Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
14/08/2026, 09:09
General
- Target d593ddbfe63dbf2b738f9a64619fbb720fab9f79facdeedc24b2c6960121b1a4.exe
- Size 1.4MB
- Sample260814-k4p8psgn7v
- SHA256 d593ddbfe63dbf2b738f9a64619fbb720fab9f79facdeedc24b2c6960121b1a4
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d593ddbfe63dbf2b738f9a64619fbb720fab9f79facdeedc24b2c6960121b1a4.exe"C:\Users\Admin\AppData\Local\Temp\d593ddbfe63dbf2b738f9a64619fbb720fab9f79facdeedc24b2c6960121b1a4.exe"1⤵
- Creates a file in the Startup directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3592-2049-0x0000000000700000-0x00000000007AC000-memory.dmp
memory/3592-2051-0x0000000004D40000-0x0000000004DCE000-memory.dmp
memory/3592-2052-0x00000000745D0000-0x0000000074D8C000-memory.dmp
memory/3592-2055-0x0000000005130000-0x0000000005138000-memory.dmp
memory/3592-2054-0x00000000745D0000-0x0000000074D8C000-memory.dmp
memory/3592-2058-0x00000000745D0000-0x0000000074D8C000-memory.dmp
memory/3592-2057-0x0000000005340000-0x00000000053A6000-memory.dmp
memory/3592-2053-0x0000000004FD0000-0x0000000005112000-memory.dmp
memory/4716-77-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-47-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-4-0x00000000053B0000-0x000000000596A000-memory.dmp
memory/4716-11-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-21-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-35-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-55-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-91-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-103-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-109-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-131-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-129-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-71-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-125-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-123-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-121-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-119-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-117-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-115-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-113-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-111-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-107-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-105-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-101-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-99-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-97-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-95-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-93-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-89-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-87-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-85-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-83-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-80-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-82-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-3-0x0000000004C30000-0x0000000004D8E000-memory.dmp
memory/4716-75-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-127-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-5-0x0000000004ED0000-0x0000000004F62000-memory.dmp
memory/4716-39-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-67-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-65-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-64-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-61-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-59-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-57-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-53-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-50-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-69-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-45-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-43-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-41-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-51-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-74-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-37-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-33-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-31-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-29-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-27-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-25-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-23-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-19-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-17-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-15-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-6-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-13-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-9-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-7-0x0000000004C30000-0x0000000004D89000-memory.dmp
memory/4716-2042-0x0000000004FC0000-0x0000000005084000-memory.dmp
memory/4716-2043-0x00000000050A0000-0x00000000050EC000-memory.dmp
memory/4716-2-0x00000000745D0000-0x0000000074D8C000-memory.dmp
memory/4716-2045-0x00000000745E2000-0x00000000745E3000-memory.dmp
memory/4716-2046-0x00000000745D0000-0x0000000074D8C000-memory.dmp
memory/4716-2050-0x00000000745D0000-0x0000000074D8C000-memory.dmp
memory/4716-2056-0x00000000745D0000-0x0000000074D8C000-memory.dmp
memory/4716-1-0x0000000000170000-0x00000000002D4000-memory.dmp
memory/4716-0-0x00000000745E2000-0x00000000745E3000-memory.dmp