Analysis
- max time kernel
150s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
30/07/2026, 12:27
General
- Target EASY_REMOTE.exe
- Size 119KB
- Sample260730-pmvjbaxeng
- SHA256 868643a0285b689148979be762ea9d2d641f333e639faacdf7f59e8d6e3deae4
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\EASY_REMOTE.exe"C:\Users\Admin\AppData\Local\Temp\EASY_REMOTE.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\szn0rprd\szn0rprd.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE768.tmp" "c:\Users\Admin\AppData\Local\Temp\szn0rprd\CSC250AF99FB70C40B4AC793ABE79671A27.TMP"3⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pxpdbsjt\pxpdbsjt.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEBAE.tmp" "c:\Users\Admin\AppData\Local\Temp\pxpdbsjt\CSCEA8FBEE72CB44D7B53366F5282E6C2.TMP"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
RESE768.tmp
RESEBAE.tmp
pxpdbsjt.dll
szn0rprd.dll
CSCEA8FBEE72CB44D7B53366F5282E6C2.TMP
pxpdbsjt.0.cs
pxpdbsjt.cmdline
CSC250AF99FB70C40B4AC793ABE79671A27.TMP
szn0rprd.0.cs
szn0rprd.cmdline
memory/2372-38-0x000000001AE40000-0x000000001AE48000-memory.dmp
memory/2372-43-0x000000001E3D0000-0x000000001E3EE000-memory.dmp
memory/2372-23-0x0000000002430000-0x0000000002438000-memory.dmp
memory/2372-8-0x000000001AE50000-0x000000001AEA0000-memory.dmp
memory/2372-9-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/2372-24-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/2372-25-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/2372-7-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/2372-0-0x00007FFB9D94F000-0x00007FFB9D950000-memory.dmp
memory/2372-6-0x000000001AD10000-0x000000001AD32000-memory.dmp
memory/2372-39-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/2372-5-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/2372-40-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/2372-13-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/2372-48-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/2372-47-0x000000001E4E0000-0x000000001E504000-memory.dmp
memory/2372-49-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/2372-46-0x000000001E4E0000-0x000000001E50A000-memory.dmp
memory/2372-44-0x000000001E3F0000-0x000000001E4A2000-memory.dmp
memory/2372-45-0x000000001E240000-0x000000001E24A000-memory.dmp
memory/2372-4-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/2372-1-0x00000000000F0000-0x0000000000114000-memory.dmp
memory/2372-50-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/2372-51-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/2372-53-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/2372-54-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/2372-55-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp