Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
25/08/2026, 12:29
General
- Target 93056298ea6e818d3ea0196c55174305af0391bec9267a0bf5f7dd6c9c9c3d9f.exe
- Size 6.1MB
- Sample260825-pn76sshb86
- SHA256 93056298ea6e818d3ea0196c55174305af0391bec9267a0bf5f7dd6c9c9c3d9f
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Drops file in System32 directory 7 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 3 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\93056298ea6e818d3ea0196c55174305af0391bec9267a0bf5f7dd6c9c9c3d9f.exe"C:\Users\Admin\AppData\Local\Temp\93056298ea6e818d3ea0196c55174305af0391bec9267a0bf5f7dd6c9c9c3d9f.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\xeddsqd\xeddsqd\xeixrff\fqurnyk.exeC:\Windows\system32\xeddsqd\xeddsqd\xeixrff\fqurnyk.exe -close2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe -NetworkService3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 124⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4204 -ip 42041⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
0202021dsfsd.ini
1.xeddsqd
2.xeddsqd
fqurnyk.exe
m.ini
eddsqdx000.IMD
eddsqdx001.IMD
eddsqdx002.IMD
eddsqdx003.IMD
eddsqdx004.IMD
eddsqdx005.IMD
eddsqdx006.IMD
eddsqdx007.IMD
eddsqdx008.IMD
eddsqdx009.IMD
eddsqdx010.IMD
memory/2236-132-0x0000000002030000-0x0000000002073000-memory.dmp
memory/2236-131-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/2236-112-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/2236-113-0x0000000002030000-0x0000000002073000-memory.dmp
memory/4204-129-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/4596-24-0x0000000002480000-0x0000000002481000-memory.dmp
memory/4596-76-0x0000000003500000-0x0000000003501000-memory.dmp
memory/4596-28-0x00000000024C0000-0x00000000024C1000-memory.dmp
memory/4596-27-0x0000000002490000-0x0000000002491000-memory.dmp
memory/4596-26-0x00000000024A0000-0x00000000024A1000-memory.dmp
memory/4596-25-0x0000000002470000-0x0000000002471000-memory.dmp
memory/4596-0-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/4596-23-0x0000000002450000-0x0000000002451000-memory.dmp
memory/4596-22-0x0000000002460000-0x0000000002461000-memory.dmp
memory/4596-21-0x0000000002430000-0x0000000002431000-memory.dmp
memory/4596-20-0x0000000002440000-0x0000000002441000-memory.dmp
memory/4596-19-0x0000000002410000-0x0000000002411000-memory.dmp
memory/4596-18-0x0000000002420000-0x0000000002421000-memory.dmp
memory/4596-17-0x00000000023C0000-0x00000000023C1000-memory.dmp
memory/4596-16-0x00000000023F0000-0x00000000023F1000-memory.dmp
memory/4596-15-0x0000000002400000-0x0000000002401000-memory.dmp
memory/4596-14-0x0000000002370000-0x0000000002371000-memory.dmp
memory/4596-13-0x0000000002330000-0x0000000002331000-memory.dmp
memory/4596-11-0x0000000002360000-0x0000000002361000-memory.dmp
memory/4596-10-0x00000000023E0000-0x00000000023E1000-memory.dmp
memory/4596-9-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/4596-6-0x0000000002200000-0x0000000002201000-memory.dmp
memory/4596-3-0x0000000000590000-0x0000000000591000-memory.dmp
memory/4596-7-0x0000000002350000-0x0000000002353000-memory.dmp
memory/4596-5-0x00000000021C0000-0x00000000021C1000-memory.dmp
memory/4596-2-0x00000000021E0000-0x00000000021E1000-memory.dmp
memory/4596-4-0x0000000000580000-0x0000000000581000-memory.dmp
memory/4596-65-0x0000000003470000-0x0000000003471000-memory.dmp
memory/4596-64-0x00000000034A0000-0x00000000034A1000-memory.dmp
memory/4596-63-0x00000000034B0000-0x00000000034B1000-memory.dmp
memory/4596-62-0x0000000003480000-0x0000000003481000-memory.dmp
memory/4596-61-0x0000000003490000-0x0000000003491000-memory.dmp
memory/4596-60-0x0000000003460000-0x0000000003461000-memory.dmp
memory/4596-57-0x0000000003440000-0x0000000003441000-memory.dmp
memory/4596-56-0x0000000003450000-0x0000000003451000-memory.dmp
memory/4596-55-0x0000000003420000-0x0000000003421000-memory.dmp
memory/4596-54-0x0000000003430000-0x0000000003431000-memory.dmp
memory/4596-66-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/4596-70-0x0000000002120000-0x0000000002163000-memory.dmp
memory/4596-69-0x00000000034C0000-0x00000000034C1000-memory.dmp
memory/4596-68-0x00000000034D0000-0x00000000034D1000-memory.dmp
memory/4596-78-0x0000000003520000-0x0000000003521000-memory.dmp
memory/4596-77-0x0000000003530000-0x0000000003531000-memory.dmp
memory/4596-29-0x00000000024B0000-0x00000000024B1000-memory.dmp
memory/4596-75-0x0000000003510000-0x0000000003511000-memory.dmp
memory/4596-74-0x00000000034E0000-0x00000000034E1000-memory.dmp
memory/4596-73-0x00000000034F0000-0x00000000034F1000-memory.dmp
memory/4596-30-0x00000000024E0000-0x00000000024E1000-memory.dmp
memory/4596-104-0x0000000003540000-0x0000000003541000-memory.dmp
memory/4596-103-0x0000000003650000-0x0000000003651000-memory.dmp
memory/4596-106-0x0000000003660000-0x0000000003661000-memory.dmp
memory/4596-105-0x0000000003670000-0x0000000003671000-memory.dmp
memory/4596-108-0x0000000003680000-0x0000000003681000-memory.dmp
memory/4596-107-0x0000000003690000-0x0000000003691000-memory.dmp
memory/4596-31-0x00000000024D0000-0x00000000024D1000-memory.dmp
memory/4596-32-0x0000000002510000-0x0000000002511000-memory.dmp
memory/4596-33-0x00000000024F0000-0x00000000024F1000-memory.dmp
memory/4596-34-0x0000000002630000-0x0000000002631000-memory.dmp
memory/4596-35-0x0000000002620000-0x0000000002621000-memory.dmp
memory/4596-36-0x0000000002650000-0x0000000002651000-memory.dmp
memory/4596-37-0x0000000002640000-0x0000000002641000-memory.dmp
memory/4596-38-0x0000000002670000-0x0000000002671000-memory.dmp
memory/4596-39-0x0000000002660000-0x0000000002661000-memory.dmp
memory/4596-40-0x0000000002690000-0x0000000002691000-memory.dmp
memory/4596-41-0x0000000002680000-0x0000000002681000-memory.dmp
memory/4596-42-0x00000000026C0000-0x00000000026C1000-memory.dmp
memory/4596-43-0x00000000026B0000-0x00000000026B1000-memory.dmp
memory/4596-46-0x0000000002A40000-0x0000000002A41000-memory.dmp
memory/4596-47-0x0000000002A30000-0x0000000002A31000-memory.dmp
memory/4596-44-0x00000000026D0000-0x00000000026D1000-memory.dmp
memory/4596-45-0x00000000026E0000-0x00000000026E1000-memory.dmp
memory/4596-12-0x0000000002210000-0x0000000002211000-memory.dmp
memory/4596-8-0x0000000002340000-0x0000000002349000-memory.dmp
memory/4596-1-0x0000000002120000-0x0000000002163000-memory.dmp
memory/4596-133-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/4596-134-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/4596-135-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/4596-136-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/4596-137-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/4596-138-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/4596-139-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/4596-140-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/4596-141-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/4596-142-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/4596-143-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/4596-144-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/4596-145-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/4596-146-0x0000000000400000-0x00000000004A0000-memory.dmp