Analysis
- max time kernel
148s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
14/08/2026, 09:12
General
- Target edfcce66ccde72dc5a38d4ef5d0ca3206ec3c319586173f4b2d209d724ae6183.exe
- Size 1.3MB
- Sample260814-k6b4vsgp31
- SHA256 edfcce66ccde72dc5a38d4ef5d0ca3206ec3c319586173f4b2d209d724ae6183
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\edfcce66ccde72dc5a38d4ef5d0ca3206ec3c319586173f4b2d209d724ae6183.exe"C:\Users\Admin\AppData\Local\Temp\edfcce66ccde72dc5a38d4ef5d0ca3206ec3c319586173f4b2d209d724ae6183.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/784-0-0x0000000000400000-0x0000000000462000-memory.dmp
memory/784-1-0x00000000749F2000-0x00000000749F3000-memory.dmp
memory/784-2-0x00000000749E0000-0x000000007519C000-memory.dmp
memory/784-3-0x0000000004F50000-0x0000000004FE8000-memory.dmp
memory/784-7-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-130-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-111-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-101-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-99-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-45-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-128-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-126-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-122-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-119-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-117-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-115-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-113-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-109-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-107-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-105-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-103-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-97-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-95-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-93-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-91-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-88-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-85-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-83-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-82-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-75-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-72-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-67-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-65-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-63-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-61-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-59-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-57-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-55-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-53-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-51-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-49-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-47-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-43-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-42-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-39-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-38-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-35-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-33-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-31-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-29-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-28-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-25-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-23-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-22-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-19-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-17-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-16-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-14-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-11-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-9-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-5-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-4-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-123-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-78-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-79-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-73-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-69-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/784-2068-0x0000000005030000-0x000000000505C000-memory.dmp
memory/784-2069-0x00000000050A0000-0x00000000050EC000-memory.dmp
memory/784-2070-0x00000000749F2000-0x00000000749F3000-memory.dmp
memory/784-2071-0x00000000749E0000-0x000000007519C000-memory.dmp