Analysis
- user interaction
yes - max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 02:56
General
- Target source_prepared.exe
- Size 30.5MB
- Sample260809-de471age29
- SHA256 3287d982918eb91a5342796981ff18e8cd4d55d5236dd11d8ea9c32a41f98a9d
Malware Config
Signatures
- Loads dropped DLL 48 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
_raw_aes.pyd
_raw_aesni.pyd
_cpuid_c.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_asyncio.pyd
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_wmi.pyd
ada92cb5d92a588d1b93__mypyc.cp313-win_amd64.pyd
_http_parser.cp313-win_amd64.pyd
_http_writer.cp313-win_amd64.pyd
mask.cp313-win_amd64.pyd
base_library.zip
cd.cp313-win_amd64.pyd
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
_multidict.cp313-win_amd64.pyd
_helpers_c.cp313-win_amd64.pyd
python3.DLL
python313.dll
select.pyd
ucrtbase.dll
unicodedata.pyd
_quoting_c.cp313-win_amd64.pyd
memory/2188-1340-0x00000243591E0000-0x00000243591E1000-memory.dmp
memory/2188-1336-0x00000243591E0000-0x00000243591E1000-memory.dmp
memory/2188-1334-0x00000243591E0000-0x00000243591E1000-memory.dmp
memory/2188-1345-0x00000243591E0000-0x00000243591E1000-memory.dmp
memory/2188-1344-0x00000243591E0000-0x00000243591E1000-memory.dmp
memory/2188-1343-0x00000243591E0000-0x00000243591E1000-memory.dmp
memory/2188-1342-0x00000243591E0000-0x00000243591E1000-memory.dmp
memory/2188-1341-0x00000243591E0000-0x00000243591E1000-memory.dmp
memory/3960-1272-0x00007FF8C1C00000-0x00007FF8C1C18000-memory.dmp
memory/3960-1313-0x00007FF8C4920000-0x00007FF8C493C000-memory.dmp
memory/3960-1258-0x00007FF8C66C0000-0x00007FF8C6700000-memory.dmp
memory/3960-1256-0x00007FF8C4900000-0x00007FF8C491E000-memory.dmp
memory/3960-1250-0x00007FF8C5E60000-0x00007FF8C5E72000-memory.dmp
memory/3960-1253-0x00007FF8C4920000-0x00007FF8C493C000-memory.dmp
memory/3960-1246-0x00007FF8C66A0000-0x00007FF8C66B6000-memory.dmp
memory/3960-1245-0x00007FF8C6960000-0x00007FF8C6993000-memory.dmp
memory/3960-1243-0x00007FF8CFFD0000-0x00007FF8CFFDC000-memory.dmp
memory/3960-1237-0x00007FF8D01B0000-0x00007FF8D01BB000-memory.dmp
memory/3960-1240-0x00007FF8C6A00000-0x00007FF8C6A12000-memory.dmp
memory/3960-1230-0x00007FF8C7930000-0x00007FF8C7946000-memory.dmp
memory/3960-1236-0x00007FF8BD920000-0x00007FF8BDE53000-memory.dmp
memory/3960-1226-0x00007FF8C2760000-0x00007FF8C2813000-memory.dmp
memory/3960-1231-0x00007FF8D0F20000-0x00007FF8D0F2F000-memory.dmp
memory/3960-1217-0x00007FF8D28D0000-0x00007FF8D28DD000-memory.dmp
memory/3960-1223-0x00007FF8C66C0000-0x00007FF8C6700000-memory.dmp
memory/3960-1221-0x00007FF8D16D0000-0x00007FF8D16DB000-memory.dmp
memory/3960-1216-0x00007FF8C8A60000-0x00007FF8C8A87000-memory.dmp
memory/3960-1214-0x00007FF8C63E0000-0x00007FF8C64AE000-memory.dmp
memory/3960-1212-0x00007FF8BDE60000-0x00007FF8BE4C9000-memory.dmp
memory/3960-1263-0x00007FF8C2760000-0x00007FF8C2813000-memory.dmp
memory/3960-1264-0x00007FF8C48C0000-0x00007FF8C48D3000-memory.dmp
memory/3960-1267-0x00007FF8D0F20000-0x00007FF8D0F2F000-memory.dmp
memory/3960-1268-0x00007FF8C26B0000-0x00007FF8C26FA000-memory.dmp
memory/3960-1210-0x00007FF8C6960000-0x00007FF8C6993000-memory.dmp
memory/3960-1270-0x00007FF8C48A0000-0x00007FF8C48B1000-memory.dmp
memory/3960-1271-0x00007FF8C2680000-0x00007FF8C26AB000-memory.dmp
memory/3960-1207-0x00007FF8D2A80000-0x00007FF8D2A8D000-memory.dmp
memory/3960-1273-0x00007FF8C0B80000-0x00007FF8C0B94000-memory.dmp
memory/3960-1274-0x00007FF8C0B10000-0x00007FF8C0B7B000-memory.dmp
memory/3960-1275-0x00007FF8C0AD0000-0x00007FF8C0B06000-memory.dmp
memory/3960-1276-0x00007FF8C0AA0000-0x00007FF8C0ACA000-memory.dmp
memory/3960-1277-0x00007FF8C0A70000-0x00007FF8C0A9F000-memory.dmp
memory/3960-1278-0x00007FF8C0A40000-0x00007FF8C0A65000-memory.dmp
memory/3960-1279-0x00007FF8BD790000-0x00007FF8BD919000-memory.dmp
memory/3960-1280-0x00007FF8C48A0000-0x00007FF8C48B1000-memory.dmp
memory/3960-1281-0x00007FF8C0A20000-0x00007FF8C0A3B000-memory.dmp
memory/3960-1282-0x00007FF8C8A00000-0x00007FF8C8A0B000-memory.dmp
memory/3960-1283-0x00007FF8C1C00000-0x00007FF8C1C18000-memory.dmp
memory/3960-1284-0x00007FF8C0A00000-0x00007FF8C0A12000-memory.dmp
memory/3960-1285-0x00007FF8C89D0000-0x00007FF8C89DC000-memory.dmp
memory/3960-1287-0x00007FF8BD500000-0x00007FF8BD78F000-memory.dmp
memory/3960-1286-0x00007FF8C0B10000-0x00007FF8C0B7B000-memory.dmp
memory/3960-1289-0x00007FF8C00D0000-0x00007FF8C0129000-memory.dmp
memory/3960-1288-0x00007FF8C0AD0000-0x00007FF8C0B06000-memory.dmp
memory/3960-1290-0x00007FF8C0AA0000-0x00007FF8C0ACA000-memory.dmp
memory/3960-1291-0x00007FF8C0A70000-0x00007FF8C0A9F000-memory.dmp
memory/3960-1307-0x00007FF8D0F20000-0x00007FF8D0F2F000-memory.dmp
memory/3960-1259-0x00007FF8C48E0000-0x00007FF8C48F8000-memory.dmp
memory/3960-1298-0x00007FF8BD920000-0x00007FF8BDE53000-memory.dmp
memory/3960-1321-0x00007FF8C0B80000-0x00007FF8C0B94000-memory.dmp
memory/3960-1320-0x00007FF8C1C00000-0x00007FF8C1C18000-memory.dmp
memory/3960-1331-0x00007FF8C89D0000-0x00007FF8C89DC000-memory.dmp
memory/3960-1333-0x00007FF8C00D0000-0x00007FF8C0129000-memory.dmp
memory/3960-1332-0x00007FF8BD500000-0x00007FF8BD78F000-memory.dmp
memory/3960-1330-0x00007FF8C0A00000-0x00007FF8C0A12000-memory.dmp
memory/3960-1329-0x00007FF8C8A00000-0x00007FF8C8A0B000-memory.dmp
memory/3960-1328-0x00007FF8C0A20000-0x00007FF8C0A3B000-memory.dmp
memory/3960-1327-0x00007FF8BD790000-0x00007FF8BD919000-memory.dmp
memory/3960-1326-0x00007FF8C0A40000-0x00007FF8C0A65000-memory.dmp
memory/3960-1325-0x00007FF8C0A70000-0x00007FF8C0A9F000-memory.dmp
memory/3960-1324-0x00007FF8C0AA0000-0x00007FF8C0ACA000-memory.dmp
memory/3960-1323-0x00007FF8C0AD0000-0x00007FF8C0B06000-memory.dmp
memory/3960-1319-0x00007FF8C2680000-0x00007FF8C26AB000-memory.dmp
memory/3960-1318-0x00007FF8C48A0000-0x00007FF8C48B1000-memory.dmp
memory/3960-1317-0x00007FF8C26B0000-0x00007FF8C26FA000-memory.dmp
memory/3960-1316-0x00007FF8C48C0000-0x00007FF8C48D3000-memory.dmp
memory/3960-1315-0x00007FF8C48E0000-0x00007FF8C48F8000-memory.dmp
memory/3960-1314-0x00007FF8C4900000-0x00007FF8C491E000-memory.dmp
memory/3960-1312-0x00007FF8C5E60000-0x00007FF8C5E72000-memory.dmp
memory/3960-1311-0x00007FF8C66A0000-0x00007FF8C66B6000-memory.dmp
memory/3960-1310-0x00007FF8CFFD0000-0x00007FF8CFFDC000-memory.dmp
memory/3960-1309-0x00007FF8C6A00000-0x00007FF8C6A12000-memory.dmp
memory/3960-1308-0x00007FF8D01B0000-0x00007FF8D01BB000-memory.dmp
memory/3960-1306-0x00007FF8C2760000-0x00007FF8C2813000-memory.dmp
memory/3960-1305-0x00007FF8C66C0000-0x00007FF8C6700000-memory.dmp
memory/3960-1304-0x00007FF8D16D0000-0x00007FF8D16DB000-memory.dmp
memory/3960-1292-0x00007FF8BDE60000-0x00007FF8BE4C9000-memory.dmp
memory/3960-1302-0x00007FF8C63E0000-0x00007FF8C64AE000-memory.dmp
memory/3960-1301-0x00007FF8C6960000-0x00007FF8C6993000-memory.dmp
memory/3960-1300-0x00007FF8D2A80000-0x00007FF8D2A8D000-memory.dmp
memory/3960-1322-0x00007FF8C0B10000-0x00007FF8C0B7B000-memory.dmp
memory/3960-1297-0x00007FF8C7930000-0x00007FF8C7946000-memory.dmp
memory/3960-1296-0x00007FF8C8A10000-0x00007FF8C8A3B000-memory.dmp
memory/3960-1295-0x00007FF8C8A40000-0x00007FF8C8A5A000-memory.dmp
memory/3960-1294-0x00007FF8D4D70000-0x00007FF8D4D7F000-memory.dmp
memory/3960-1303-0x00007FF8D28D0000-0x00007FF8D28DD000-memory.dmp
memory/3960-1299-0x00007FF8C6A20000-0x00007FF8C6A39000-memory.dmp
memory/3960-1293-0x00007FF8C8A60000-0x00007FF8C8A87000-memory.dmp
memory/3960-1204-0x00007FF8C6A20000-0x00007FF8C6A39000-memory.dmp
memory/3960-1200-0x00007FF8BD920000-0x00007FF8BDE53000-memory.dmp
memory/3960-1198-0x00007FF8C7930000-0x00007FF8C7946000-memory.dmp
memory/3960-1194-0x00007FF8C8A10000-0x00007FF8C8A3B000-memory.dmp
memory/3960-1192-0x00007FF8C8A40000-0x00007FF8C8A5A000-memory.dmp
memory/3960-1188-0x00007FF8D4D70000-0x00007FF8D4D7F000-memory.dmp
memory/3960-1186-0x00007FF8C8A60000-0x00007FF8C8A87000-memory.dmp
memory/3960-1178-0x00007FF8BDE60000-0x00007FF8BE4C9000-memory.dmp