Analysis
- user interaction
yes - max time kernel
149s - max time network
154s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
31/07/2026, 23:29
General
- Target tungtung.exe
- Size 72.6MB
- Sample260731-3gyknsshld
- SHA256 26eb43ef4bd74cf30c58e2dcee7d0c6083d978a8f65ed6b0ca57668c5b16f93b
Malware Config
Signatures
- Loads dropped DLL 64 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 13 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tungtung.exe"C:\Users\Admin\AppData\Local\Temp\tungtung.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tungtung.exe"C:\Users\Admin\AppData\Local\Temp\tungtung.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\tungtung.exe"C:\Users\Admin\AppData\Local\Temp\tungtung.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tungtung.exe"C:\Users\Admin\AppData\Local\Temp\tungtung.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\New Microsoft Excel Worksheet.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_asyncio.pyd
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_elementtree.pyd
_hashlib.pyd
_lzma.pyd
_multiprocessing.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_uuid.pyd
_wmi.pyd
_zstd.pyd
ada92cb5d92a588d1b93__mypyc.cp314-win_amd64.pyd
_http_parser.cp314-win_amd64.pyd
_http_writer.cp314-win_amd64.pyd
base_library.zip
cd.cp314-win_amd64.pyd
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
_multidict.cp314-win_amd64.pyd
_helpers_c.cp314-win_amd64.pyd
_psutil_windows.pyd
pyexpat.pyd
python3.dll
python314.dll
select.pyd
Lorem ipsum.txt
unicodedata.pyd
_quoting_c.cp314-win_amd64.pyd
index.dat
b8ab77100df80ab2.customDestinations-ms
b8ab77100df80ab2.customDestinations-ms
memory/2480-285-0x00007FF9FB390000-0x00007FF9FB3A0000-memory.dmp
memory/2480-281-0x00007FF9FDA50000-0x00007FF9FDA60000-memory.dmp
memory/2480-280-0x00007FF9FDA50000-0x00007FF9FDA60000-memory.dmp
memory/2480-284-0x00007FF9FB390000-0x00007FF9FB3A0000-memory.dmp
memory/2480-279-0x00007FF9FDA50000-0x00007FF9FDA60000-memory.dmp
memory/2480-283-0x00007FF9FDA50000-0x00007FF9FDA60000-memory.dmp
memory/2480-282-0x00007FF9FDA50000-0x00007FF9FDA60000-memory.dmp
memory/5036-277-0x00000214A49B0000-0x00000214A50A4000-memory.dmp
memory/5072-170-0x000001E3D6F20000-0x000001E3D7519000-memory.dmp