Analysis
- max time kernel
150s - max time network
138s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/08/2026, 04:48
General
- Target d5568ed2823323de4d6ba21160b5ce75a90106059b0c6e1d24679fddcd1d132d.exe
- Size 1.2MB
- Sample260810-ffjnss1fng
- SHA256 d5568ed2823323de4d6ba21160b5ce75a90106059b0c6e1d24679fddcd1d132d
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 4 IoCs
- Drops file in System32 directory 3 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5568ed2823323de4d6ba21160b5ce75a90106059b0c6e1d24679fddcd1d132d.exe"C:\Users\Admin\AppData\Local\Temp\d5568ed2823323de4d6ba21160b5ce75a90106059b0c6e1d24679fddcd1d132d.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\NetworkService\NetHost\NetHostAgent.exe"C:\Users\Admin\AppData\Local\NetworkService\NetHost\NetHostAgent.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\LengHu\NetHostAgent.exeC:\Windows\System32\LengHu\NetHostAgent.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
NetHostAgent.exe
soui3.dll
utilities.dll
memory/1656-158-0x0000000180000000-0x0000000180035000-memory.dmp
memory/1656-165-0x0000000180000000-0x0000000180035000-memory.dmp
memory/1656-172-0x0000000180000000-0x0000000180035000-memory.dmp
memory/1656-111-0x0000000180000000-0x0000000180035000-memory.dmp
memory/1656-112-0x0000000180000000-0x0000000180035000-memory.dmp
memory/1656-116-0x0000000180000000-0x0000000180035000-memory.dmp
memory/1656-157-0x0000000180000000-0x0000000180035000-memory.dmp
memory/1656-98-0x000001FCD9DE0000-0x000001FCD9DE3000-memory.dmp
memory/1656-174-0x00007FFFDC5C0000-0x00007FFFDC823000-memory.dmp
memory/1656-21-0x00007FFFDC5C0000-0x00007FFFDC823000-memory.dmp
memory/1656-168-0x0000000180000000-0x0000000180035000-memory.dmp
memory/1656-169-0x0000000180000000-0x0000000180035000-memory.dmp
memory/1656-138-0x0000000180000000-0x0000000180035000-memory.dmp
memory/1656-139-0x0000000180000000-0x0000000180035000-memory.dmp
memory/1656-113-0x0000000180000000-0x0000000180035000-memory.dmp
memory/1656-114-0x0000000180000000-0x0000000180035000-memory.dmp
memory/1656-110-0x0000000180000000-0x0000000180035000-memory.dmp
memory/1656-99-0x00007FFFDC5C0000-0x00007FFFDC823000-memory.dmp
memory/4412-56-0x0000000180000000-0x0000000180035000-memory.dmp
memory/4412-34-0x0000000180000000-0x0000000180035000-memory.dmp
memory/4412-83-0x0000000180000000-0x0000000180035000-memory.dmp
memory/4412-87-0x0000000180000000-0x0000000180035000-memory.dmp
memory/4412-93-0x0000000180000000-0x0000000180035000-memory.dmp
memory/4412-95-0x0000000180000000-0x0000000180035000-memory.dmp
memory/4412-96-0x0000000180000000-0x0000000180035000-memory.dmp
memory/4412-97-0x0000000180000000-0x0000000180035000-memory.dmp
memory/4412-72-0x0000000180000000-0x0000000180035000-memory.dmp
memory/4412-69-0x0000000180000000-0x0000000180035000-memory.dmp
memory/4412-68-0x0000000180000000-0x0000000180035000-memory.dmp
memory/4412-64-0x0000000180000000-0x0000000180035000-memory.dmp
memory/4412-33-0x0000000180000000-0x0000000180035000-memory.dmp
memory/4412-81-0x0000000180000000-0x0000000180035000-memory.dmp
memory/4412-35-0x0000000180000000-0x0000000180035000-memory.dmp
memory/4412-36-0x0000000180000000-0x0000000180035000-memory.dmp
memory/4412-37-0x0000000180000000-0x0000000180035000-memory.dmp
memory/4412-57-0x0000000180000000-0x0000000180035000-memory.dmp
memory/4412-40-0x0000000180000000-0x0000000180035000-memory.dmp
memory/4412-38-0x0000000180000000-0x0000000180035000-memory.dmp
memory/4412-26-0x0000000180000000-0x0000000180035000-memory.dmp
memory/4412-24-0x000001A999760000-0x000001A999790000-memory.dmp
memory/4412-23-0x000001A999720000-0x000001A999723000-memory.dmp
memory/4412-22-0x00007FFFDC71F000-0x00007FFFDC720000-memory.dmp
memory/4412-17-0x00007FFFDC5C0000-0x00007FFFDC823000-memory.dmp