Analysis
- max time kernel
151s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
07/08/2026, 19:32
General
- Target setup_j68011.exe
- Size 53.8MB
- Sample260807-x88basvxcx
- SHA256 d80d0714a925a7eb994ccc4ac62a294cbc1d55b3597f666f33687d59295c376b
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Drops file in System32 directory 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_j68011.exe"C:\Users\Admin\AppData\Local\Temp\setup_j68011.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Public\TpQVuH\aGCTc0.exe"C:\Users\Public\TpQVuH\aGCTc0.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
UxEnhance64.dll
aGCTc0.exe
adoresd.dat
msadox.tb
memory/5488-526-0x00007FFE7A690000-0x00007FFE7A6A2000-memory.dmp
memory/5488-2-0x00000000005D0000-0x00000000005DB000-memory.dmp
memory/5488-0-0x00000000005B0000-0x00000000005BD000-memory.dmp
memory/5488-514-0x00007FFE7A690000-0x00007FFE7A6A2000-memory.dmp
memory/5488-504-0x00007FFE7A690000-0x00007FFE7A6A2000-memory.dmp
memory/5488-525-0x00000000005B0000-0x00000000005BD000-memory.dmp
memory/5488-1-0x00000000005B0000-0x00000000005BD000-memory.dmp
memory/5792-540-0x000001FBCBE00000-0x000001FBCC691000-memory.dmp
memory/5792-547-0x000001FBCBE00000-0x000001FBCC691000-memory.dmp
memory/5792-537-0x000001FBCBE00000-0x000001FBCC691000-memory.dmp
memory/5792-539-0x00007FFE83060000-0x00007FFE83062000-memory.dmp
memory/5792-531-0x00007FFE83050000-0x00007FFE83052000-memory.dmp
memory/5792-544-0x000001FBCBE00000-0x000001FBCC691000-memory.dmp
memory/5792-545-0x000001FBCBE00000-0x000001FBCC691000-memory.dmp
memory/5792-532-0x00007FFE60500000-0x00007FFE60A1E000-memory.dmp
memory/5792-546-0x000001FBCBE00000-0x000001FBCC691000-memory.dmp
memory/5792-551-0x000001FBCBE00000-0x000001FBCC691000-memory.dmp
memory/5792-558-0x000001FBCC730000-0x000001FBCC7BA000-memory.dmp
memory/5792-561-0x000001FBCC730000-0x000001FBCC7BA000-memory.dmp
memory/5792-557-0x000001FBCB3A0000-0x000001FBCB3EE000-memory.dmp
memory/5792-560-0x000001FBCC730000-0x000001FBCC7BA000-memory.dmp
memory/5792-559-0x000001FBCC730000-0x000001FBCC7BA000-memory.dmp