Analysis
- max time kernel
149s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 04:19
General
- Target DotsAimPrivate.exe
- Size 4.5MB
- Sample260809-exy95shk9v
- SHA256 19384b705a10d8c7dc142422d86717a47c612f92f0b03cc1fded19d8c0f457bf
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Obfuscated with Agile.Net obfuscator 64 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Delays execution with timeout.exe 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DotsAimPrivate.exe"C:\Users\Admin\AppData\Local\Temp\DotsAimPrivate.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c start cmd /C "color b && title Error && echo SSL assertion fail, make sure you're not debugging Network. Disable internet firewall on router if possible. & echo: & echo If not, ask the developer of the program to use custom domains to fix this. && timeout /t 5"2⤵
- Executes a command shell one-liner
- System Time Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /C "color b && title Error && echo SSL assertion fail, make sure you're not debugging Network. Disable internet firewall on router if possible. & echo: & echo If not, ask the developer of the program to use custom domains to fix this. && timeout /t 5"3⤵
- Executes a command shell one-liner
- System Time Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /t 54⤵
- Delays execution with timeout.exe
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
GunaDotNetRT64.dll
memory/4448-0-0x00007FFDE3F1F000-0x00007FFDE3F20000-memory.dmp
memory/4448-1-0x000002D7C4DB0000-0x000002D7C5228000-memory.dmp
memory/4448-2-0x00007FFDE3D90000-0x00007FFDE4734000-memory.dmp
memory/4448-3-0x00007FFDE3D90000-0x00007FFDE4734000-memory.dmp
memory/4448-4-0x00007FFDE3D90000-0x00007FFDE4734000-memory.dmp
memory/4448-5-0x000002D7E02F0000-0x000002D7E053C000-memory.dmp
memory/4448-9-0x00007FFDE3D90000-0x00007FFDE4734000-memory.dmp
memory/4448-14-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-19-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-35-0x00007FFDE3D90000-0x00007FFDE4734000-memory.dmp
memory/4448-55-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-81-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-79-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-77-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-89-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-87-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-92-0x00007FFDF3590000-0x00007FFDF35B7000-memory.dmp
memory/4448-85-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-83-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-75-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-73-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-71-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-69-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-67-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-65-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-63-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-61-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-59-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-57-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-53-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-51-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-48-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-49-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-45-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-43-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-41-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-39-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-37-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-34-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-32-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-30-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-28-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-27-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-25-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-22-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-18-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-16-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-13-0x00007FFDEF520000-0x00007FFDEF64F000-memory.dmp
memory/4448-21-0x00007FFDE3D90000-0x00007FFDE4734000-memory.dmp
memory/4448-102-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-112-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-114-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-120-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-126-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-138-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-141-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-136-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-134-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-132-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-130-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-128-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-124-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-122-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-118-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-117-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-110-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-108-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-105-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-100-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-98-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-96-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-94-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-91-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-106-0x000002D7E02F0000-0x000002D7E0536000-memory.dmp
memory/4448-1739-0x00007FFDE3D90000-0x00007FFDE4734000-memory.dmp
memory/4448-10614-0x00007FFDE3D90000-0x00007FFDE4734000-memory.dmp
memory/4448-10615-0x00007FFDE3D90000-0x00007FFDE4734000-memory.dmp
memory/4448-10616-0x00007FFDE3D90000-0x00007FFDE4734000-memory.dmp
memory/4448-10617-0x000002D7E0A60000-0x000002D7E0A72000-memory.dmp
memory/4448-10618-0x00007FFDE3D90000-0x00007FFDE4734000-memory.dmp
memory/4448-10619-0x00007FFDE3D90000-0x00007FFDE4734000-memory.dmp
memory/4448-10620-0x00007FFDE3D90000-0x00007FFDE4734000-memory.dmp
memory/4448-10621-0x00007FFDF3590000-0x00007FFDF35B7000-memory.dmp