Analysis
- max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
29/07/2026, 11:13
General
- Target 42d00bbf109d84bf076159af48932d3354d76daecf049fd09559dba48d3b5d21.dll
- Size 7.4MB
- Sample260729-nbm5essend
- SHA256 42d00bbf109d84bf076159af48932d3354d76daecf049fd09559dba48d3b5d21
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of FindShellTrayWindow 34 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\42d00bbf109d84bf076159af48932d3354d76daecf049fd09559dba48d3b5d21.dll,#12⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-fre --no-default-browser-check --disable-background-networking --disable-sync --disable-gpu --mute-audio --new-window2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa5702c728,0x7ffa5702c734,0x7ffa5702c7403⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1600,i,15595885196446333587,827813097353010128,262144 --field-trial-handle=2420,i,10013173233118695789,4264168615319785,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1896,i,11919680009370731023,2831475885252300820,524288 --field-trial-handle=2420,i,10013173233118695789,4264168615319785,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=2096,i,9278238350339734063,5816165577514167338,524288 --field-trial-handle=2420,i,10013173233118695789,4264168615319785,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:133⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3128,i,15996764264340320334,6562608396082355429,2097152 --field-trial-handle=2420,i,10013173233118695789,4264168615319785,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3124,i,15507865570785100517,346692584652098250,2097152 --field-trial-handle=2420,i,10013173233118695789,4264168615319785,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4520,i,12918871460349559208,751291526906212249,2097152 --field-trial-handle=2420,i,10013173233118695789,4264168615319785,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:13⤵
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
SCT Auditing Pending Reports
Local State
memory/2084-34-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-17-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-5-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-9-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-8-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-6-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-4-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-15-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-14-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-19-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-20-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-18-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-31-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-16-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-13-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-12-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-11-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-10-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-21-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-28-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-35-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-0-0x00000202B8A40000-0x00000202B8A41000-memory.dmp
memory/2084-3-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-33-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-22-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-29-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-27-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-26-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-25-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-24-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-23-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-30-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-32-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-1-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-7-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/2084-2-0x00000202B8A70000-0x00000202B8A71000-memory.dmp
memory/5860-50-0x0000000000B40000-0x0000000000BF4000-memory.dmp
memory/5860-36-0x0000000000B40000-0x0000000000BF4000-memory.dmp
memory/5860-70-0x0000000000B40000-0x0000000000BF4000-memory.dmp
memory/5860-71-0x0000000000B40000-0x0000000000BF4000-memory.dmp
memory/5860-73-0x0000000000B40000-0x0000000000BF4000-memory.dmp
memory/5860-74-0x0000000000B40000-0x0000000000BF4000-memory.dmp
memory/5860-75-0x0000000000B40000-0x0000000000BF4000-memory.dmp
memory/5860-76-0x0000000000B40000-0x0000000000BF4000-memory.dmp
memory/5860-77-0x0000000000B40000-0x0000000000BF4000-memory.dmp
memory/5860-78-0x0000000000B40000-0x0000000000BF4000-memory.dmp
memory/5860-79-0x0000000000B40000-0x0000000000BF4000-memory.dmp