Analysis
- user interaction
yes - max time kernel
69s - max time network
79s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
27/08/2026, 10:43
General
- Target ExploitStrap-v420.48.exe
- Size 161.6MB
- Sample260827-mslr9atarg
- SHA256 8c857bcfec5d302e45e52dd25800c3dc4e4d6fe7702d57dff8604e8dbf1562f1
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 7 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Modifies registry class 18 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ExploitStrap-v420.48.exe"C:\Users\Admin\AppData\Local\Temp\ExploitStrap-v420.48.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\ExploitStrap\ExploitStrap.exe"C:\Users\Admin\AppData\Local\ExploitStrap\ExploitStrap.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Settings.json
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
vcruntime140_cor3.dll
wpfgfx_cor3.dll
memory/1800-420-0x000002452EE30000-0x000002452EE62000-memory.dmp
memory/1800-397-0x000002452A2A0000-0x000002452A2A9000-memory.dmp
memory/5668-35-0x0000016837570000-0x0000016837575000-memory.dmp
memory/5668-131-0x000001685A600000-0x000001685A621000-memory.dmp
memory/5668-26-0x000001685B970000-0x000001685C1B2000-memory.dmp
memory/5668-56-0x0000016838FD0000-0x0000016838FE2000-memory.dmp
memory/5668-53-0x0000016838FB0000-0x0000016838FC8000-memory.dmp
memory/5668-74-0x000001685DF70000-0x000001685E78C000-memory.dmp
memory/5668-80-0x0000016838F50000-0x0000016838F5A000-memory.dmp
memory/5668-83-0x000001685A390000-0x000001685A412000-memory.dmp
memory/5668-110-0x000001685A340000-0x000001685A34F000-memory.dmp
memory/5668-113-0x000001685A660000-0x000001685A6AA000-memory.dmp
memory/5668-107-0x000001685A460000-0x000001685A494000-memory.dmp
memory/5668-104-0x000001685A5A0000-0x000001685A5F5000-memory.dmp
memory/5668-101-0x000001685A320000-0x000001685A336000-memory.dmp
memory/5668-98-0x000001685A420000-0x000001685A45C000-memory.dmp
memory/5668-95-0x0000016859C30000-0x0000016859C35000-memory.dmp
memory/5668-92-0x000001685A300000-0x000001685A313000-memory.dmp
memory/5668-89-0x000001685A4E0000-0x000001685A595000-memory.dmp
memory/5668-86-0x0000016859C40000-0x0000016859C61000-memory.dmp
memory/5668-77-0x0000016859BE0000-0x0000016859C09000-memory.dmp
memory/5668-71-0x0000016859BB0000-0x0000016859BDA000-memory.dmp
memory/5668-68-0x0000016859B60000-0x0000016859BA7000-memory.dmp
memory/5668-65-0x0000016838F60000-0x0000016838F68000-memory.dmp
memory/5668-62-0x000001685A000000-0x000001685A0F4000-memory.dmp
memory/5668-47-0x0000016838F90000-0x0000016838FA6000-memory.dmp
memory/5668-44-0x0000016838F70000-0x0000016838F89000-memory.dmp
memory/5668-41-0x00000168375A0000-0x00000168375A7000-memory.dmp
memory/5668-38-0x0000016838F20000-0x0000016838F33000-memory.dmp
memory/5668-20-0x00000168375B0000-0x00000168375F5000-memory.dmp
memory/5668-32-0x0000016837580000-0x000001683758D000-memory.dmp
memory/5668-29-0x0000016859A40000-0x0000016859AB6000-memory.dmp
memory/5668-23-0x0000016837610000-0x000001683764E000-memory.dmp
memory/5668-50-0x0000016859AC0000-0x0000016859B00000-memory.dmp
memory/5668-186-0x0000016866670000-0x00000168666BE000-memory.dmp
memory/5668-116-0x000001685A730000-0x000001685A79F000-memory.dmp
memory/5668-119-0x000001685F5E0000-0x000001685F744000-memory.dmp
memory/5668-122-0x000001685A830000-0x000001685A8B1000-memory.dmp
memory/5668-17-0x0000016859EA0000-0x0000016859FFE000-memory.dmp
memory/5668-128-0x000001685F750000-0x000001685F814000-memory.dmp
memory/5668-125-0x000001685F910000-0x000001685FAC8000-memory.dmp
memory/5668-140-0x000001685FED0000-0x000001685FF5A000-memory.dmp
memory/5668-137-0x000001685F820000-0x000001685F8C7000-memory.dmp
memory/5668-134-0x000001685A7A0000-0x000001685A7FC000-memory.dmp
memory/5668-143-0x0000016860F60000-0x0000016861C11000-memory.dmp
memory/5668-147-0x00000168602A0000-0x0000016860361000-memory.dmp
memory/5668-154-0x0000016860370000-0x000001686046E000-memory.dmp
memory/5668-151-0x000001685A700000-0x000001685A720000-memory.dmp
memory/5668-162-0x000001685A6E0000-0x000001685A6ED000-memory.dmp
memory/5668-165-0x000001685A6F0000-0x000001685A6F6000-memory.dmp
memory/5668-168-0x00000168666D0000-0x000001686683A000-memory.dmp
memory/5668-171-0x0000016866550000-0x00000168665CC000-memory.dmp
memory/5668-174-0x0000016865260000-0x0000016865279000-memory.dmp
memory/5668-177-0x0000016865280000-0x00000168652A5000-memory.dmp
memory/5668-180-0x00000168665D0000-0x00000168665E7000-memory.dmp
memory/5668-183-0x00000168665F0000-0x0000016866607000-memory.dmp
memory/5668-14-0x0000016859C70000-0x0000016859E98000-memory.dmp
memory/5668-189-0x0000016866840000-0x0000016866881000-memory.dmp
memory/5668-192-0x0000016866890000-0x00000168668B0000-memory.dmp
memory/5668-202-0x0000016866C40000-0x0000016866CE2000-memory.dmp
memory/5668-11-0x000001685A9E0000-0x000001685B967000-memory.dmp
memory/5668-8-0x0000000180000000-0x0000000180A25000-memory.dmp
memory/5668-198-0x0000016866B20000-0x0000016866C34000-memory.dmp
memory/5668-195-0x00000168666C0000-0x00000168666C9000-memory.dmp