Resubmissions
13/08/2026, 17:45
260813-wbr3dadj3w813/08/2026, 17:42
260813-v925katyf1313/08/2026, 17:31
260813-v3wdfacr2y8Analysis
- max time kernel
184s - max time network
173s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
13/08/2026, 17:45
General
- Target cats.exe
- Size 73.0MB
- Sample260813-wbr3dadj3w
- SHA256 295784caefa5e7199326e1fe29ba9fb6d63507538ebf24d5f5344965dc1d1dad
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 6 IoCs
- Loads dropped DLL 64 IoCs
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 6 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 26 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\cats.exe"C:\Users\Admin\AppData\Local\Temp\cats.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cats.exe"C:\Users\Admin\AppData\Local\Temp\cats.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /query3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn TelemetrySync /tr \"C:\Users\Admin\AppData\Roaming/SystemInformer\InformerUpdate.exe\" /sc onlogon /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\SystemInformer\InformerUpdate.exeC:\Users\Admin\AppData\Roaming/SystemInformer\InformerUpdate.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SystemInformer\InformerUpdate.exeC:\Users\Admin\AppData\Roaming/SystemInformer\InformerUpdate.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Roaming\SystemInformer\InformerUpdate.exe"C:\Users\Admin\AppData\Roaming/SystemInformer\InformerUpdate.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SystemInformer\InformerUpdate.exe"C:\Users\Admin\AppData\Roaming/SystemInformer\InformerUpdate.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ConfigService\SysSettingSvc.exeC:\Users\Admin\AppData\Roaming/Microsoft/Windows/ConfigService\SysSettingSvc.exe3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ConfigService\SysSettingSvc.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\ConfigService\SysSettingSvc.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004B8 0x00000000000004DC1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
InformerUpdate.exe
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
base_library.zip
libcrypto-1_1.dll
libffi-7.dll
_psutil_windows.pyd
python3.DLL
python310.dll
select.pyd
unicodedata.pyd
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_lzma.pyd
_socket.pyd
base_library.zip
libffi-8.dll
_psutil_windows.pyd
python3.DLL
python312.dll
select.pyd
ucrtbase.dll
memory/1076-372-0x00007FF72B950000-0x00007FF72F596000-memory.dmp
memory/1076-321-0x00007FF72B950000-0x00007FF72F596000-memory.dmp
memory/4876-69-0x00007FF9A4E80000-0x00007FF9A5824000-memory.dmp
memory/4876-57-0x00007FF9A4E80000-0x00007FF9A5824000-memory.dmp
memory/4876-71-0x00007FF9A4E80000-0x00007FF9A5824000-memory.dmp
memory/4876-72-0x00007FF9A4E80000-0x00007FF9A5824000-memory.dmp
memory/4876-73-0x00007FF9A4E80000-0x00007FF9A5824000-memory.dmp
memory/4876-75-0x00007FF9A4E80000-0x00007FF9A5824000-memory.dmp
memory/4876-60-0x00007FF9A4E80000-0x00007FF9A5824000-memory.dmp
memory/4876-68-0x000002C323FA0000-0x000002C323FAA000-memory.dmp
memory/4876-59-0x00007FF9A4E80000-0x00007FF9A5824000-memory.dmp
memory/4876-66-0x000002C323EC0000-0x000002C323EDE000-memory.dmp
memory/4876-58-0x00007FF9A4E80000-0x00007FF9A5824000-memory.dmp
memory/4876-70-0x00007FF9A4E80000-0x00007FF9A5824000-memory.dmp
memory/4876-56-0x00007FF9A4E80000-0x00007FF9A5824000-memory.dmp
memory/4876-55-0x000002C323C60000-0x000002C323C82000-memory.dmp
memory/4876-54-0x00007FF9A4E80000-0x00007FF9A5824000-memory.dmp
memory/4876-51-0x00007FF9A500F000-0x00007FF9A5010000-memory.dmp
memory/4876-67-0x000002C323EE0000-0x000002C323F92000-memory.dmp
memory/4876-63-0x00007FF9A4E80000-0x00007FF9A5824000-memory.dmp
memory/4876-62-0x00007FF9A4E80000-0x00007FF9A5824000-memory.dmp
memory/4876-61-0x00007FF9A4E80000-0x00007FF9A5824000-memory.dmp
memory/5316-323-0x00007FF995070000-0x00007FF999F22000-memory.dmp
memory/5316-322-0x00007FF72B950000-0x00007FF72F596000-memory.dmp