Analysis
- user interaction
yes - max time kernel
598s - max time network
366s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
14/08/2026, 03:21
General
- Target FatalityClicker_v8.4.0.exe
- Size 90.2MB
- Sample260814-dwb8jstekf
- SHA256 215879bee3fcadfa83f927abaca80eeac7c7f322f1bf95b3e64d1ab17c4d1878
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Loads dropped DLL 5 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FatalityClicker_v8.4.0.exe"C:\Users\Admin\AppData\Local\Temp\FatalityClicker_v8.4.0.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-CimInstance Win32_DiskDrive | Where-Object { $_.Index -eq 0 }).SerialNumber"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_aoeqfbnq.dg1.ps1
evb85E5.tmp
evb8CCC.tmp
evb8EF0.tmp
evb8F00.tmp
evb91B1.tmp
memory/3092-65-0x000001B275290000-0x000001B2752B4000-memory.dmp
memory/3092-64-0x000001B275290000-0x000001B2752BA000-memory.dmp
memory/3092-57-0x000001B25D100000-0x000001B25D122000-memory.dmp
memory/4432-25-0x0000000003C70000-0x0000000003D50000-memory.dmp
memory/4432-58-0x0000000140000000-0x0000000140250000-memory.dmp
memory/4432-14-0x00000000029A0000-0x0000000003C70000-memory.dmp
memory/4432-31-0x0000000003D50000-0x00000000052B4000-memory.dmp
memory/4432-40-0x0000000003C70000-0x0000000003D50000-memory.dmp
memory/4432-48-0x00000000052C0000-0x000000000537B000-memory.dmp
memory/4432-46-0x00000000052C0000-0x000000000537B000-memory.dmp
memory/4432-0-0x0000000140000000-0x0000000140250000-memory.dmp
memory/4432-37-0x0000000003D50000-0x00000000052B4000-memory.dmp
memory/4432-27-0x0000000003C70000-0x0000000003D50000-memory.dmp
memory/4432-5-0x0000000180000000-0x00000001846D8000-memory.dmp
memory/4432-18-0x00000000029A0000-0x0000000003C70000-memory.dmp
memory/4432-63-0x00000000052C0000-0x000000000537B000-memory.dmp
memory/4432-62-0x0000000003D50000-0x00000000052B4000-memory.dmp
memory/4432-60-0x00000000029A0000-0x0000000003C70000-memory.dmp
memory/4432-59-0x0000000180000000-0x00000001846D8000-memory.dmp
memory/4432-4-0x00007FF945350000-0x00007FF945545000-memory.dmp
memory/4432-1-0x00007FF9453ED000-0x00007FF9453EE000-memory.dmp
memory/4432-69-0x00007FF945350000-0x00007FF945545000-memory.dmp
memory/4432-68-0x0000000140000000-0x0000000140250000-memory.dmp
memory/4432-70-0x0000000140000000-0x0000000140250000-memory.dmp
memory/4432-184-0x0000000140000000-0x0000000140250000-memory.dmp
memory/4432-185-0x0000000180000000-0x00000001846D8000-memory.dmp
memory/4432-238-0x0000000140000000-0x0000000140250000-memory.dmp