Analysis
- max time kernel
148s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 04:20
General
- Target SHINEEX PRIVATE.exe
- Size 5.8MB
- Sample260809-eyjabagf52
- SHA256 4178a36a1dd59353a70a9d72be5dc74706c08a32a2ddbdbbadf93fe98653596a
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Obfuscated with Agile.Net obfuscator 64 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SHINEEX PRIVATE.exe"C:\Users\Admin\AppData\Local\Temp\SHINEEX PRIVATE.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c start cmd /C "color b && title Error && echo Connection failure. Please try again, or contact us for help. && timeout /t 5"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /C "color b && title Error && echo Connection failure. Please try again, or contact us for help. && timeout /t 5"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /t 54⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc1⤵
- Checks processor information in registry
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
GunaDotNetRT64.dll
memory/6136-0-0x00007FF845DBF000-0x00007FF845DC0000-memory.dmp
memory/6136-1-0x000002034FFD0000-0x00000203505A2000-memory.dmp
memory/6136-2-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
memory/6136-3-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
memory/6136-4-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
memory/6136-5-0x000002036B720000-0x000002036B96C000-memory.dmp
memory/6136-18-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-24-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-27-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-22-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-20-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-14-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-12-0x00007FF849D00000-0x00007FF849E2F000-memory.dmp
memory/6136-87-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
memory/6136-75-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-17-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-13-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-30-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-33-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-29-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-38-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-36-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-34-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-56-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-54-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-52-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-58-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-50-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-48-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-60-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-62-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-46-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-44-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-42-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-40-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-64-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-137-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-135-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-133-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-131-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-130-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-127-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-125-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-123-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-121-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-119-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-118-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-115-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-113-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-111-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-109-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-105-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-94-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-92-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-86-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-101-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-97-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-108-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-95-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-103-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-100-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-84-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-82-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-80-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-78-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-77-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-72-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-89-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-70-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-68-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-66-0x000002036B720000-0x000002036B966000-memory.dmp
memory/6136-10438-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
memory/6136-10439-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
memory/6136-10440-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
memory/6136-10441-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
memory/6136-10443-0x00007FF858900000-0x00007FF858927000-memory.dmp
memory/6136-10442-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
memory/6136-10444-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
memory/6136-10445-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
memory/6136-10446-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
memory/6136-10447-0x000002036BA70000-0x000002036BA82000-memory.dmp
memory/6136-10448-0x000002036EB60000-0x000002036EBD6000-memory.dmp
memory/6136-10449-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
memory/6136-10450-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
memory/6136-10451-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
memory/6136-10453-0x000002036EAE0000-0x000002036EAFE000-memory.dmp
memory/6136-10454-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
memory/6136-10455-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp