Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
25/08/2026, 14:56
General
- Target Chara.exe
- Size 658KB
- Sample260825-sa7vnatfph
- SHA256 a079a744f8735c1451e3b83ac62b142ad17501da1aee6ba91816d9475ac0bcfb
Malware Config
Signatures
- Renames multiple (89) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Chara.exe"C:\Users\Admin\AppData\Local\Temp\Chara.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4mmg55an\4mmg55an.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES550C.tmp" "c:\Users\Admin\AppData\Local\Temp\4mmg55an\CSCF2ABC748A87444079BD58358E857E7BF.TMP"3⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ast24vu1\ast24vu1.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7A28.tmp" "c:\Users\Admin\AppData\Local\Temp\ast24vu1\CSCEC251C5F90564261B26F9E923D3A5C88.TMP"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
4mmg55an.dll
RES550C.tmp
RES7A28.tmp
ast24vu1.dll
4mmg55an.0.cs
4mmg55an.cmdline
CSCF2ABC748A87444079BD58358E857E7BF.TMP
CSCEC251C5F90564261B26F9E923D3A5C88.TMP
ast24vu1.0.cs
ast24vu1.cmdline
memory/3380-12-0x00007FF88E1D0000-0x00007FF88EB74000-memory.dmp
memory/3380-5-0x000000001AFC0000-0x000000001AFE2000-memory.dmp
memory/3380-20-0x000000001C250000-0x000000001C258000-memory.dmp
memory/3380-22-0x00007FF88E1D0000-0x00007FF88EB74000-memory.dmp
memory/3380-23-0x00007FF88E1D0000-0x00007FF88EB74000-memory.dmp
memory/3380-24-0x00007FF88E1D0000-0x00007FF88EB74000-memory.dmp
memory/3380-25-0x00007FF88E1D0000-0x00007FF88EB74000-memory.dmp
memory/3380-0-0x00007FF88E35F000-0x00007FF88E360000-memory.dmp
memory/3380-6-0x00007FF88E1D0000-0x00007FF88EB74000-memory.dmp
memory/3380-21-0x00007FF88E1D0000-0x00007FF88EB74000-memory.dmp
memory/3380-4-0x00007FF88E1D0000-0x00007FF88EB74000-memory.dmp
memory/3380-1-0x00000000001E0000-0x000000000028A000-memory.dmp
memory/3380-38-0x00000000025B0000-0x00000000025B8000-memory.dmp
memory/3380-40-0x0000000027A00000-0x00000000281A6000-memory.dmp
memory/3380-43-0x0000000027350000-0x0000000027450000-memory.dmp
memory/3380-42-0x0000000027350000-0x0000000027450000-memory.dmp
memory/3380-45-0x00007FF88E1D0000-0x00007FF88EB74000-memory.dmp
memory/3380-46-0x00007FF88E1D0000-0x00007FF88EB74000-memory.dmp
memory/3380-47-0x00007FF88E1D0000-0x00007FF88EB74000-memory.dmp