Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
29/07/2026, 11:14
General
- Target 文件夹美化工具(Dr. Folder)2.6.6.3单文件版.exe
- Size 21.4MB
- Sample260729-nb5dpsga35
- SHA256 27ab4ddf58fc10e2733a9a87f14765cab977de9bc45da924eb833a1b1e3d5b2b
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\文件夹美化工具(Dr. Folder)2.6.6.3单文件版.exe"C:\Users\Admin\AppData\Local\Temp\文件夹美化工具(Dr. Folder)2.6.6.3单文件版.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
evb7413.tmp
memory/3660-13-0x0000000002EF0000-0x0000000002EF8000-memory.dmp
memory/3660-15-0x0000000005CC0000-0x0000000005CCE000-memory.dmp
memory/3660-3-0x0000000000400000-0x0000000000446000-memory.dmp
memory/3660-4-0x0000000002C80000-0x0000000002C90000-memory.dmp
memory/3660-1-0x0000000077C02000-0x0000000077C03000-memory.dmp
memory/3660-8-0x0000000010000000-0x000000001000A000-memory.dmp
memory/3660-12-0x0000000002C70000-0x0000000002C7A000-memory.dmp
memory/3660-0-0x0000000000400000-0x000000000048C000-memory.dmp
memory/3660-2-0x0000000077C03000-0x0000000077C04000-memory.dmp
memory/3660-16-0x0000000006810000-0x0000000006818000-memory.dmp
memory/3660-14-0x0000000005C80000-0x0000000005CB8000-memory.dmp
memory/3660-17-0x0000000002C80000-0x0000000002C90000-memory.dmp
memory/3660-18-0x0000000002C80000-0x0000000002C90000-memory.dmp
memory/3660-19-0x0000000000400000-0x000000000048C000-memory.dmp
memory/3660-20-0x0000000002C80000-0x0000000002C90000-memory.dmp
memory/3660-23-0x0000000002C80000-0x0000000002C90000-memory.dmp
memory/3660-24-0x0000000002C80000-0x0000000002C90000-memory.dmp