Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/08/2026, 18:13
General
- Target 88287f70307150fc1f469bf08e49dee581cdce1900dcf477a08d010e90fef57d.exe
- Size 806KB
- Sample260810-wt7wjsen5x
- SHA256 88287f70307150fc1f469bf08e49dee581cdce1900dcf477a08d010e90fef57d
Malware Config
Signatures
- Badlisted process makes network request 10 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\88287f70307150fc1f469bf08e49dee581cdce1900dcf477a08d010e90fef57d.exe"C:\Users\Admin\AppData\Local\Temp\88287f70307150fc1f469bf08e49dee581cdce1900dcf477a08d010e90fef57d.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle 1 "$Wolframet=GC -raw 'C:\Users\Admin\AppData\Local\Witnessers153\raabte\amuletters\Undvrligst130.Gul';$Canangium=$Wolframet.SubString(29282,3);.$Canangium($Wolframet)"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
transudes.jpg
Undvrligst130.Gul
prisniveaus.Kas
memory/4896-68-0x0000000001C20000-0x000000000268F000-memory.dmp
memory/4896-67-0x0000000000930000-0x0000000001C16000-memory.dmp
memory/4896-66-0x0000000001C20000-0x000000000268F000-memory.dmp
memory/6052-36-0x0000000007A10000-0x0000000007A46000-memory.dmp
memory/6052-47-0x0000000007D40000-0x0000000007D50000-memory.dmp
memory/6052-23-0x0000000006030000-0x0000000006096000-memory.dmp
memory/6052-27-0x00000000061B0000-0x000000000650B000-memory.dmp
memory/6052-28-0x00000000065F0000-0x000000000660E000-memory.dmp
memory/6052-29-0x0000000006650000-0x000000000669C000-memory.dmp
memory/6052-32-0x0000000006B70000-0x0000000006B92000-memory.dmp
memory/6052-31-0x0000000006B00000-0x0000000006B1A000-memory.dmp
memory/6052-30-0x00000000078B0000-0x0000000007946000-memory.dmp
memory/6052-33-0x0000000007F10000-0x00000000084CA000-memory.dmp
memory/6052-22-0x0000000005820000-0x0000000005842000-memory.dmp
memory/6052-35-0x0000000008B50000-0x00000000091CC000-memory.dmp
memory/6052-41-0x0000000007A50000-0x0000000007A70000-memory.dmp
memory/6052-38-0x0000000070290000-0x00000000702DC000-memory.dmp
memory/6052-42-0x00000000738F0000-0x00000000740AC000-memory.dmp
memory/6052-43-0x00000000738F0000-0x00000000740AC000-memory.dmp
memory/6052-44-0x0000000007AA0000-0x0000000007B43000-memory.dmp
memory/6052-37-0x00000000738F0000-0x00000000740AC000-memory.dmp
memory/6052-20-0x0000000005870000-0x0000000005EBA000-memory.dmp
memory/6052-45-0x0000000007BA0000-0x0000000007BAA000-memory.dmp
memory/6052-46-0x0000000007D20000-0x0000000007D31000-memory.dmp
memory/6052-24-0x00000000060A0000-0x0000000006106000-memory.dmp
memory/6052-48-0x0000000007D50000-0x0000000007D65000-memory.dmp
memory/6052-49-0x0000000007DA0000-0x0000000007DBC000-memory.dmp
memory/6052-50-0x0000000007D90000-0x0000000007D98000-memory.dmp
memory/6052-51-0x0000000007DA0000-0x0000000007DCA000-memory.dmp
memory/6052-52-0x0000000007DE0000-0x0000000007E04000-memory.dmp
memory/6052-53-0x0000000073902000-0x0000000073903000-memory.dmp
memory/6052-54-0x00000000738F0000-0x00000000740AC000-memory.dmp
memory/6052-55-0x00000000738F0000-0x00000000740AC000-memory.dmp
memory/6052-56-0x00000000738F0000-0x00000000740AC000-memory.dmp
memory/6052-21-0x00000000738F0000-0x00000000740AC000-memory.dmp
memory/6052-59-0x00000000738F0000-0x00000000740AC000-memory.dmp
memory/6052-60-0x00000000738F0000-0x00000000740AC000-memory.dmp
memory/6052-58-0x00000000091D0000-0x0000000009C3F000-memory.dmp
memory/6052-61-0x00000000738F0000-0x00000000740AC000-memory.dmp
memory/6052-62-0x00000000738F0000-0x00000000740AC000-memory.dmp
memory/6052-63-0x00000000738F0000-0x00000000740AC000-memory.dmp
memory/6052-65-0x00000000738F0000-0x00000000740AC000-memory.dmp
memory/6052-19-0x00000000738F0000-0x00000000740AC000-memory.dmp
memory/6052-18-0x0000000003100000-0x0000000003136000-memory.dmp
memory/6052-17-0x0000000073902000-0x0000000073903000-memory.dmp