Analysis
- user interaction
yes - max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
05/08/2026, 18:24
General
- Target Marcas.exe
- Size 17.3MB
- Sample260805-w2d87sdp7x
- SHA256 57329f0974567f61087b1b117131fa41e64071674e1c93f42c9a2748f90ecea6
Malware Config
Signatures
- Drops desktop.ini file(s) 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Marcas.exe"C:\Users\Admin\AppData\Local\Temp\Marcas.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
desktop.ini
memory/3184-46-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-48-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-16-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-17-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-15-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-14-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-23-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-26-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-25-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-31-0x0000000002B80000-0x0000000002CC0000-memory.dmp
memory/3184-24-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-22-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-21-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-20-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-19-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-10-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-2-0x000000007660F000-0x0000000076610000-memory.dmp
memory/3184-0-0x0000000000400000-0x0000000000D49000-memory.dmp
memory/3184-6-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-7-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-11-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-47-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-8-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-49-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-51-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-57-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-61-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-60-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-59-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-58-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-56-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-55-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-54-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-53-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-52-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-62-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-63-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-66-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-65-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-64-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-67-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-70-0x00000000765F0000-0x00000000766E0000-memory.dmp
memory/3184-71-0x0000000000400000-0x0000000000B3B000-memory.dmp