Analysis
- max time kernel
599s - max time network
479s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
14/08/2026, 03:21
General
- Target FatalityClicker_v8.4.0.exe
- Size 90.2MB
- Sample260814-dwb8jstekf
- SHA256 215879bee3fcadfa83f927abaca80eeac7c7f322f1bf95b3e64d1ab17c4d1878
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Loads dropped DLL 5 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FatalityClicker_v8.4.0.exe"C:\Users\Admin\AppData\Local\Temp\FatalityClicker_v8.4.0.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-CimInstance Win32_DiskDrive | Where-Object { $_.Index -eq 0 }).SerialNumber"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
evbC626.tmp
evbCA1E.tmp
evbCD3C.tmp
evbCD3D.tmp
evbD0C8.tmp
memory/4360-60-0x000001B952EB0000-0x000001B952EDA000-memory.dmp
memory/4360-61-0x000001B952EB0000-0x000001B952ED4000-memory.dmp
memory/4360-59-0x000001B9529B0000-0x000001B9529BA000-memory.dmp
memory/4360-57-0x000001B952A40000-0x000001B952A5E000-memory.dmp
memory/4360-58-0x000001B952A60000-0x000001B952B12000-memory.dmp
memory/4360-54-0x000001B9529D0000-0x000001B9529F2000-memory.dmp
memory/6512-28-0x0000000002570000-0x0000000002650000-memory.dmp
memory/6512-6-0x0000000180000000-0x00000001846D8000-memory.dmp
memory/6512-32-0x0000000002570000-0x0000000002650000-memory.dmp
memory/6512-19-0x0000000003460000-0x0000000004730000-memory.dmp
memory/6512-35-0x0000000004730000-0x0000000005C94000-memory.dmp
memory/6512-40-0x0000000004730000-0x0000000005C94000-memory.dmp
memory/6512-50-0x0000000002650000-0x000000000270B000-memory.dmp
memory/6512-48-0x0000000002650000-0x000000000270B000-memory.dmp
memory/6512-26-0x0000000002570000-0x0000000002650000-memory.dmp
memory/6512-14-0x0000000003460000-0x0000000004730000-memory.dmp
memory/6512-0-0x0000000140000000-0x0000000140250000-memory.dmp
memory/6512-31-0x0000000003460000-0x0000000004730000-memory.dmp
memory/6512-4-0x00007FFD11240000-0x00007FFD114A3000-memory.dmp
memory/6512-5-0x00007FFD11240000-0x00007FFD114A3000-memory.dmp
memory/6512-1-0x00007FFD1139F000-0x00007FFD113A0000-memory.dmp
memory/6512-63-0x0000000140000000-0x0000000140250000-memory.dmp
memory/6512-67-0x0000000004730000-0x0000000005C94000-memory.dmp
memory/6512-68-0x0000000002650000-0x000000000270B000-memory.dmp
memory/6512-64-0x0000000180000000-0x00000001846D8000-memory.dmp
memory/6512-69-0x00007FFD11240000-0x00007FFD114A3000-memory.dmp
memory/6512-70-0x0000000140000000-0x0000000140250000-memory.dmp
memory/6512-82-0x0000000140000000-0x0000000140250000-memory.dmp
memory/6512-142-0x0000000140000000-0x0000000140250000-memory.dmp
memory/6512-143-0x0000000180000000-0x00000001846D8000-memory.dmp