Analysis
- max time kernel
149s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
11/08/2026, 02:56
General
- Target c2efaf69e47d5b10189f0b18d072b65f81e6751482ece8d75bb87511417a700c.exe
- Size 868KB
- Sample260811-dfbxvathkd
- SHA256 c2efaf69e47d5b10189f0b18d072b65f81e6751482ece8d75bb87511417a700c
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2efaf69e47d5b10189f0b18d072b65f81e6751482ece8d75bb87511417a700c.exe"C:\Users\Admin\AppData\Local\Temp\c2efaf69e47d5b10189f0b18d072b65f81e6751482ece8d75bb87511417a700c.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/548-0-0x00007FF914D7F000-0x00007FF914D80000-memory.dmp
memory/548-1-0x0000000000500000-0x00000000005E0000-memory.dmp
memory/548-2-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/548-3-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/548-4-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/548-5-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/548-6-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/548-7-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/548-8-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/548-9-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/548-10-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/548-11-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/548-12-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/548-13-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/548-14-0x00007FF914BF0000-0x00007FF915594000-memory.dmp
memory/548-15-0x00007FF914BF0000-0x00007FF915594000-memory.dmp