Analysis
- user interaction
yes - max time kernel
149s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
30/07/2026, 20:26
General
- Target agent-8a27.exe
- Size 8.7MB
- Sample260730-y78fcafc23
- SHA256 7eda79f0d4c39b541acabfe5b47c9d4aafd5dac950bc6d5dba9ef6c8202cb214
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- Modifies system certificate store 2 TTPs 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\agent-8a27.exe"C:\Users\Admin\AppData\Local\Temp\agent-8a27.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WindowsUpdate\agent\i luv u.exe"C:\Users\Admin\AppData\Roaming\WindowsUpdate\agent\i luv u.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies trusted root certificate store through registry
- Modifies system certificate store
-
-
C:\Users\Admin\AppData\Roaming\WindowsUpdate\agent\i luv u.exe"C:\Users\Admin\AppData\Roaming\WindowsUpdate\agent\i luv u.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
i luv u.exe
id
memory/2308-22-0x00007FF7ED6C0000-0x00007FF7EFFD4000-memory.dmp
memory/2308-0-0x00000002A1770000-0x00000002A177D000-memory.dmp
memory/2428-161-0x00007FF728C40000-0x00007FF72B554000-memory.dmp
memory/2428-157-0x00007FF728C40000-0x00007FF72B554000-memory.dmp
memory/2428-155-0x00007FF728C40000-0x00007FF72B554000-memory.dmp
memory/2428-145-0x00007FF728C40000-0x00007FF72B554000-memory.dmp
memory/2428-163-0x00007FF728C40000-0x00007FF72B554000-memory.dmp
memory/2428-137-0x00007FF728C40000-0x00007FF72B554000-memory.dmp
memory/2428-153-0x00007FF728C40000-0x00007FF72B554000-memory.dmp
memory/2428-139-0x00007FF728C40000-0x00007FF72B554000-memory.dmp
memory/2428-151-0x00007FF728C40000-0x00007FF72B554000-memory.dmp
memory/2428-141-0x00007FF728C40000-0x00007FF72B554000-memory.dmp
memory/2428-149-0x00007FF728C40000-0x00007FF72B554000-memory.dmp
memory/2428-143-0x00007FF728C40000-0x00007FF72B554000-memory.dmp
memory/2428-147-0x00007FF728C40000-0x00007FF72B554000-memory.dmp
memory/4156-136-0x00007FF728C40000-0x00007FF72B554000-memory.dmp
memory/4156-146-0x00007FF728C40000-0x00007FF72B554000-memory.dmp
memory/4156-144-0x00007FF728C40000-0x00007FF72B554000-memory.dmp
memory/4156-148-0x00007FF728C40000-0x00007FF72B554000-memory.dmp
memory/4156-142-0x00007FF728C40000-0x00007FF72B554000-memory.dmp
memory/4156-140-0x00007FF728C40000-0x00007FF72B554000-memory.dmp
memory/4156-152-0x00007FF728C40000-0x00007FF72B554000-memory.dmp
memory/4156-138-0x00007FF728C40000-0x00007FF72B554000-memory.dmp
memory/4156-154-0x00007FF728C40000-0x00007FF72B554000-memory.dmp
memory/4156-24-0x0000000207610000-0x000000020761C000-memory.dmp
memory/4156-156-0x00007FF728C40000-0x00007FF72B554000-memory.dmp
memory/4156-60-0x00000003A51D0000-0x00000003A51DC000-memory.dmp
memory/4156-160-0x00007FF728C40000-0x00007FF72B554000-memory.dmp
memory/4156-33-0x000000029A970000-0x000000029A97C000-memory.dmp
memory/4156-162-0x00007FF728C40000-0x00007FF72B554000-memory.dmp
memory/4156-51-0x0000000372200000-0x000000037220C000-memory.dmp