Analysis
- max time kernel
149s - max time network
138s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
03/08/2026, 19:32
General
- Target Prime For Life.exe
- Size 201.2MB
- Sample260803-x82hraef69
- SHA256 a13b487f536a8878ab2073892ef78ece2d797af24c60561da140984670ea872e
Malware Config
Signatures
- Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Prime For Life.exe"C:\Users\Admin\AppData\Local\Temp\Prime For Life.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Prime For Life.exe"C:\Users\Admin\AppData\Local\Temp\Prime For Life.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\instructor-app-electron" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1720,i,17494484622314310802,11612563519295090412,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1716 /prefetch:22⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Prime For Life.exe"C:\Users\Admin\AppData\Local\Temp\Prime For Life.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\instructor-app-electron" --field-trial-handle=1720,i,17494484622314310802,11612563519295090412,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2032 /prefetch:112⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Prime For Life.exe"C:\Users\Admin\AppData\Local\Temp\Prime For Life.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\instructor-app-electron" --app-user-model-id=org.primeforlife.instructor --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1720,i,17494484622314310802,11612563519295090412,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2944 /prefetch:12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Prime For Life.exe"C:\Users\Admin\AppData\Local\Temp\Prime For Life.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\instructor-app-electron" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1720,i,17494484622314310802,11612563519295090412,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3272 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
default.dic
data_0
data_1
data_2
data_3
Preferences
Preferences~RFe58467a.TMP
config.json
memory/2460-142-0x00000228D2CF0000-0x00000228D45DA000-memory.dmp
memory/2460-114-0x00000228D2CF0000-0x00000228D45DA000-memory.dmp
memory/2460-116-0x00000228D2CF0000-0x00000228D45DA000-memory.dmp
memory/2628-63-0x00007FFB803C0000-0x00007FFB803C1000-memory.dmp
memory/2628-64-0x00007FFB7F350000-0x00007FFB7F351000-memory.dmp
memory/4972-126-0x000001C32A1C0000-0x000001C32A1C1000-memory.dmp
memory/4972-127-0x000001C32A1C0000-0x000001C32A1C1000-memory.dmp
memory/4972-138-0x000001C32A1C0000-0x000001C32A1C1000-memory.dmp
memory/4972-137-0x000001C32A1C0000-0x000001C32A1C1000-memory.dmp
memory/4972-136-0x000001C32A1C0000-0x000001C32A1C1000-memory.dmp
memory/4972-135-0x000001C32A1C0000-0x000001C32A1C1000-memory.dmp
memory/4972-134-0x000001C32A1C0000-0x000001C32A1C1000-memory.dmp
memory/4972-133-0x000001C32A1C0000-0x000001C32A1C1000-memory.dmp
memory/4972-132-0x000001C32A1C0000-0x000001C32A1C1000-memory.dmp
memory/4972-139-0x000001C3268B0000-0x000001C32819A000-memory.dmp
memory/4972-128-0x000001C32A1C0000-0x000001C32A1C1000-memory.dmp