Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
26/08/2026, 07:17
General
- Target 2715c60d4eea1ed1fd204626b803fae58833de0dc109428464e7b6259aa133b8.exe
- Size 352KB
- Sample260826-h4e2macb46
- SHA256 2715c60d4eea1ed1fd204626b803fae58833de0dc109428464e7b6259aa133b8
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 2 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2715c60d4eea1ed1fd204626b803fae58833de0dc109428464e7b6259aa133b8.exe"C:\Users\Admin\AppData\Local\Temp\2715c60d4eea1ed1fd204626b803fae58833de0dc109428464e7b6259aa133b8.exe"1⤵
- Creates a file in the Startup directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\PROGRA~3\{09221~1\2715c60d4eea1ed1fd204626b803fae58833de0dc109428464e7b6259aa133b8.exeC:\PROGRA~3\{09221~1\2715C6~1.EXE1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\PROGRA~3\{A8C66~1\2715c60d4eea1ed1fd204626b803fae58833de0dc109428464e7b6259aa133b8.exeC:\PROGRA~3\{A8C66~1\2715C6~1.EXE1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2715c60d4eea1ed1fd204626b803fae58833de0dc109428464e7b6259aa133b8.exe
2715c60d4eea1ed1fd204626b803fae58833de0dc109428464e7b6259aa133b8.lnk
Bidaily Synchronize Task.job
memory/2660-60-0x0000000001290000-0x0000000001291000-memory.dmp
memory/2660-59-0x0000000001280000-0x0000000001281000-memory.dmp
memory/2660-48-0x0000000000D90000-0x0000000000D91000-memory.dmp
memory/2660-49-0x0000000000DA0000-0x0000000000DA1000-memory.dmp
memory/2660-50-0x0000000000D50000-0x0000000000D51000-memory.dmp
memory/2660-52-0x0000000001250000-0x000000000127F000-memory.dmp
memory/2660-47-0x0000000000D80000-0x0000000000D81000-memory.dmp
memory/2660-56-0x0000000000DD0000-0x0000000000DD1000-memory.dmp
memory/2660-57-0x0000000000DF0000-0x0000000000DF1000-memory.dmp
memory/2660-42-0x0000000000CC0000-0x0000000000CC1000-memory.dmp
memory/2660-58-0x0000000000E00000-0x0000000000E01000-memory.dmp
memory/2660-46-0x0000000000D60000-0x0000000000D61000-memory.dmp
memory/2660-51-0x0000000000DC0000-0x0000000000DC1000-memory.dmp
memory/2660-43-0x0000000000CD0000-0x0000000000CD1000-memory.dmp
memory/2660-44-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/2660-45-0x0000000000D30000-0x0000000000D31000-memory.dmp
memory/2660-37-0x0000000000C50000-0x0000000000C51000-memory.dmp
memory/2660-38-0x0000000000C70000-0x0000000000C71000-memory.dmp
memory/2660-39-0x0000000000C80000-0x0000000000C81000-memory.dmp
memory/2660-40-0x0000000000CA0000-0x0000000000CA1000-memory.dmp
memory/2660-41-0x0000000000CB0000-0x0000000000CB1000-memory.dmp
memory/2660-69-0x0000000001320000-0x0000000001321000-memory.dmp
memory/2660-36-0x00000000009A0000-0x00000000009A1000-memory.dmp
memory/5028-3-0x00000000009E0000-0x00000000009E1000-memory.dmp
memory/5028-70-0x0000000000C00000-0x0000000000C01000-memory.dmp
memory/5028-25-0x0000000000B80000-0x0000000000B81000-memory.dmp
memory/5028-26-0x0000000000B90000-0x0000000000B91000-memory.dmp
memory/5028-21-0x0000000000B20000-0x0000000000B4F000-memory.dmp
memory/5028-2-0x00000000009D0000-0x00000000009D1000-memory.dmp
memory/5028-0-0x00000000008F0000-0x00000000008F1000-memory.dmp
memory/5028-4-0x00000000009F0000-0x00000000009F1000-memory.dmp
memory/5028-5-0x0000000000A00000-0x0000000000A01000-memory.dmp
memory/5028-6-0x0000000000A50000-0x0000000000A51000-memory.dmp
memory/5028-7-0x0000000000A60000-0x0000000000A61000-memory.dmp
memory/5028-10-0x0000000000A90000-0x0000000000A91000-memory.dmp
memory/5028-11-0x0000000000AA0000-0x0000000000AA1000-memory.dmp
memory/5028-12-0x0000000000AB0000-0x0000000000AB1000-memory.dmp
memory/5028-13-0x0000000000AC0000-0x0000000000AC1000-memory.dmp
memory/5028-14-0x0000000000AD0000-0x0000000000AD1000-memory.dmp
memory/5028-15-0x0000000000AE0000-0x0000000000AE1000-memory.dmp
memory/5028-16-0x0000000000B00000-0x0000000000B01000-memory.dmp
memory/5028-17-0x0000000000AF0000-0x0000000000AF1000-memory.dmp
memory/5028-18-0x0000000000B10000-0x0000000000B11000-memory.dmp
memory/5028-19-0x0000000000B60000-0x0000000000B61000-memory.dmp
memory/5028-8-0x0000000000A70000-0x0000000000A71000-memory.dmp
memory/5028-9-0x0000000000A80000-0x0000000000A81000-memory.dmp
memory/5028-24-0x0000000000B70000-0x0000000000B71000-memory.dmp
memory/5028-1-0x00000000009A0000-0x00000000009A1000-memory.dmp
memory/5056-83-0x0000000003770000-0x0000000003771000-memory.dmp
memory/5056-85-0x0000000003790000-0x0000000003791000-memory.dmp
memory/5056-81-0x00000000033F0000-0x00000000033F1000-memory.dmp
memory/5056-90-0x0000000003810000-0x0000000003811000-memory.dmp
memory/5056-89-0x00000000037D0000-0x00000000037D1000-memory.dmp
memory/5056-88-0x00000000037C0000-0x00000000037C1000-memory.dmp
memory/5056-87-0x00000000037B0000-0x00000000037B1000-memory.dmp
memory/5056-79-0x00000000033D0000-0x00000000033D1000-memory.dmp
memory/5056-80-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/5056-84-0x0000000003780000-0x0000000003781000-memory.dmp
memory/5056-82-0x0000000003400000-0x0000000003401000-memory.dmp
memory/5056-73-0x0000000000760000-0x0000000000761000-memory.dmp
memory/5056-86-0x00000000037A0000-0x00000000037A1000-memory.dmp
memory/5056-78-0x0000000000F40000-0x0000000000F41000-memory.dmp
memory/5056-77-0x0000000000F30000-0x0000000000F31000-memory.dmp
memory/5056-76-0x0000000000F10000-0x0000000000F11000-memory.dmp
memory/5056-75-0x0000000000F00000-0x0000000000F01000-memory.dmp
memory/5056-74-0x0000000000ED0000-0x0000000000ED1000-memory.dmp
memory/5056-91-0x00000000040A0000-0x00000000040A1000-memory.dmp
memory/5056-94-0x00000000044F0000-0x00000000044F1000-memory.dmp
memory/5056-92-0x00000000037E0000-0x000000000380F000-memory.dmp
memory/5056-97-0x0000000004D90000-0x0000000004D91000-memory.dmp
memory/5056-100-0x0000000002FD0000-0x0000000002FD1000-memory.dmp