Analysis
- user interaction
yes - max time kernel
53s - max time network
60s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 02:26
General
- Target Davetrap-4.0.1-win-x64/Davetrap.exe
- Size 96.5MB
- Sample260804-cw4gcsbe77
- SHA256 80e0db32bbcaefebcc9a7d51aa0fd659c53758a2bcedb2e63f714d6273395c30
Malware Config
Signatures
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 12 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 19 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Davetrap-4.0.1-win-x64\Davetrap.exe"C:\Users\Admin\AppData\Local\Temp\Davetrap-4.0.1-win-x64\Davetrap.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Davetrap\Logs\Davetrap_20260804T022829Z.log2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Users\Admin\AppData\Local\Davetrap\Davetrap.exe"C:\Users\Admin\AppData\Local\Davetrap\Davetrap.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Davetrap\Davetrap.exe"C:\Users\Admin\AppData\Local\Davetrap\Davetrap.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ClientAppSettings.json
RobloxState.json
Settings.json
State.json
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
vcruntime140_cor3.dll
wpfgfx_cor3.dll
Davetrap_20260804T022829Z.log
rps0sdkt.dfi
memory/1052-152-0x000001E8756F0000-0x000001E875790000-memory.dmp
memory/1052-160-0x000001E877280000-0x000001E877FA0000-memory.dmp
memory/1052-37-0x000001E057300000-0x000001E057320000-memory.dmp
memory/1052-65-0x000001E05C6A0000-0x000001E05C6D0000-memory.dmp
memory/1052-69-0x000001E05CED0000-0x000001E05CEF0000-memory.dmp
memory/1052-84-0x000001E873730000-0x000001E873EA0000-memory.dmp
memory/1052-88-0x000001E05CF40000-0x000001E05CF70000-memory.dmp
memory/1052-76-0x000001E05D080000-0x000001E05D180000-memory.dmp
memory/1052-45-0x000001E057180000-0x000001E057190000-memory.dmp
memory/1052-112-0x000001E872EF0000-0x000001E872F10000-memory.dmp
memory/1052-124-0x000001E873FF0000-0x000001E874000000-memory.dmp
memory/1052-120-0x000001E873EB0000-0x000001E873EF0000-memory.dmp
memory/1052-116-0x000001E873F50000-0x000001E873FB0000-memory.dmp
memory/1052-108-0x000001E872F60000-0x000001E872FA0000-memory.dmp
memory/1052-104-0x000001E057000000-0x000001E057010000-memory.dmp
memory/1052-100-0x000001E872D20000-0x000001E872D40000-memory.dmp
memory/1052-96-0x000001E872E30000-0x000001E872EF0000-memory.dmp
memory/1052-92-0x000001E872CB0000-0x000001E872CD0000-memory.dmp
memory/1052-80-0x000001E05CEF0000-0x000001E05CF40000-memory.dmp
memory/1052-57-0x000001E05B420000-0x000001E05B440000-memory.dmp
memory/1052-61-0x000001E05C610000-0x000001E05C630000-memory.dmp
memory/1052-128-0x000001E8746B0000-0x000001E874760000-memory.dmp
memory/1052-133-0x000001E8747D0000-0x000001E874840000-memory.dmp
memory/1052-136-0x000001E874A30000-0x000001E874B90000-memory.dmp
memory/1052-140-0x000001E874C90000-0x000001E874D90000-memory.dmp
memory/1052-144-0x000001E875010000-0x000001E8751C0000-memory.dmp
memory/1052-5-0x000001E0588E0000-0x000001E059830000-memory.dmp
memory/1052-148-0x000001E8755C0000-0x000001E875640000-memory.dmp
memory/1052-156-0x000001E875B10000-0x000001E875D80000-memory.dmp
memory/1052-164-0x000001E877FA0000-0x000001E878320000-memory.dmp
memory/1052-169-0x000001E878500000-0x000001E8786D0000-memory.dmp
memory/1052-41-0x000001E05C370000-0x000001E05C3F0000-memory.dmp
memory/1052-178-0x000001E874880000-0x000001E8748A0000-memory.dmp
memory/1052-174-0x000001E875800000-0x000001E875870000-memory.dmp
memory/1052-182-0x000001E874E10000-0x000001E874E60000-memory.dmp
memory/1052-186-0x000001E8787C0000-0x000001E8788A0000-memory.dmp
memory/1052-49-0x000001E05B330000-0x000001E05B350000-memory.dmp
memory/1052-53-0x000001E05B400000-0x000001E05B420000-memory.dmp
memory/1052-199-0x000001E875890000-0x000001E8758A0000-memory.dmp
memory/1052-195-0x000001E875880000-0x000001E875890000-memory.dmp
memory/1052-203-0x000001E87C2A0000-0x000001E87C2C0000-memory.dmp
memory/1052-211-0x000001E87EA90000-0x000001E87EC60000-memory.dmp
memory/1052-219-0x000001E87ED80000-0x000001E87EEA0000-memory.dmp
memory/1052-227-0x000001E87C2C0000-0x000001E87C2E0000-memory.dmp
memory/1052-231-0x000001E87E840000-0x000001E87E860000-memory.dmp
memory/1052-235-0x000001E87F0B0000-0x000001E87F0E0000-memory.dmp
memory/1052-223-0x000001E87EF90000-0x000001E87F080000-memory.dmp
memory/1052-215-0x000001E87AAB0000-0x000001E87AAC0000-memory.dmp
memory/1052-239-0x000001E87C250000-0x000001E87C260000-memory.dmp
memory/1052-252-0x000001E87F0E0000-0x000001E87F160000-memory.dmp
memory/1052-255-0x000001E87E720000-0x000001E87E740000-memory.dmp
memory/1052-259-0x000001E87AAD0000-0x000001E87AAE0000-memory.dmp
memory/1052-33-0x000001E870A00000-0x000001E8711F0000-memory.dmp
memory/1052-25-0x000001E05B1F0000-0x000001E05B230000-memory.dmp
memory/1052-29-0x000001E05B2C0000-0x000001E05B310000-memory.dmp
memory/1052-21-0x000001E05B160000-0x000001E05B1B0000-memory.dmp
memory/1052-17-0x000001E0571A0000-0x000001E057300000-memory.dmp
memory/1052-13-0x000001E05AD90000-0x000001E05AFB0000-memory.dmp
memory/1052-10-0x000001E86FAE0000-0x000001E870A00000-memory.dmp
memory/4548-711-0x0000025597960000-0x0000025597990000-memory.dmp
memory/4548-723-0x000002559A580000-0x000002559A5B0000-memory.dmp
memory/4548-727-0x000002559A5E0000-0x000002559A600000-memory.dmp
memory/4548-731-0x000002559A6E0000-0x000002559A750000-memory.dmp
memory/4548-735-0x000002559A640000-0x000002559A660000-memory.dmp