Analysis
- max time kernel
149s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/08/2026, 11:12
General
- Target sample.exe
- Size 51KB
- Sample260818-nav4ms1djd
- SHA256 0794022a72a69256b2c93df157c77f0daff33bba46adf3e7b2c7d2e14ee4ef49
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\sample.exe"C:\Users\Admin\AppData\Local\Temp\sample.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xqcfw0bi\xqcfw0bi.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBA6D.tmp" "c:\Users\Admin\AppData\Local\Temp\xqcfw0bi\CSCDE1ED70ECBED46F5832B655E5531A493.TMP"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RESBA6D.tmp
xqcfw0bi.dll
CSCDE1ED70ECBED46F5832B655E5531A493.TMP
xqcfw0bi.0.cs
xqcfw0bi.cmdline
memory/4300-29-0x00000000232F0000-0x00000000232FA000-memory.dmp
memory/4300-27-0x0000000023210000-0x000000002322E000-memory.dmp
memory/4300-7-0x000000001B130000-0x000000001B152000-memory.dmp
memory/4300-6-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp
memory/4300-14-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp
memory/4300-17-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp
memory/4300-5-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp
memory/4300-2-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp
memory/4300-1-0x00000000003F0000-0x0000000000404000-memory.dmp
memory/4300-23-0x000000001B160000-0x000000001B168000-memory.dmp
memory/4300-24-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp
memory/4300-0-0x00007FFB528AF000-0x00007FFB528B0000-memory.dmp
memory/4300-28-0x0000000023230000-0x00000000232E2000-memory.dmp
memory/4300-8-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp
memory/4300-30-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp
memory/4300-31-0x0000000023320000-0x000000002333E000-memory.dmp
memory/4300-32-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp
memory/4300-33-0x0000000023370000-0x000000002337A000-memory.dmp
memory/4300-34-0x0000000023380000-0x000000002338A000-memory.dmp
memory/4300-36-0x0000000023240000-0x0000000023264000-memory.dmp
memory/4300-35-0x0000000023240000-0x000000002326A000-memory.dmp
memory/4300-37-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp
memory/4300-38-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp
memory/4300-39-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp
memory/4300-40-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp
memory/4300-41-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp
memory/4300-42-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp
memory/4300-44-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp