Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
22/08/2026, 17:16
General
- Target COM-LNW.exe
- Size 51KB
- Sample260822-vs4xts1zes
- SHA256 09730d609d591f16df6368b9591790d650fcb520e20e62d0b9cd91fb31fb5567
Malware Config
Signatures
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 11 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\COM-LNW.exe"C:\Users\Admin\AppData\Local\Temp\COM-LNW.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\COM-LNW\App\COM-LNW User.exe"C:\Users\Admin\AppData\Local\COM-LNW\App\COM-LNW User.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\COM-LNW\App\COM-LNW User.exe"C:\Users\Admin\AppData\Local\COM-LNW\App\COM-LNW User.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\p2p-remote-client" --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1748,i,2957160594871190548,13729884390144697821,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\COM-LNW\App\COM-LNW User.exe"C:\Users\Admin\AppData\Local\COM-LNW\App\COM-LNW User.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\p2p-remote-client" --field-trial-handle=2508,i,2957160594871190548,13729884390144697821,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:113⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\COM-LNW\App\COM-LNW User.exe"C:\Users\Admin\AppData\Local\COM-LNW\App\COM-LNW User.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\p2p-remote-client" --app-path="C:\Users\Admin\AppData\Local\COM-LNW\App\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2576,i,2957160594871190548,13729884390144697821,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\COM-LNW\App\COM-LNW User.exe"C:\Users\Admin\AppData\Local\COM-LNW\App\COM-LNW User.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\p2p-remote-client" --gpu-preferences=UAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=3600,i,2957160594871190548,13729884390144697821,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:103⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
D3DCompiler_47.dll
chrome_100_percent.pak
chrome_200_percent.pak
ffmpeg.dll
icudtl.dat
libegl.dll
libglesv2.dll
en-US.pak
resources.pak
app.asar
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
default.exc
data_0
data_1
data_2
data_3
CURRENT
memory/1960-10-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp
memory/1960-1-0x0000000000230000-0x0000000000240000-memory.dmp
memory/1960-12-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp
memory/1960-77-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp
memory/1960-19-0x000000001FCE0000-0x000000001FCF2000-memory.dmp
memory/1960-9-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp
memory/1960-8-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp
memory/1960-7-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp
memory/1960-6-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp
memory/1960-18-0x000000001C120000-0x000000001C12A000-memory.dmp
memory/1960-16-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp
memory/1960-5-0x0000000023270000-0x0000000023432000-memory.dmp
memory/1960-4-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp
memory/1960-3-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp
memory/1960-2-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp
memory/1960-11-0x000000002A7C0000-0x000000002ACE8000-memory.dmp
memory/1960-0-0x00007FFE37EDF000-0x00007FFE37EE0000-memory.dmp
memory/1960-13-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp
memory/1960-15-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp
memory/2024-136-0x00007FFE59F00000-0x00007FFE59F01000-memory.dmp
memory/2024-137-0x00007FFE5AEC0000-0x00007FFE5AEC1000-memory.dmp
memory/5376-207-0x000001C3C96B0000-0x000001C3C96B1000-memory.dmp
memory/5376-205-0x000001C3C96B0000-0x000001C3C96B1000-memory.dmp
memory/5376-211-0x000001C3C96B0000-0x000001C3C96B1000-memory.dmp
memory/5376-216-0x000001C3C96B0000-0x000001C3C96B1000-memory.dmp
memory/5376-215-0x000001C3C96B0000-0x000001C3C96B1000-memory.dmp
memory/5376-214-0x000001C3C96B0000-0x000001C3C96B1000-memory.dmp
memory/5376-213-0x000001C3C96B0000-0x000001C3C96B1000-memory.dmp
memory/5376-212-0x000001C3C96B0000-0x000001C3C96B1000-memory.dmp