Analysis
- user interaction
yes - max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
07/08/2026, 06:32
General
- Target NEOScavenger.exe
- Size 45.4MB
- Sample260807-has2dshk8t
- SHA256 fafe014a76c762819f800089fd8ba47cdd8fe04b21e9acec63e8407e9dabe980
Malware Config
Signatures
- Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 7 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEOScavenger.exe"C:\Users\Admin\AppData\Local\Temp\NEOScavenger.exe"1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1952-0-0x00000000048A0000-0x00000000048A1000-memory.dmp
memory/1952-15-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-36-0x00000000090C0000-0x00000000092C0000-memory.dmp
memory/1952-38-0x00000000090C0000-0x00000000092C0000-memory.dmp
memory/1952-63-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-66-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-81-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-154-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-164-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-163-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-162-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-160-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-159-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-158-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-157-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-156-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-155-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-153-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-152-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-150-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-149-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-148-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-147-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-132-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-131-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-129-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-128-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-127-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-125-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-124-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-120-0x0000000009400000-0x0000000009600000-memory.dmp
memory/1952-118-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-80-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-79-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-78-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-77-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-76-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-74-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-65-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-64-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-61-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-57-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-55-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-54-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-48-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-41-0x00000000090C0000-0x00000000092C0000-memory.dmp
memory/1952-40-0x00000000090C0000-0x00000000092C0000-memory.dmp
memory/1952-39-0x00000000090C0000-0x00000000092C0000-memory.dmp
memory/1952-37-0x00000000090C0000-0x00000000092C0000-memory.dmp
memory/1952-35-0x00000000090C0000-0x00000000092C0000-memory.dmp
memory/1952-34-0x00000000090C0000-0x00000000092C0000-memory.dmp
memory/1952-33-0x00000000090C0000-0x00000000092C0000-memory.dmp
memory/1952-32-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-31-0x00000000090C0000-0x00000000092C0000-memory.dmp
memory/1952-30-0x00000000090C0000-0x00000000092C0000-memory.dmp
memory/1952-29-0x00000000090C0000-0x00000000092C0000-memory.dmp
memory/1952-28-0x00000000090C0000-0x00000000092C0000-memory.dmp
memory/1952-27-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-26-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-25-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-24-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-22-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-20-0x00000000090C0000-0x00000000092C0000-memory.dmp
memory/1952-19-0x00000000090C0000-0x00000000092C0000-memory.dmp
memory/1952-14-0x0000000008EC0000-0x00000000090C0000-memory.dmp
memory/1952-190-0x00000000048A0000-0x00000000048A1000-memory.dmp