Analysis
- max time kernel
151s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/08/2026, 17:20
General
- Target EDP-50-ANOS-COMPLETO.scr
- Size 70.4MB
- Sample260812-vwtahaea39
- SHA256 7592e7486790e413d07c14c6bfe74df764724735f230043a33bd23cb808af0c8
Malware Config
Signatures
- Loads dropped DLL 4 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\EDP-50-ANOS-COMPLETO.scr"C:\Users\Admin\AppData\Local\Temp\EDP-50-ANOS-COMPLETO.scr" /S1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
WMSDKNS.XML
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
vcruntime140_cor3.dll
wpfgfx_cor3.dll
memory/1632-77-0x0000025D06C00000-0x0000025D06C20000-memory.dmp
memory/1632-120-0x0000025D0A2C0000-0x0000025D0A2F0000-memory.dmp
memory/1632-29-0x0000025D00440000-0x0000025D00460000-memory.dmp
memory/1632-69-0x0000025D06BA0000-0x0000025D06BE0000-memory.dmp
memory/1632-81-0x0000025D09D50000-0x0000025D09D80000-memory.dmp
memory/1632-5-0x0000025D01210000-0x0000025D01EA0000-memory.dmp
memory/1632-92-0x0000025D09D80000-0x0000025D09DD0000-memory.dmp
memory/1632-91-0x0000025D09F20000-0x0000025D0A030000-memory.dmp
memory/1632-104-0x0000025D0A190000-0x0000025D0A220000-memory.dmp
memory/1632-108-0x0000025D0A0E0000-0x0000025D0A100000-memory.dmp
memory/1632-124-0x0000025D0A220000-0x0000025D0A230000-memory.dmp
memory/1632-140-0x0000025D0C3D0000-0x0000025D0C420000-memory.dmp
memory/1632-132-0x0000025D0C2C0000-0x0000025D0C380000-memory.dmp
memory/1632-25-0x0000025D06630000-0x0000025D06910000-memory.dmp
memory/1632-21-0x0000025D05940000-0x0000025D06630000-memory.dmp
memory/1632-149-0x0000025D0CA50000-0x0000025D0CAC0000-memory.dmp
memory/1632-136-0x0000025D0A3D0000-0x0000025D0A3F0000-memory.dmp
memory/1632-13-0x0000025D022F0000-0x0000025D02520000-memory.dmp
memory/1632-128-0x0000025D0C150000-0x0000025D0C1A0000-memory.dmp
memory/1632-33-0x0000025D00500000-0x0000025D00540000-memory.dmp
memory/1632-160-0x0000025D0A300000-0x0000025D0A310000-memory.dmp
memory/1632-116-0x0000025D0A250000-0x0000025D0A270000-memory.dmp
memory/1632-112-0x0000025D06C80000-0x0000025D06C90000-memory.dmp
memory/1632-96-0x0000025D0ABB0000-0x0000025D0B350000-memory.dmp
memory/1632-100-0x0000025D0A090000-0x0000025D0A0C0000-memory.dmp
memory/1632-17-0x0000025D04660000-0x0000025D047C0000-memory.dmp
memory/1632-73-0x0000025D04BA0000-0x0000025D04BC0000-memory.dmp
memory/1632-65-0x0000025D06B10000-0x0000025D06B60000-memory.dmp
memory/1632-61-0x0000025D04B60000-0x0000025D04B80000-memory.dmp
memory/1632-57-0x0000025D02770000-0x0000025D02790000-memory.dmp
memory/1632-53-0x0000025D00540000-0x0000025D00550000-memory.dmp
memory/1632-49-0x0000025D026C0000-0x0000025D026E0000-memory.dmp
memory/1632-45-0x0000025D04AA0000-0x0000025D04B20000-memory.dmp
memory/1632-37-0x0000025D074C0000-0x0000025D07CF0000-memory.dmp
memory/1632-41-0x0000025D00490000-0x0000025D004B0000-memory.dmp
memory/1632-9-0x0000025D03700000-0x0000025D04660000-memory.dmp
memory/1632-168-0x0000025D07CF0000-0x0000025D07F8E000-memory.dmp
memory/1632-169-0x0000025D0C420000-0x0000025D0C5EA000-memory.dmp