Analysis
- max time kernel
150s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
27/07/2026, 12:24
General
- Target git.exe
- Size 4.2MB
- Sample260727-plcbcasvgx
- SHA256 cab4c4eea1d869cf9f7be73868dc9a90ad2df1b1b673e5f8c8714a576c25ea96
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 7 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\git.exe"C:\Users\Admin\AppData\Local\Temp\git.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exe"cmd /c start "" /D "C:\ProgramData\GitWinx86" "C:\ProgramData\GitWinx86\git.exe""1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\GitWinx86\git.exe"C:\ProgramData\GitWinx86\git.exe""2⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\Temp\DCRCVDrv.sysC:\Windows\Temp\DCRCVDrv.sys1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
git.exe
libiconv-2.dll
libintl-8.dll
libpcre2-8-0.dll
libwinpthread-1.dll
msvcp140.dll
ucrtbase.dll
vcruntime140.dll
vcruntime140_1.dll
zlib1.dll
DCRCVDrv.sys
memory/2184-35-0x00007FF61B4B0000-0x00007FF61B91F000-memory.dmp
memory/2184-36-0x00007FFBE7610000-0x00007FFBE772F000-memory.dmp
memory/2184-39-0x00007FFBE7550000-0x00007FFBE7606000-memory.dmp
memory/2184-38-0x00007FFBF05E0000-0x00007FFBF0606000-memory.dmp
memory/2184-37-0x00007FFBEAC10000-0x00007FFBEAC62000-memory.dmp
memory/2268-12-0x0000000000010000-0x000000000003D000-memory.dmp
memory/3264-118-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-96-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-41-0x0000000005450000-0x000000000546A000-memory.dmp
memory/3264-42-0x00000000055F0000-0x000000000561C000-memory.dmp
memory/3264-128-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-148-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-156-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-154-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-152-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-150-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-146-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-144-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-142-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-140-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-138-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-136-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-134-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-132-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-130-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-126-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-124-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-122-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-120-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-34-0x0000000000400000-0x0000000000470000-memory.dmp
memory/3264-116-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-114-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-112-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-110-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-108-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-106-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-104-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-102-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-100-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-40-0x00000000054E0000-0x00000000054F0000-memory.dmp
memory/3264-94-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-92-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-90-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-88-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-86-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-84-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-82-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-80-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-78-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-76-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-74-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-72-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-70-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-68-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-66-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-64-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-62-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-60-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-58-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-56-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-54-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-52-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-50-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-48-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-46-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-44-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-98-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-43-0x00000000055F0000-0x0000000005616000-memory.dmp
memory/3264-1297-0x0000000005880000-0x00000000058E6000-memory.dmp
memory/3264-1300-0x0000000006A00000-0x0000000006A92000-memory.dmp
memory/3264-1301-0x0000000007050000-0x00000000075F4000-memory.dmp
memory/3264-1302-0x00000000054E0000-0x00000000054F0000-memory.dmp