Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
21/08/2026, 12:06
General
- Target hihi crack omerta.exe
- Size 8.5MB
- Sample260821-n92epsdr2v
- SHA256 bd11156cfbd869ecc28c7aab42bcc469ba77839ca63801332327a9491d389107
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 16 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 19 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\hihi crack omerta.exe"C:\Users\Admin\AppData\Local\Temp\hihi crack omerta.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hihi crack omerta.exe"C:\Users\Admin\AppData\Local\Temp\hihi crack omerta.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\hihi crack omerta.exe"C:\Users\Admin\AppData\Local\Temp\hihi crack omerta.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hihi crack omerta.exe"C:\Users\Admin\AppData\Local\Temp\hihi crack omerta.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\LastDance\Firefox.exe"C:\Users\Admin\AppData\Local\LastDance\Firefox.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ipconfig /flushdns4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\ipconfig.exeipconfig /flushdns5⤵
- Gathers network information
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c pause4⤵
- Executes a command shell one-liner
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Firefox.exe
payload_swap.dll
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_ssl.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
python313.dll
select.pyd
ucrtbase.dll
unicodedata.pyd
memory/720-0-0x0000000140000000-0x00000001408AD000-memory.dmp
memory/720-103-0x0000000140000000-0x00000001408AD000-memory.dmp
memory/720-113-0x0000000140000000-0x00000001408AD000-memory.dmp
memory/1532-98-0x0000000140000000-0x0000000143924000-memory.dmp
memory/1532-115-0x0000000140000000-0x0000000143924000-memory.dmp
memory/1532-120-0x0000000140000000-0x0000000143924000-memory.dmp
memory/1532-99-0x0000000140000000-0x0000000143924000-memory.dmp
memory/1532-100-0x0000000140000000-0x0000000143924000-memory.dmp
memory/1532-101-0x0000000140000000-0x0000000143924000-memory.dmp
memory/1532-102-0x0000000140000000-0x0000000143924000-memory.dmp
memory/1532-119-0x0000000140000000-0x0000000143924000-memory.dmp
memory/1532-118-0x0000000140000000-0x0000000143924000-memory.dmp
memory/1532-105-0x0000000140000000-0x0000000143924000-memory.dmp
memory/1532-106-0x0000000140000000-0x0000000143924000-memory.dmp
memory/1532-107-0x0000000140000000-0x0000000143924000-memory.dmp
memory/1532-108-0x0000000140000000-0x0000000143924000-memory.dmp
memory/1532-109-0x0000000140000000-0x0000000143924000-memory.dmp
memory/1532-117-0x0000000140000000-0x0000000143924000-memory.dmp
memory/1532-110-0x0000000140000000-0x0000000143924000-memory.dmp
memory/1532-112-0x0000000140000000-0x0000000143924000-memory.dmp
memory/1532-116-0x0000000140000000-0x0000000143924000-memory.dmp
memory/1532-114-0x0000000140000000-0x0000000143924000-memory.dmp
memory/2784-111-0x0000000140000000-0x00000001408AD000-memory.dmp
memory/2784-104-0x0000000140000000-0x00000001408AD000-memory.dmp
memory/2784-61-0x0000000140000000-0x00000001408AD000-memory.dmp
memory/4052-67-0x0000000140000000-0x0000000140050000-memory.dmp
memory/4108-4-0x0000000140000000-0x0000000140050000-memory.dmp
memory/4108-9-0x0000000140000000-0x0000000140050000-memory.dmp