Analysis
- user interaction
yes - max time kernel
149s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
25/08/2026, 14:48
General
- Target Chara.exe
- Size 811KB
- Sample260825-r6f65stepd
- SHA256 e977d9019638f1d22d1dacf3d452191626a89b767bb5bf3fe59a2fb1fec8fb73
Malware Config
Signatures
- Renames multiple (141) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Chara.exe"C:\Users\Admin\AppData\Local\Temp\Chara.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qminshmt\qminshmt.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3464.tmp" "c:\Users\Admin\AppData\Local\Temp\qminshmt\CSC1D06A080CBF64723A24D94942577F4FC.TMP"3⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xq0myksn\xq0myksn.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES69AD.tmp" "c:\Users\Admin\AppData\Local\Temp\xq0myksn\CSC7DA37798E8894FAC9538299B50F5FB50.TMP"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
RES3464.tmp
RES69AD.tmp
qminshmt.dll
xq0myksn.dll
CSC1D06A080CBF64723A24D94942577F4FC.TMP
qminshmt.0.cs
qminshmt.cmdline
CSC7DA37798E8894FAC9538299B50F5FB50.TMP
xq0myksn.0.cs
xq0myksn.cmdline
memory/5804-29-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/5804-27-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/5804-7-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/5804-24-0x00000000016D0000-0x00000000016D8000-memory.dmp
memory/5804-6-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/5804-25-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/5804-3-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/5804-8-0x000000001B980000-0x000000001B9A2000-memory.dmp
memory/5804-30-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/5804-28-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/5804-9-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/5804-10-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/5804-26-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/5804-11-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/5804-0-0x00007FFC6847F000-0x00007FFC68480000-memory.dmp
memory/5804-2-0x0000000000CA0000-0x0000000000D70000-memory.dmp
memory/5804-1-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/5804-43-0x000000001BA00000-0x000000001BA08000-memory.dmp
memory/5804-44-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/5804-46-0x0000000028620000-0x0000000028DC6000-memory.dmp
memory/5804-47-0x0000000027FB0000-0x00000000280B0000-memory.dmp
memory/5804-51-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/5804-52-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp