Resubmissions
28/07/2026, 22:48
260728-2rbm8abl3w1028/07/2026, 22:37
260728-2jv2wsbj7v1028/07/2026, 22:32
260728-2fxfjsxglc1027/07/2026, 21:38
260727-1hkdbs1hrd10Analysis
- user interaction
yes - max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
28/07/2026, 22:32
General
- Target REAL_hd.any_MiniRedir.dll
- Size 7.7MB
- Sample260728-2fxfjsxglc
- SHA256 0794db73759ee87450b45bde86b7ecc226e97f4dfd7cce528c975f4a4f695fcb
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
- A potential corporate email address has been identified in the URL: [email protected]
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 34 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\REAL_hd.any_MiniRedir.dll,#12⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-fre --no-default-browser-check --disable-background-networking --disable-sync --disable-gpu --mute-audio --new-window2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff9d610c728,0x7ff9d610c734,0x7ff9d610c7403⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1316,i,4678670668095394798,17613332776641439890,524288 --field-trial-handle=2056,i,14633023902548371645,12067022328335378106,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1704,i,14196239616509685462,15451574351960343412,262144 --field-trial-handle=2056,i,14633023902548371645,12067022328335378106,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=2088,i,11914156681466635325,3599369601805670107,524288 --field-trial-handle=2056,i,14633023902548371645,12067022328335378106,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:133⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3144,i,2067433237830111883,18408499835675448246,2097152 --field-trial-handle=2056,i,14633023902548371645,12067022328335378106,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3172,i,8882954532468750885,10755980681760893741,2097152 --field-trial-handle=2056,i,14633023902548371645,12067022328335378106,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4508,i,6491097893175020167,3715545265922642467,2097152 --field-trial-handle=2056,i,14633023902548371645,12067022328335378106,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:13⤵
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
SCT Auditing Pending Reports
Local State
memory/2820-34-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-12-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-7-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-5-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-3-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-2-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-1-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-11-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-20-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-19-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-18-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-17-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-16-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-14-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-13-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-31-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-15-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-10-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-21-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-22-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-35-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-0-0x0000022BB8AA0000-0x0000022BB8AA1000-memory.dmp
memory/2820-8-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-33-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-4-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-30-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-28-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-26-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-24-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-23-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-32-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-29-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-27-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-25-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-6-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/2820-9-0x0000022BB8C20000-0x0000022BB8C21000-memory.dmp
memory/5572-39-0x0000000000D30000-0x0000000000DDE000-memory.dmp
memory/5572-38-0x0000000000D30000-0x0000000000DDE000-memory.dmp
memory/5572-36-0x0000000000D30000-0x0000000000DDE000-memory.dmp
memory/5572-75-0x0000000000D30000-0x0000000000DDE000-memory.dmp
memory/5572-77-0x0000000000D30000-0x0000000000DDE000-memory.dmp
memory/5572-78-0x0000000000D30000-0x0000000000DDE000-memory.dmp
memory/5572-80-0x0000000000D30000-0x0000000000DDE000-memory.dmp
memory/5572-82-0x0000000000D30000-0x0000000000DDE000-memory.dmp
memory/5572-83-0x0000000000D30000-0x0000000000DDE000-memory.dmp
memory/5572-84-0x0000000000D30000-0x0000000000DDE000-memory.dmp