Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
25/08/2026, 02:12
General
- Target 8ac5c120f4a842dfd7905294bd98892f3ef5f63369bebc43a099ffbedfbadb05.exe
- Size 1.1MB
- Sample260825-cm348swclf
- SHA256 8ac5c120f4a842dfd7905294bd98892f3ef5f63369bebc43a099ffbedfbadb05
Malware Config
Signatures
- Badlisted process makes network request 10 IoCs
Network request originating from process or tool commonly abused by malware.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ac5c120f4a842dfd7905294bd98892f3ef5f63369bebc43a099ffbedfbadb05.exe"C:\Users\Admin\AppData\Local\Temp\8ac5c120f4a842dfd7905294bd98892f3ef5f63369bebc43a099ffbedfbadb05.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Horrorises=GC -raw 'C:\Users\Admin\AppData\Roaming\guldsmedenes\Oversaetteren.esp';$toxophilitism=$Horrorises.SubString(51875,3);$Epicenes++; .$toxophilitism($Horrorises)"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Liverwurst.Par
Oversaetteren.esp
memory/5552-50-0x00000000076F0000-0x00000000076FA000-memory.dmp
memory/5552-26-0x00000000732D0000-0x0000000073A8C000-memory.dmp
memory/5552-28-0x00000000732D0000-0x0000000073A8C000-memory.dmp
memory/5552-31-0x0000000005490000-0x00000000054F6000-memory.dmp
memory/5552-30-0x0000000005420000-0x0000000005486000-memory.dmp
memory/5552-29-0x0000000005380000-0x00000000053A2000-memory.dmp
memory/5552-34-0x0000000005D40000-0x000000000609B000-memory.dmp
memory/5552-35-0x0000000006130000-0x000000000614E000-memory.dmp
memory/5552-36-0x0000000006490000-0x00000000064DC000-memory.dmp
memory/5552-37-0x0000000007300000-0x0000000007396000-memory.dmp
memory/5552-38-0x0000000006670000-0x000000000668A000-memory.dmp
memory/5552-39-0x00000000066D0000-0x00000000066F2000-memory.dmp
memory/5552-40-0x00000000079C0000-0x0000000007F7A000-memory.dmp
memory/5552-27-0x0000000005680000-0x0000000005CCA000-memory.dmp
memory/5552-42-0x0000000008600000-0x0000000008C7C000-memory.dmp
memory/5552-45-0x000000006FD90000-0x000000006FDDC000-memory.dmp
memory/5552-48-0x0000000007550000-0x0000000007570000-memory.dmp
memory/5552-44-0x00000000732D0000-0x0000000073A8C000-memory.dmp
memory/5552-43-0x0000000007570000-0x00000000075A6000-memory.dmp
memory/5552-49-0x00000000075C0000-0x0000000007663000-memory.dmp
memory/5552-52-0x0000000007850000-0x0000000007861000-memory.dmp
memory/5552-24-0x00000000732E2000-0x00000000732E3000-memory.dmp
memory/5552-51-0x00000000732D0000-0x0000000073A8C000-memory.dmp
memory/5552-53-0x0000000007870000-0x0000000007880000-memory.dmp
memory/5552-54-0x0000000007890000-0x00000000078A5000-memory.dmp
memory/5552-55-0x00000000078E0000-0x00000000078FC000-memory.dmp
memory/5552-56-0x00000000078D0000-0x00000000078D8000-memory.dmp
memory/5552-57-0x00000000732E2000-0x00000000732E3000-memory.dmp
memory/5552-58-0x00000000732D0000-0x0000000073A8C000-memory.dmp
memory/5552-59-0x00000000078D0000-0x00000000078FA000-memory.dmp
memory/5552-60-0x0000000007910000-0x0000000007934000-memory.dmp
memory/5552-61-0x00000000732D0000-0x0000000073A8C000-memory.dmp
memory/5552-62-0x00000000732D0000-0x0000000073A8C000-memory.dmp
memory/5552-63-0x00000000732D0000-0x0000000073A8C000-memory.dmp
memory/5552-25-0x0000000002DA0000-0x0000000002DD6000-memory.dmp
memory/5552-65-0x00000000732D0000-0x0000000073A8C000-memory.dmp
memory/5552-66-0x00000000732D0000-0x0000000073A8C000-memory.dmp
memory/5552-67-0x0000000008C80000-0x000000000ABBF000-memory.dmp
memory/5552-68-0x00000000732D0000-0x0000000073A8C000-memory.dmp
memory/5552-69-0x00000000732D0000-0x0000000073A8C000-memory.dmp
memory/5552-71-0x00000000732D0000-0x0000000073A8C000-memory.dmp
memory/5552-72-0x00000000732D0000-0x0000000073A8C000-memory.dmp
memory/5552-73-0x00000000732D0000-0x0000000073A8C000-memory.dmp
memory/5572-74-0x0000000000850000-0x0000000001B36000-memory.dmp