Analysis
- user interaction
yes - max time kernel
28s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
22/08/2026, 04:34
General
- Target Remember.exe
- Size 231.9MB
- Sample260822-e7hp5svybs
- SHA256 1918b63fe28ffd4a8497f1ebc5bb784ce0f990e6f598c44e470ba31a48e8bd35
Malware Config
Signatures
- Loads dropped DLL 6 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 30 IoCs
- Suspicious use of SendNotifyMessage 30 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Remember.exe"C:\Users\Admin\AppData\Local\Temp\Remember.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 4602⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4364 -ip 43641⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
dbprocore.dll
dbprosetupdebug.dll
dbprosystemdebug.dll
d836b8b_c.bmp
loop6.mpg
memory/4364-669-0x00000000024D0000-0x0000000002511000-memory.dmp
memory/4364-691-0x0000000003D20000-0x0000000003D42000-memory.dmp
memory/4364-680-0x0000000003CE0000-0x0000000003D08000-memory.dmp
memory/4412-697-0x000001B1B8F20000-0x000001B1B8F21000-memory.dmp
memory/4412-696-0x000001B1B8F20000-0x000001B1B8F21000-memory.dmp
memory/4412-695-0x000001B1B8F20000-0x000001B1B8F21000-memory.dmp
memory/4412-701-0x000001B1B8F20000-0x000001B1B8F21000-memory.dmp
memory/4412-707-0x000001B1B8F20000-0x000001B1B8F21000-memory.dmp
memory/4412-706-0x000001B1B8F20000-0x000001B1B8F21000-memory.dmp
memory/4412-705-0x000001B1B8F20000-0x000001B1B8F21000-memory.dmp
memory/4412-704-0x000001B1B8F20000-0x000001B1B8F21000-memory.dmp
memory/4412-703-0x000001B1B8F20000-0x000001B1B8F21000-memory.dmp
memory/4412-702-0x000001B1B8F20000-0x000001B1B8F21000-memory.dmp