Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/08/2026, 18:40
General
- Target location_changer_installer.exe
- Size 3.2MB
- Sample260824-xbfj1sysds
- SHA256 71fed3a2d48fdec3efcf758bfc2e37f6342fc03eef14db3c31c7497c7787cc30
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\location_changer_installer.exe"C:\Users\Admin\AppData\Local\Temp\location_changer_installer.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tmp123_downloader\download'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
config.ini
en.ini
language.ini
memory/2828-223-0x0000000073700000-0x0000000073EBC000-memory.dmp
memory/2828-224-0x00000000700E0000-0x000000007012C000-memory.dmp
memory/2828-211-0x0000000073700000-0x0000000073EBC000-memory.dmp
memory/2828-213-0x0000000073700000-0x0000000073EBC000-memory.dmp
memory/2828-212-0x0000000004FB0000-0x00000000055FA000-memory.dmp
memory/2828-214-0x0000000004F10000-0x0000000004F32000-memory.dmp
memory/2828-216-0x00000000057A0000-0x0000000005806000-memory.dmp
memory/2828-215-0x0000000005730000-0x0000000005796000-memory.dmp
memory/2828-219-0x00000000058B0000-0x0000000005C0B000-memory.dmp
memory/2828-220-0x0000000005CE0000-0x0000000005CFE000-memory.dmp
memory/2828-221-0x0000000006240000-0x000000000628C000-memory.dmp
memory/2828-209-0x0000000073712000-0x0000000073713000-memory.dmp
memory/2828-222-0x0000000006EB0000-0x0000000006EE6000-memory.dmp
memory/2828-210-0x00000000027E0000-0x0000000002816000-memory.dmp
memory/2828-228-0x0000000073700000-0x0000000073EBC000-memory.dmp
memory/2828-227-0x0000000006EF0000-0x0000000006F10000-memory.dmp
memory/2828-230-0x0000000006F10000-0x0000000006FB3000-memory.dmp
memory/2828-229-0x0000000073700000-0x0000000073EBC000-memory.dmp
memory/2828-232-0x0000000007050000-0x000000000706A000-memory.dmp
memory/2828-231-0x0000000007690000-0x0000000007D0C000-memory.dmp
memory/2828-233-0x00000000070C0000-0x00000000070CA000-memory.dmp
memory/2828-234-0x00000000072C0000-0x0000000007356000-memory.dmp
memory/2828-235-0x0000000073712000-0x0000000073713000-memory.dmp
memory/2828-236-0x0000000073700000-0x0000000073EBC000-memory.dmp
memory/2828-237-0x0000000073700000-0x0000000073EBC000-memory.dmp
memory/2828-239-0x0000000073700000-0x0000000073EBC000-memory.dmp