Analysis
- user interaction
yes - max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
07/08/2026, 06:32
General
- Target NEOScavenger.exe
- Size 45.4MB
- Sample260807-has2dshk8t
- SHA256 fafe014a76c762819f800089fd8ba47cdd8fe04b21e9acec63e8407e9dabe980
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEOScavenger.exe"C:\Users\Admin\AppData\Local\Temp\NEOScavenger.exe"1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4080-0-0x00000000034F0000-0x00000000034F1000-memory.dmp
memory/4080-15-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-19-0x0000000009D70000-0x0000000009F70000-memory.dmp
memory/4080-16-0x0000000009D70000-0x0000000009F70000-memory.dmp
memory/4080-14-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-20-0x0000000009D70000-0x0000000009F70000-memory.dmp
memory/4080-26-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-27-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-30-0x0000000009D70000-0x0000000009F70000-memory.dmp
memory/4080-29-0x0000000009D70000-0x0000000009F70000-memory.dmp
memory/4080-25-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-28-0x0000000009D70000-0x0000000009F70000-memory.dmp
memory/4080-31-0x0000000009D70000-0x0000000009F70000-memory.dmp
memory/4080-24-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-22-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-33-0x0000000009D70000-0x0000000009F70000-memory.dmp
memory/4080-81-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-80-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-118-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-163-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-162-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-160-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-158-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-157-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-156-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-155-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-154-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-153-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-152-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-150-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-149-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-148-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-147-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-132-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-131-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-129-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-128-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-127-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-125-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-124-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-120-0x000000000A070000-0x000000000A270000-memory.dmp
memory/4080-159-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-79-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-78-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-77-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-76-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-74-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-66-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-65-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-64-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-63-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-61-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-57-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-55-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-54-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-48-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-41-0x0000000009D70000-0x0000000009F70000-memory.dmp
memory/4080-40-0x0000000009D70000-0x0000000009F70000-memory.dmp
memory/4080-39-0x0000000009D70000-0x0000000009F70000-memory.dmp
memory/4080-36-0x0000000009D70000-0x0000000009F70000-memory.dmp
memory/4080-35-0x0000000009D70000-0x0000000009F70000-memory.dmp
memory/4080-37-0x0000000009D70000-0x0000000009F70000-memory.dmp
memory/4080-38-0x0000000009D70000-0x0000000009F70000-memory.dmp
memory/4080-34-0x0000000009D70000-0x0000000009F70000-memory.dmp
memory/4080-32-0x0000000009B70000-0x0000000009D70000-memory.dmp
memory/4080-190-0x00000000034F0000-0x00000000034F1000-memory.dmp