Analysis
- max time kernel
150s - max time network
137s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
02/08/2026, 07:38
General
- Target WindowsHostManager(4).exe
- Size 2.4MB
- Sample260802-jgmnmafb46
- SHA256 d59999071e1abd9b74f2feac791f4a975e549a4d2841d6d7c62185b62b5a4194
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\WindowsHostManager(4).exe"C:\Users\Admin\AppData\Local\Temp\WindowsHostManager(4).exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WindowsHostManager.exe"C:\Users\Admin\AppData\Roaming\WindowsHostManager.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
WindowsHostManager.exe
memory/2372-0-0x000001EE24350000-0x000001EE245C0000-memory.dmp
memory/2372-1-0x00007FFB9D94F000-0x00007FFB9D950000-memory.dmp
memory/2372-2-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/2372-4-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/2372-5-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/3488-7-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/3488-8-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/3488-9-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/3488-10-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/3488-15-0x0000019F774B0000-0x0000019F774C6000-memory.dmp