008062000-memory.dmp
memory/2392-24-0x0000000008070000-0x0000000008272000-memory.dmp
memory/2392-26-0x0000000004F90000-0x0000000004F91000-memory.dmp
memory/2392-30-0x0000000004F90000-0x0000000004F91000-memory.dmp
memory/2392-29-0x0000000004F90000-0x0000000004F91000-memory.dmp
memory/2392-28-0x0000000004F90000-0x0000000004F91000-memory.dmp
memory/2392-27-0x0000000004F90000-0x0000000004F91000-memory.dmp
memory/2392-31-0x0000000004F90000-0x0000000004F91000-memory.dmp
memory/2392-33-0x0000000004F90000-0x0000000004F91000-memory.dmp
memory/2392-32-0x0000000004F90000-0x0000000004F91000-memory.dmp
memory/2392-38-0x0000000006900000-0x0000000006901000-memory.dmp
memory/2392-37-0x0000000006900000-0x0000000006901000-memory.dmp
memory/2392-35-0x0000000004FD0000-0x0000000004FD1000-memory.dmp
memory/2392-39-0x0000000006900000-0x0000000006901000-memory.dmp
memory/2392-40-0x0000000006900000-0x0000000006901000-memory.dmp
memory/2392-41-0x0000000004FD0000-0x0000000004FD1000-memory.dmp
memory/2392-43-0x000000000B3B0000-0x000000000B3B1000-memory.dmp
memory/2392-44-0x000000000B3B0000-0x000000000B3B1000-memory.dmp
memory/2392-45-0x0000000006900000-0x0000000006901000-memory.dmp
memory/2392-58-0x000000000C870000-0x000000000C873000-memory.dmp
memory/2392-54-0x000000000C830000-0x000000000C831000-memory.dmp
memory/2392-52-0x000000000B3B0000-0x000000000B3B1000-memory.dmp
memory/2392-46-0x0000000006900000-0x0000000006901000-memory.dmp
memory/2392-63-0x000000000C5D0000-0x000000000C5D1000-memory.dmp
memory/2392-61-0x000000000C830000-0x000000000C831000-memory.dmp
memory/2392-60-0x000000000C830000-0x000000000C831000-memory.dmp
memory/2392-59-0x000000000C870000-0x000000000C873000-memory.dmp
memory/2392-57-0x000000000C860000-0x000000000C861000-memory.dmp
memory/2392-55-0x000000000C830000-0x000000000C831000-memory.dmp
memory/2392-51-0x000000000C5D0000-0x000000000C5D1000-memory.dmp
memory/2392-49-0x0000000006900000-0x0000000006901000-memory.dmp
memory/2392-48-0x0000000006900000-0x0000000006901000-memory.dmp
memory/2392-47-0x0000000006900000-0x0000000006901000-memory.dmp
memory/2392-70-0x000000000DF90000-0x000000000DF91000-memory.dmp
memory/2392-69-0x000000000DF90000-0x000000000DF91000-memory.dmp
memory/2392-67-0x000000000DEE0000-0x000000000DEE1000-memory.dmp
memory/2392-65-0x000000000C5D0000-0x000000000C5D1000-memory.dmp
memory/2392-64-0x0000000006900000-0x0000000006901000-memory.dmp
memory/2392-62-0x000000000C5D0000-0x000000000C5D1000-memory.dmp
memory/2392-73-0x000000000DF90000-0x000000000DF91000-memory.dmp
memory/2392-72-0x000000000DF90000-0x000000000DF91000-memory.dmp
memory/2392-71-0x000000000DF90000-0x000000000DF91000-memory.dmp
memory/2392-74-0x0000000004FD0000-0x0000000004FD1000-memory.dmp
memory/2392-76-0x000000000C870000-0x000000000C873000-memory.dmp
memory/2392-75-0x000000000DEE0000-0x000000000DEE1000-memory.dmp
memory/2392-77-0x0000000004FD0000-0x0000000004FD1000-memory.dmp
memory/2392-90-0x000000000C870000-0x000000000C873000-memory.dmp
memory/2392-88-0x000000000C860000-0x000000000C861000-memory.dmp
memory/2392-79-0x000000000C870000-0x000000000C873000-memory.dmp
memory/2392-80-0x000000000C870000-0x000000000C873000-memory.dmp
memory/2392-78-0x000000000C870000-0x000000000C873000-memory.dmp
memory/2392-89-0x000000000C860000-0x000000000C861000-memory.dmp
memory/2392-95-0x0000000011150000-0x0000000011151000-memory.dmp
memory/2392-94-0x000000000B3B0000-0x000000000B3B1000-memory.dmp
memory/2392-93-0x0000000011150000-0x0000000011151000-memory.dmp
memory/2392-91-0x000000000C830000-0x000000000C831000-memory.dmp
memory/2392-83-0x000000000C860000-0x000000000C861000-memory.dmp
memory/2392-87-0x000000000C860000-0x000000000C861000-memory.dmp
memory/2392-86-0x000000000C860000-0x000000000C861000-memory.dmp
memory/2392-85-0x000000000C860000-0x000000000C861000-memory.dmp
memory/2392-84-0x000000000C860000-0x000000000C861000-memory.dmp
memory/2392-82-0x000000000C860000-0x000000000C861000-memory.dmp
memory/2392-81-0x000000000C870000-0x000000000C873000-memory.dmp
memory/5312-18-0x0000000000400000-0x0000000000457000-memory.dmp