Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
25/08/2026, 01:59
General
- Target b6baf782b24cfe8e36dd991d971daef66c281d9c427bb99d37ae3a5014df89c4.exe
- Size 719KB
- Sample260825-cewp7adr2s
- SHA256 b6baf782b24cfe8e36dd991d971daef66c281d9c427bb99d37ae3a5014df89c4
Malware Config
Signatures
- Badlisted process makes network request 7 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6baf782b24cfe8e36dd991d971daef66c281d9c427bb99d37ae3a5014df89c4.exe"C:\Users\Admin\AppData\Local\Temp\b6baf782b24cfe8e36dd991d971daef66c281d9c427bb99d37ae3a5014df89c4.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle 1 "$Pyloralgia105=GC -raw 'C:\Users\Admin\AppData\Local\Temp\driks\Indkapslingers84\camoufleur.Can';$Tillidsreprsentanterne=$Pyloralgia105.SubString(9985,3);.$Tillidsreprsentanterne($Pyloralgia105)"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Opdelingernes.Fis
camoufleur.Can
memory/2432-39-0x0000000073D70000-0x000000007452C000-memory.dmp
memory/2432-44-0x00000000077F0000-0x00000000077FA000-memory.dmp
memory/2432-22-0x0000000005BD0000-0x0000000005BF2000-memory.dmp
memory/2432-24-0x0000000005CE0000-0x0000000005D46000-memory.dmp
memory/2432-21-0x0000000073D70000-0x000000007452C000-memory.dmp
memory/2432-23-0x0000000005C70000-0x0000000005CD6000-memory.dmp
memory/2432-25-0x0000000005D50000-0x00000000060AB000-memory.dmp
memory/2432-28-0x0000000006250000-0x000000000626E000-memory.dmp
memory/2432-29-0x00000000062A0000-0x00000000062EC000-memory.dmp
memory/2432-30-0x0000000007320000-0x00000000073B6000-memory.dmp
memory/2432-31-0x0000000006780000-0x000000000679A000-memory.dmp
memory/2432-32-0x00000000067E0000-0x0000000006802000-memory.dmp
memory/2432-33-0x0000000007980000-0x0000000007F3A000-memory.dmp
memory/2432-19-0x0000000073D70000-0x000000007452C000-memory.dmp
memory/2432-35-0x00000000085C0000-0x0000000008C3C000-memory.dmp
memory/2432-37-0x0000000070710000-0x000000007075C000-memory.dmp
memory/2432-36-0x0000000007680000-0x00000000076B6000-memory.dmp
memory/2432-41-0x0000000007660000-0x0000000007680000-memory.dmp
memory/2432-17-0x0000000073D82000-0x0000000073D83000-memory.dmp
memory/2432-43-0x00000000076D0000-0x0000000007773000-memory.dmp
memory/2432-20-0x0000000005550000-0x0000000005B9A000-memory.dmp
memory/2432-45-0x0000000007F60000-0x0000000007F71000-memory.dmp
memory/2432-42-0x0000000073D70000-0x000000007452C000-memory.dmp
memory/2432-46-0x0000000007970000-0x0000000007980000-memory.dmp
memory/2432-47-0x0000000007F80000-0x0000000007F95000-memory.dmp
memory/2432-48-0x0000000007FD0000-0x0000000007FEC000-memory.dmp
memory/2432-49-0x0000000007FC0000-0x0000000007FC8000-memory.dmp
memory/2432-50-0x0000000007FD0000-0x0000000007FFA000-memory.dmp
memory/2432-51-0x0000000008010000-0x0000000008034000-memory.dmp
memory/2432-53-0x0000000073D70000-0x000000007452C000-memory.dmp
memory/2432-52-0x0000000073D82000-0x0000000073D83000-memory.dmp
memory/2432-54-0x0000000073D70000-0x000000007452C000-memory.dmp
memory/2432-55-0x0000000073D70000-0x000000007452C000-memory.dmp
memory/2432-56-0x0000000073D70000-0x000000007452C000-memory.dmp
memory/2432-18-0x0000000004D80000-0x0000000004DB6000-memory.dmp
memory/2432-58-0x0000000073D70000-0x000000007452C000-memory.dmp
memory/2432-60-0x0000000073D70000-0x000000007452C000-memory.dmp
memory/2432-59-0x0000000008C40000-0x000000000E03E000-memory.dmp
memory/2432-62-0x0000000073D70000-0x000000007452C000-memory.dmp
memory/2432-63-0x0000000073D70000-0x000000007452C000-memory.dmp
memory/2932-64-0x0000000000E90000-0x0000000002176000-memory.dmp