Overview

overview

10

Static

static

3

TradingVie...ed.exe

windows11-21h2-x64

10

TradingVie...ed.exe

windows11-ltsc_2024-x64

7

Resubmissions

12/08/2026, 05:45

260812-gf2eaawyet10

12/08/2026, 05:32

260812-f8sgeaaf5510

Analysis

  • max time kernel
    30s
  • max time network
    30s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/08/2026, 05:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    TradingView Premium Desktop_patched.exe
  • Size 3.6MB
  • Sample260812-gf2eaawyet
  • SHA256 a31d36bc01708fdd740b54f82a8c5ab7caa3b599e7ad0e6d63d6caccd98c6103
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
executionpersistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Executes a command shell one-liner 1 TTPs 5 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TradingView Premium Desktop_patched.exe
    "C:\Users\Admin\AppData\Local\Temp\TradingView Premium Desktop_patched.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4240
    • C:\Windows\SYSTEM32\at.exe
      at.exe djhfjshdf937826457862398347
      2⤵
        PID:4912
      • C:\Windows\SYSTEM32\cmd.exe
        cmd /c NhLMpXW & type Shall.potm | %comspec%
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4452
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" type Shall.potm "
          3⤵
            PID:1132
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1320
            • C:\Windows\system32\cmd.exe
              cmd /c set /p ="MZ"
              4⤵
              • Executes a command shell one-liner
              PID:1228
            • C:\Windows\system32\cmd.exe
              cmd /c findstr /V "BUTTON" Protecting
              4⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:4220
              • C:\Windows\system32\findstr.exe
                findstr /V "BUTTON" Protecting
                5⤵
                  PID:5480
              • C:\Windows\system32\cmd.exe
                cmd /c copy /b /y 275115\Minister.exe + Reg + Award + Sony 275115\Minister.exe
                4⤵
                • Executes a command shell one-liner
                PID:4640
              • C:\Windows\system32\cmd.exe
                cmd /c copy /b /y ..\Ferry.potm f
                4⤵
                • Executes a command shell one-liner
                PID:2196
              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\275115\Minister.exe
                Minister.exe f
                4⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:4836

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              Minister.exe
              • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\275115\Minister.exe
              • Size 1.1MB
              • SHA256 881619a47b62b52305d92640cc4d4845a279c23a5a749413785fc8fcb0fdf7fb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Award
              • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Award
              • Size 453KB
              • SHA256 41029c728d89342b93db00f1c1be64be25c27e7d73a01e5daaa55d25132e8bcf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Ferry.potm
              • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ferry.potm
              • Size 1.9MB
              • SHA256 d9f9d53003c197d75d0abebf907e8f676b937a19798ce732df0b905f7068ac68
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Protecting
              • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Protecting
              • Size 1KB
              • SHA256 1f54cedbaf3f664332655e1dc27f2b0d442deaefe1188fbab103b097bb767257
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Reg
              • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Reg
              • Size 435KB
              • SHA256 74a7882ff750454191c0fd0f87e9a105d0505f940ca02093d99c3d9c3965b271
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Shall.potm
              • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Shall.potm
              • Size 12KB
              • SHA256 03a34fd9f86f04c24665be18fc37aa63ba9156e34884b2e48fa7aa1f63af8d77
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Sony
              • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sony
              • Size 193KB
              • SHA256 72f3dcffc45c83783b81e271318c57e0467b48cb78bd5237a7e49913b0f0d52c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download