Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
06/08/2026, 02:33
General
- Target setup_r8011.exe
- Size 61.7MB
- Sample260806-c149fsfd69
- SHA256 12b5a941dc864f6c2d41d069850525089adcdc45fbd19e7638da68ac1bfb2f3d
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 52 IoCs
- Suspicious behavior: LoadsDriver 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_r8011.exe"C:\Users\Admin\AppData\Local\Temp\setup_r8011.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Public\pV4Luh\xTrtYK.exeC:\Users\Public\pV4Luh\xTrtYK.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\pV4Luh\" /t REG_DWORD /d 0 /f"1⤵
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
UxEnhance64.dll
adoresd.dat
msadox.tb
xTrtYK.exe
memory/3068-1-0x00000000001E0000-0x00000000001ED000-memory.dmp
memory/3068-2-0x00000000004D0000-0x00000000004DB000-memory.dmp
memory/3068-504-0x00007FFD994F0000-0x00007FFD99500000-memory.dmp
memory/3068-526-0x00000000001E0000-0x00000000001ED000-memory.dmp
memory/3068-527-0x00007FFD994F0000-0x00007FFD99500000-memory.dmp
memory/3068-0-0x00000000001E0000-0x00000000001ED000-memory.dmp
memory/4784-538-0x0000027E4E1E0000-0x0000027E4EA71000-memory.dmp
memory/4784-552-0x0000027E4E1E0000-0x0000027E4EA71000-memory.dmp
memory/4784-532-0x00007FFDA8F10000-0x00007FFDA8F12000-memory.dmp
memory/4784-545-0x0000027E4E1E0000-0x0000027E4EA71000-memory.dmp
memory/4784-541-0x0000027E4E1E0000-0x0000027E4EA71000-memory.dmp
memory/4784-540-0x00007FFDA8F20000-0x00007FFDA8F22000-memory.dmp
memory/4784-546-0x0000027E4E1E0000-0x0000027E4EA71000-memory.dmp
memory/4784-547-0x0000027E4E1E0000-0x0000027E4EA71000-memory.dmp
memory/4784-548-0x0000027E4E1E0000-0x0000027E4EA71000-memory.dmp
memory/4784-533-0x00007FFD8BF00000-0x00007FFD8C41E000-memory.dmp
memory/4784-561-0x0000027E4EE50000-0x0000027E4EEDA000-memory.dmp
memory/4784-560-0x0000027E4EE50000-0x0000027E4EEDA000-memory.dmp
memory/4784-559-0x0000027E4EE50000-0x0000027E4EEDA000-memory.dmp
memory/4784-558-0x0000027E4EE50000-0x0000027E4EEDA000-memory.dmp
memory/4784-557-0x0000027E4D790000-0x0000027E4D7DE000-memory.dmp
memory/4784-565-0x0000027E4E1E0000-0x0000027E4EA71000-memory.dmp
memory/4784-567-0x0000027E4E1E0000-0x0000027E4EA71000-memory.dmp