Analysis
- user interaction
yes - max time kernel
22s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
26/08/2026, 00:41
General
- Target 66mods Tweaker.exe
- Size 75.1MB
- Sample260826-a194labc97
- SHA256 b65767ad6e87178e8453d410ab7cb427a40bae509d11dc340a6ef679211c229b
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
- Power Settings 1 TTPs 2 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\66mods Tweaker.exe"C:\Users\Admin\AppData\Local\Temp\66mods Tweaker.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /getactivescheme2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /list2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
baseline.json
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
wpfgfx_cor3.dll
memory/2804-104-0x000001ECD5470000-0x000001ECD5490000-memory.dmp
memory/2804-84-0x000001ECD5F20000-0x000001ECD66C0000-memory.dmp
memory/2804-49-0x000001AC3D880000-0x000001AC3D8A0000-memory.dmp
memory/2804-45-0x000001AC3D500000-0x000001AC3D520000-memory.dmp
memory/2804-69-0x000001ECD50F0000-0x000001ECD5110000-memory.dmp
memory/2804-80-0x000001ECD53C0000-0x000001ECD5410000-memory.dmp
memory/2804-76-0x000001ECD52B0000-0x000001ECD53C0000-memory.dmp
memory/2804-21-0x000001AC3B520000-0x000001AC3B570000-memory.dmp
memory/2804-65-0x000001AC3DAB0000-0x000001AC3DAE0000-memory.dmp
memory/2804-61-0x000001AC3D8E0000-0x000001AC3D900000-memory.dmp
memory/2804-57-0x000001AC3DA70000-0x000001AC3DAB0000-memory.dmp
memory/2804-53-0x000001AC3D8A0000-0x000001AC3D8C0000-memory.dmp
memory/2804-42-0x000001AC3B4C0000-0x000001AC3B4D0000-memory.dmp
memory/2804-37-0x000001AC3B590000-0x000001AC3B5B0000-memory.dmp
memory/2804-29-0x000001ECD2E60000-0x000001ECD3690000-memory.dmp
memory/2804-88-0x000001ECD5410000-0x000001ECD5440000-memory.dmp
memory/2804-92-0x000001ECD5550000-0x000001ECD55E0000-memory.dmp
memory/2804-108-0x000001AC3DAE0000-0x000001AC3DAF0000-memory.dmp
memory/2804-5-0x000001AC3A160000-0x000001AC3ADF0000-memory.dmp
memory/2804-100-0x000001ECD66C0000-0x000001ECD6780000-memory.dmp
memory/2804-33-0x000001AC3D5C0000-0x000001AC3D640000-memory.dmp
memory/2804-25-0x000001AC3D4C0000-0x000001AC3D500000-memory.dmp
memory/2804-96-0x000001ECD55E0000-0x000001ECD5610000-memory.dmp
memory/2804-120-0x000001ECD68C0000-0x000001ECD6920000-memory.dmp
memory/2804-128-0x000001AC38F10000-0x000001AC38F20000-memory.dmp
memory/2804-124-0x000001ECD6820000-0x000001ECD6860000-memory.dmp
memory/2804-116-0x000001ECD5730000-0x000001ECD5750000-memory.dmp
memory/2804-112-0x000001ECD67D0000-0x000001ECD6820000-memory.dmp
memory/2804-132-0x000001ECD72F0000-0x000001ECD74F0000-memory.dmp
memory/2804-136-0x000001ECD7660000-0x000001ECD77D0000-memory.dmp
memory/2804-140-0x000001ECD6B50000-0x000001ECD6B70000-memory.dmp
memory/2804-148-0x000001ECD6B40000-0x000001ECD6B50000-memory.dmp
memory/2804-144-0x000001ECD7950000-0x000001ECD7A50000-memory.dmp
memory/2804-152-0x000001ECD7E50000-0x000001ECD7EA0000-memory.dmp
memory/2804-10-0x000001AC3C520000-0x000001AC3D480000-memory.dmp
memory/2804-17-0x000001AC39350000-0x000001AC394B0000-memory.dmp
memory/2804-13-0x000001AC3B110000-0x000001AC3B340000-memory.dmp
memory/2804-172-0x000001ECD8040000-0x000001ECD80B0000-memory.dmp
memory/2804-176-0x000001ECD82B0000-0x000001ECD8410000-memory.dmp
memory/2804-180-0x000001ECD6B30000-0x000001ECD6B40000-memory.dmp
memory/2804-184-0x000001ECDB410000-0x000001ECDB420000-memory.dmp