Analysis
- max time kernel
148s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
07/08/2026, 09:40
General
- Target Chara/Chara.exe
- Size 371KB
- Sample260807-lnbwtavvhs
- SHA256 fc11ec883f6552e69b00dc71b8ece86e888525cd5f13bab3a892523f0637e5d4
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Chara\Chara.exe"C:\Users\Admin\AppData\Local\Temp\Chara\Chara.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3rnceobm\3rnceobm.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1B1F.tmp" "c:\Users\Admin\AppData\Local\Temp\3rnceobm\CSC3787D4986E744722ACBB636C3C91F21.TMP"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
3rnceobm.dll
RES1B1F.tmp
3rnceobm.0.cs
3rnceobm.cmdline
CSC3787D4986E744722ACBB636C3C91F21.TMP
memory/5084-15-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/5084-2-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/5084-9-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/5084-10-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/5084-5-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/5084-16-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/5084-11-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/5084-0-0x00007FF99F5EF000-0x00007FF99F5F0000-memory.dmp
memory/5084-6-0x000000001BBC0000-0x000000001BBE2000-memory.dmp
memory/5084-7-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/5084-8-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/5084-27-0x000000001BA90000-0x000000001BA98000-memory.dmp
memory/5084-23-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/5084-1-0x0000000000DE0000-0x0000000000E42000-memory.dmp
memory/5084-28-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/5084-29-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/5084-31-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/5084-32-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/5084-33-0x0000000025A90000-0x0000000026236000-memory.dmp
memory/5084-38-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/5084-39-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp