Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
19/08/2026, 05:53
General
- Target 549dee7b792be5bdabc04f7e60d1367b4c3dd9976959fe81e5e34c31053fbafa.exe
- Size 526KB
- Sample260819-glbe2sel8w
- SHA256 549dee7b792be5bdabc04f7e60d1367b4c3dd9976959fe81e5e34c31053fbafa
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Delays execution with timeout.exe 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\549dee7b792be5bdabc04f7e60d1367b4c3dd9976959fe81e5e34c31053fbafa.exe"C:\Users\Admin\AppData\Local\Temp\549dee7b792be5bdabc04f7e60d1367b4c3dd9976959fe81e5e34c31053fbafa.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C timeout /t 3 /nobreak > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\549dee7b792be5bdabc04f7e60d1367b4c3dd9976959fe81e5e34c31053fbafa.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /t 3 /nobreak3⤵
- Delays execution with timeout.exe
-
-
-
C:\ProgramData\Client Demo\ClientDemo.exe"C:\ProgramData\Client Demo\ClientDemo.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ClientDemo.exe
memory/2128-1-0x00007FF6E6330000-0x00007FF6E63BB000-memory.dmp
memory/2128-4-0x0000000180000000-0x000000018002A000-memory.dmp
memory/2128-17-0x0000019D9F510000-0x0000019DA0CEF000-memory.dmp
memory/2128-16-0x0000019D9EE80000-0x0000019D9F503000-memory.dmp
memory/2128-25-0x0000019D9F510000-0x0000019DA0CEF000-memory.dmp
memory/2128-26-0x0000019D9F510000-0x0000019DA0CEF000-memory.dmp
memory/2128-27-0x0000019D9F510000-0x0000019DA0CEF000-memory.dmp
memory/2128-28-0x0000019D9F510000-0x0000019DA0CEF000-memory.dmp
memory/2128-29-0x0000019D9F510000-0x0000019DA0CEF000-memory.dmp
memory/2128-31-0x0000019D9F510000-0x0000019DA0CEF000-memory.dmp
memory/2128-32-0x0000019D9F510000-0x0000019DA0CEF000-memory.dmp
memory/2128-33-0x0000019D9F510000-0x0000019DA0CEF000-memory.dmp
memory/2128-34-0x0000019D9F510000-0x0000019DA0CEF000-memory.dmp
memory/2128-35-0x0000019D9F510000-0x0000019DA0CEF000-memory.dmp
memory/2128-36-0x0000019D9F510000-0x0000019DA0CEF000-memory.dmp
memory/2128-37-0x0000019D9F510000-0x0000019DA0CEF000-memory.dmp
memory/2128-38-0x0000019D9F510000-0x0000019DA0CEF000-memory.dmp
memory/2128-39-0x0000019D9F510000-0x0000019DA0CEF000-memory.dmp
memory/2128-40-0x0000019D9F510000-0x0000019DA0CEF000-memory.dmp
memory/2128-41-0x0000019D9F510000-0x0000019DA0CEF000-memory.dmp
memory/2128-42-0x0000019D9F510000-0x0000019DA0CEF000-memory.dmp
memory/2128-43-0x0000019D9F510000-0x0000019DA0CEF000-memory.dmp
memory/2128-44-0x0000019D9F510000-0x0000019DA0CEF000-memory.dmp
memory/2128-47-0x00007FF6E6330000-0x00007FF6E63BB000-memory.dmp