Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
27/08/2026, 16:04
General
- Target 4c7f04926192ebc81be9129e9073a435ef1a44c35e2bd741bbd9d9b063c6e2f8.exe
- Size 932KB
- Sample260827-thy36abk3v
- SHA256 4c7f04926192ebc81be9129e9073a435ef1a44c35e2bd741bbd9d9b063c6e2f8
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c7f04926192ebc81be9129e9073a435ef1a44c35e2bd741bbd9d9b063c6e2f8.exe"C:\Users\Admin\AppData\Local\Temp\4c7f04926192ebc81be9129e9073a435ef1a44c35e2bd741bbd9d9b063c6e2f8.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\dqfqcb.exe"C:\ProgramData\dqfqcb.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\dqfqcb.exeC:\ProgramData\dqfqcb.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
DDF.sys .exe
Mira.h
dqfqcb.exe
$Recycle.Bin .exe
Documents and Settings .exe
DumpStack.log.tmp .exe
PerfLogs .exe
Program Files (x86) .exe
Program Files .exe
ProgramData .exe
Recovery .exe
System Volume Information .exe
Users .exe
Windows .exe
Windows .exe
$RECYCLE.BIN .exe
System Volume Information .exe
memory/1188-44-0x0000000000400000-0x0000000000448000-memory.dmp
memory/3980-43-0x0000000000400000-0x0000000000448000-memory.dmp
memory/4680-7-0x0000000000400000-0x000000000044E000-memory.dmp