Analysis
- max time kernel
10s - max time network
86s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
25/08/2026, 23:59
Errors
General
- Target 333.exe
- Size 1.2MB
- Sample260825-31vccsfl7x
- SHA256 599765dd956ae4c28e555c8391fde79991280ed60ac36c2027414aea905325c2
Malware Config
Signatures
- Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Costura .NET executable packer 1 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\333.exe"C:\Users\Admin\AppData\Local\Temp\333.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3748-1-0x00007FFA31B5F000-0x00007FFA31B60000-memory.dmp
memory/3748-0-0x0000026250D80000-0x0000026250EAE000-memory.dmp
memory/3748-2-0x00007FFA319D0000-0x00007FFA32374000-memory.dmp
memory/3748-3-0x00007FFA319D0000-0x00007FFA32374000-memory.dmp
memory/3748-4-0x00007FFA319D0000-0x00007FFA32374000-memory.dmp
memory/3748-5-0x00007FFA319D0000-0x00007FFA32374000-memory.dmp
memory/3748-6-0x00007FFA319D0000-0x00007FFA32374000-memory.dmp
memory/3748-7-0x00007FFA319D0000-0x00007FFA32374000-memory.dmp
memory/3748-8-0x00007FFA319D0000-0x00007FFA32374000-memory.dmp
memory/3748-9-0x00007FFA319D0000-0x00007FFA32374000-memory.dmp
memory/3748-10-0x00007FFA319D0000-0x00007FFA32374000-memory.dmp
memory/3748-11-0x00007FFA319D0000-0x00007FFA32374000-memory.dmp
memory/3748-12-0x000002626BAD0000-0x000002626BBD8000-memory.dmp
memory/3748-13-0x00007FFA319D0000-0x00007FFA32374000-memory.dmp
memory/3748-14-0x00007FFA319D0000-0x00007FFA32374000-memory.dmp
memory/3748-16-0x000002626BE90000-0x000002626BF08000-memory.dmp
memory/3748-22-0x0000026252B80000-0x0000026252B8E000-memory.dmp