Analysis
- max time kernel
150s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
05/08/2026, 04:28
General
- Target setup_r8015.exe
- Size 40.9MB
- Sample260805-e3xnhavyd1
- SHA256 1d894cde7753f1a8997024dea0841814ee28341786d4a1f1ad821902aeb54f0e
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious behavior: EnumeratesProcesses 38 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_r8015.exe"C:\Users\Admin\AppData\Local\Temp\setup_r8015.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Users\Public\uLSi5z\2Liptm.exe"C:\Users\Public\uLSi5z\2Liptm.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
2Liptm.exe
UxEnhance64.dll
adoresd.dat
msadox.tb
memory/2640-1-0x00000000005C0000-0x00000000005CD000-memory.dmp
memory/2640-2-0x00000000005D0000-0x00000000005DB000-memory.dmp
memory/2640-504-0x00007FFAC88B0000-0x00007FFAC88C2000-memory.dmp
memory/2640-505-0x00007FFAC88B0000-0x00007FFAC88C2000-memory.dmp
memory/2640-528-0x00000000005C0000-0x00000000005CD000-memory.dmp
memory/2640-529-0x00007FFAC88B0000-0x00007FFAC88C2000-memory.dmp
memory/2640-0-0x00000000005C0000-0x00000000005CD000-memory.dmp
memory/3968-535-0x00007FFAB4D90000-0x00007FFAB52AE000-memory.dmp
memory/3968-534-0x00007FFAD7470000-0x00007FFAD7472000-memory.dmp
memory/3968-540-0x0000028898E70000-0x0000028899701000-memory.dmp
memory/3968-542-0x00007FFAD7480000-0x00007FFAD7482000-memory.dmp
memory/3968-543-0x0000028898E70000-0x0000028899701000-memory.dmp
memory/3968-547-0x0000028898E70000-0x0000028899701000-memory.dmp
memory/3968-548-0x0000028898E70000-0x0000028899701000-memory.dmp
memory/3968-549-0x0000028898E70000-0x0000028899701000-memory.dmp
memory/3968-550-0x0000028898E70000-0x0000028899701000-memory.dmp