Analysis
- max time kernel
151s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 08:15
General
- Target install_c0b016.exe
- Size 53.8MB
- Sample260809-j5wlfaxtfx
- SHA256 968f3dec08c015ecfd3f544d40a3e857afcf2224203bd52d91293ab65ad962d8
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Drops file in System32 directory 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 5 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\install_c0b016.exe"C:\Users\Admin\AppData\Local\Temp\install_c0b016.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Public\QQ7qfr\PUYlNC.exe"C:\Users\Public\QQ7qfr\PUYlNC.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
PUYlNC.exe
UxEnhance64.dll
adoresd.dat
msadox.tb
memory/5156-1-0x0000000005490000-0x000000000549D000-memory.dmp
memory/5156-2-0x00000000054A0000-0x00000000054AB000-memory.dmp
memory/5156-504-0x00007FF927120000-0x00007FF927132000-memory.dmp
memory/5156-524-0x0000000005490000-0x000000000549D000-memory.dmp
memory/5156-525-0x00007FF927120000-0x00007FF927132000-memory.dmp
memory/5156-0-0x0000000005490000-0x000000000549D000-memory.dmp
memory/5996-537-0x0000019B2BEF0000-0x0000019B2C781000-memory.dmp
memory/5996-550-0x0000019B296E0000-0x0000019B29BFE000-memory.dmp
memory/5996-531-0x00007FF92FA70000-0x00007FF92FA72000-memory.dmp
memory/5996-539-0x00007FF92FA80000-0x00007FF92FA82000-memory.dmp
memory/5996-540-0x0000019B2BEF0000-0x0000019B2C781000-memory.dmp
memory/5996-544-0x0000019B2BEF0000-0x0000019B2C781000-memory.dmp
memory/5996-545-0x0000019B2BEF0000-0x0000019B2C781000-memory.dmp
memory/5996-546-0x0000019B2BEF0000-0x0000019B2C781000-memory.dmp
memory/5996-547-0x0000019B2BEF0000-0x0000019B2C781000-memory.dmp
memory/5996-532-0x0000019B296E0000-0x0000019B29BFE000-memory.dmp
memory/5996-552-0x0000019B2BEF0000-0x0000019B2C781000-memory.dmp
memory/5996-558-0x0000019B2B4E0000-0x0000019B2B52E000-memory.dmp
memory/5996-563-0x0000019B2C870000-0x0000019B2C8FA000-memory.dmp
memory/5996-562-0x0000019B2C870000-0x0000019B2C8FA000-memory.dmp
memory/5996-561-0x0000019B2C870000-0x0000019B2C8FA000-memory.dmp
memory/5996-560-0x0000019B2C870000-0x0000019B2C8FA000-memory.dmp
memory/5996-565-0x0000019B2BEF0000-0x0000019B2C781000-memory.dmp