Analysis
- user interaction
yes - max time kernel
16s - max time network
20s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
02/08/2026, 07:07
General
- Target RTM Tool MsToLHaCkEr.exe
- Size 5.2MB
- Sample260802-hxtansxbqa
- SHA256 3c4f4ad0c697280920d5625e07ed071ccc901a5fb6242fb8b4999e056fd57e2b
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RTM Tool MsToLHaCkEr.exe"C:\Users\Admin\AppData\Local\Temp\RTM Tool MsToLHaCkEr.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5052-0-0x0000000005D90000-0x0000000005DA0000-memory.dmp
memory/5052-1-0x0000000006440000-0x0000000006AE2000-memory.dmp
memory/5052-2-0x0000000005D90000-0x0000000005DA0000-memory.dmp
memory/5052-3-0x0000000005DA0000-0x0000000006346000-memory.dmp
memory/5052-4-0x0000000006AE0000-0x0000000007180000-memory.dmp
memory/5052-5-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-12-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-14-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-18-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-22-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-26-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-36-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-44-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-42-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-48-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-56-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-60-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-58-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-54-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-52-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-50-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-46-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-40-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-38-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-35-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-32-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-28-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-30-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-24-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-20-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-16-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-11-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-8-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-6-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-64-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-72-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-82-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-112-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-118-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-124-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-130-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-128-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-122-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-120-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-126-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-116-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-114-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-110-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-106-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-104-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-102-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-108-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-100-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-98-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-96-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-94-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-92-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-90-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-88-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-86-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-85-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-80-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-78-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-76-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-74-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-70-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-68-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-66-0x0000000006AE0000-0x000000000717A000-memory.dmp
memory/5052-62-0x0000000006AE0000-0x000000000717A000-memory.dmp