Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 18:14
General
- Target install_c0b016.exe
- Size 40.7MB
- Sample260809-wvss1stbne
- SHA256 b5b50d55bd03826dbbc6b0c974cb6725046ff1dd79ec7005fd465ee84b84b228
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious behavior: EnumeratesProcesses 38 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\install_c0b016.exe"C:\Users\Admin\AppData\Local\Temp\install_c0b016.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Users\Public\qkIlOb\1ygpsO.exe"C:\Users\Public\qkIlOb\1ygpsO.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
1ygpsO.exe
UxEnhance64.dll
adoresd.dat
msadox.tb
memory/1652-540-0x00007FF9066A0000-0x00007FF9066A2000-memory.dmp
memory/1652-541-0x000001D640130000-0x000001D6409C1000-memory.dmp
memory/1652-548-0x000001D640130000-0x000001D6409C1000-memory.dmp
memory/1652-532-0x00007FF906690000-0x00007FF906692000-memory.dmp
memory/1652-547-0x000001D640130000-0x000001D6409C1000-memory.dmp
memory/1652-533-0x00007FF8E3740000-0x00007FF8E3C5E000-memory.dmp
memory/1652-546-0x000001D640130000-0x000001D6409C1000-memory.dmp
memory/1652-538-0x000001D640130000-0x000001D6409C1000-memory.dmp
memory/1652-545-0x000001D640130000-0x000001D6409C1000-memory.dmp
memory/3200-0-0x00000000004D0000-0x00000000004DE000-memory.dmp
memory/3200-526-0x00007FF8FA980000-0x00007FF8FA992000-memory.dmp
memory/3200-1-0x00000000004F0000-0x00000000004FC000-memory.dmp
memory/3200-503-0x00007FF8FA980000-0x00007FF8FA992000-memory.dmp
memory/3200-525-0x00000000004D0000-0x00000000004DE000-memory.dmp