Analysis
- user interaction
yes - max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
02/08/2026, 10:19
General
- Target RTM Tool MsToLHaCkEr.exe
- Size 5.2MB
- Sample260802-mcm1dagf27
- SHA256 3c4f4ad0c697280920d5625e07ed071ccc901a5fb6242fb8b4999e056fd57e2b
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 14 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 5 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RTM Tool MsToLHaCkEr.exe"C:\Users\Admin\AppData\Local\Temp\RTM Tool MsToLHaCkEr.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 27099 -prefMapHandle 1960 -prefMapSize 270279 -ipcHandle 2068 -initialChannelId {68fb06cf-39e8-42db-9b7d-804f0a261a3c} -parentPid 3192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3192" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {12180586-ab19-40d3-993b-ffc19e652b5e} -parentPid 3192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3600 -prefsLen 27325 -prefMapHandle 3604 -prefMapSize 270279 -jsInitHandle 3608 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3660 -initialChannelId {38755276-9a15-4083-a9d0-34673cd5a401} -parentPid 3192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3848 -prefsLen 27325 -prefMapHandle 3852 -prefMapSize 270279 -ipcHandle 3936 -initialChannelId {4a4c8a0f-4897-406c-bac5-6b8942ac14ad} -parentPid 3192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3192" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3112 -prefsLen 34824 -prefMapHandle 1556 -prefMapSize 270279 -jsInitHandle 3204 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2896 -initialChannelId {acd4dc9e-f5fd-4334-bfc2-e4f75257a82c} -parentPid 3192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
data.safe.tmp
events
4f0cf448-8824-40b1-a5f7-d871a3546310
60c18eed-36e7-4763-8e63-97edf07a6c92
644461b4-4c0c-4f27-9779-f5890ef99227
a069b7aa-5ded-49f4-a5a8-8cfeb3d6b7fc
b3842f88-ba6b-4f7e-88f8-b58f65e5fb81
e7d43cd2-a8eb-4866-b2ee-6c4e88951291
prefs-1.js
prefs.js
prefs.js
memory/772-87-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-102-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-14-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-22-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-20-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-26-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-30-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-28-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-24-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-18-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-16-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-12-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-6-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-34-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-36-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-42-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-44-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-48-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-46-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-41-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-38-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-32-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-55-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-53-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-51-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-67-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-63-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-71-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-69-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-77-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-89-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-10-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-91-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-85-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-83-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-79-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-94-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-8-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-108-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-100-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-128-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-126-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-104-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-112-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-132-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-145-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-147-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-110-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-233-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/772-130-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-273-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/772-124-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-328-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/772-122-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-116-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-114-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-106-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-143-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-141-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-5-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-4-0x00000000069F0000-0x0000000007090000-memory.dmp
memory/772-3-0x0000000005BA0000-0x0000000006144000-memory.dmp
memory/772-2-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/772-1066-0x0000000006150000-0x00000000061E2000-memory.dmp
memory/772-1068-0x0000000002740000-0x0000000002741000-memory.dmp
memory/772-1067-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/772-1-0x0000000006250000-0x00000000068F2000-memory.dmp
memory/772-0-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/772-139-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-98-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-96-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-75-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-73-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-57-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-65-0x00000000069F0000-0x000000000708A000-memory.dmp
memory/772-1069-0x00000000027B0000-0x00000000027C0000-memory.dmp