Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/07/2026, 12:24
General
- Target git.exe
- Size 4.2MB
- Sample260727-plcbcasvgx
- SHA256 cab4c4eea1d869cf9f7be73868dc9a90ad2df1b1b673e5f8c8714a576c25ea96
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 7 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\git.exe"C:\Users\Admin\AppData\Local\Temp\git.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exe"cmd /c start "" /D "C:\ProgramData\GitWinx86" "C:\ProgramData\GitWinx86\git.exe""1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\GitWinx86\git.exe"C:\ProgramData\GitWinx86\git.exe""2⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\Temp\DCRCVDrv.sysC:\Windows\Temp\DCRCVDrv.sys1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140_1.dll
git.exe
libiconv-2.dll
libintl-8.dll
libpcre2-8-0.dll
libwinpthread-1.dll
msvcp140.dll
ucrtbase.dll
vcruntime140.dll
zlib1.dll
DCRCVDrv.sys
memory/1084-115-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-103-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-1303-0x0000000074470000-0x0000000074C2C000-memory.dmp
memory/1084-1302-0x0000000006F20000-0x00000000074DA000-memory.dmp
memory/1084-1301-0x00000000068C0000-0x0000000006952000-memory.dmp
memory/1084-1300-0x0000000074482000-0x0000000074483000-memory.dmp
memory/1084-1299-0x0000000005A80000-0x0000000005AE6000-memory.dmp
memory/1084-40-0x0000000074482000-0x0000000074483000-memory.dmp
memory/1084-41-0x0000000074470000-0x0000000074C2C000-memory.dmp
memory/1084-42-0x0000000005690000-0x00000000056AA000-memory.dmp
memory/1084-43-0x00000000057E0000-0x000000000580C000-memory.dmp
memory/1084-53-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-55-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-158-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-155-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-153-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-151-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-149-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-147-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-145-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-141-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-139-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-137-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-135-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-133-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-131-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-129-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-127-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-125-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-44-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-121-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-120-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-117-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-34-0x0000000000400000-0x0000000000470000-memory.dmp
memory/1084-113-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-111-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-109-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-107-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-105-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-63-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-99-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-97-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-95-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-93-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-91-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-89-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-87-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-83-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-81-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-79-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-77-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-75-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-73-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-71-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-67-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-65-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-61-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-59-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-57-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-51-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-49-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-47-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-45-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-143-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-123-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-101-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-85-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/1084-69-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/2364-12-0x0000000000010000-0x000000000003D000-memory.dmp
memory/4064-669-0x0000000074470000-0x0000000074C2C000-memory.dmp
memory/4064-1304-0x0000000074470000-0x0000000074C2C000-memory.dmp
memory/4064-1305-0x0000000074470000-0x0000000074C2C000-memory.dmp
memory/5032-36-0x00007FF8FF8D0000-0x00007FF8FF9EF000-memory.dmp
memory/5032-37-0x00007FF8F4490000-0x00007FF8F44E2000-memory.dmp
memory/5032-39-0x00007FF8F3F20000-0x00007FF8F3FD6000-memory.dmp
memory/5032-35-0x00007FF71B400000-0x00007FF71B86F000-memory.dmp
memory/5032-38-0x00007FF8FF8A0000-0x00007FF8FF8C6000-memory.dmp