Analysis
- max time kernel
148s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
29/07/2026, 11:14
General
- Target 文件夹美化工具(Dr. Folder)2.6.6.3单文件版.exe
- Size 21.4MB
- Sample260729-nb5dpsga35
- SHA256 27ab4ddf58fc10e2733a9a87f14765cab977de9bc45da924eb833a1b1e3d5b2b
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\文件夹美化工具(Dr. Folder)2.6.6.3单文件版.exe"C:\Users\Admin\AppData\Local\Temp\文件夹美化工具(Dr. Folder)2.6.6.3单文件版.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
evbD3C2.tmp
memory/5924-13-0x0000000073C90000-0x000000007444C000-memory.dmp
memory/5924-15-0x00000000053A0000-0x00000000053DE000-memory.dmp
memory/5924-3-0x0000000073CA2000-0x0000000073CA3000-memory.dmp
memory/5924-4-0x0000000000400000-0x0000000000446000-memory.dmp
memory/5924-5-0x0000000073C90000-0x000000007444C000-memory.dmp
memory/5924-1-0x00000000770F8000-0x00000000770F9000-memory.dmp
memory/5924-2-0x00000000770F9000-0x00000000770FA000-memory.dmp
memory/5924-10-0x0000000010000000-0x000000001000A000-memory.dmp
memory/5924-14-0x0000000005390000-0x0000000005398000-memory.dmp
memory/5924-0-0x0000000000400000-0x000000000048C000-memory.dmp
memory/5924-16-0x00000000053E0000-0x00000000053EE000-memory.dmp
memory/5924-17-0x00000000094E0000-0x00000000094E8000-memory.dmp
memory/5924-18-0x0000000073C90000-0x000000007444C000-memory.dmp
memory/5924-19-0x0000000000400000-0x000000000048C000-memory.dmp
memory/5924-20-0x0000000073CA2000-0x0000000073CA3000-memory.dmp
memory/5924-21-0x0000000073C90000-0x000000007444C000-memory.dmp