Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
31/08/2026, 04:48
General
- Target 5619051c90bedc4a1af4f134d2e5ce60986dd838f264fa83833a7bd1aac9f125.exe
- Size 1.4MB
- Sample260831-fe5vmsveja
- SHA256 5619051c90bedc4a1af4f134d2e5ce60986dd838f264fa83833a7bd1aac9f125
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5619051c90bedc4a1af4f134d2e5ce60986dd838f264fa83833a7bd1aac9f125.exe"C:\Users\Admin\AppData\Local\Temp\5619051c90bedc4a1af4f134d2e5ce60986dd838f264fa83833a7bd1aac9f125.exe"1⤵
- Creates a file in the Startup directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2864-2051-0x0000000000520000-0x00000000005CE000-memory.dmp
memory/2864-2052-0x0000000074FB0000-0x000000007576C000-memory.dmp
memory/2864-2053-0x0000000004B60000-0x0000000004BEE000-memory.dmp
memory/2864-2055-0x0000000074FB0000-0x000000007576C000-memory.dmp
memory/2864-2054-0x0000000004D10000-0x0000000004E52000-memory.dmp
memory/2864-2060-0x0000000074FB0000-0x000000007576C000-memory.dmp
memory/2864-2059-0x0000000074FB0000-0x000000007576C000-memory.dmp
memory/2864-2058-0x0000000005210000-0x0000000005276000-memory.dmp
memory/2864-2056-0x0000000004FC0000-0x0000000004FC8000-memory.dmp
memory/4560-74-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-78-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-6-0x0000000005380000-0x0000000005412000-memory.dmp
memory/4560-32-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-30-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-88-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-132-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-130-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-129-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-126-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-124-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-122-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-120-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-118-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-116-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-114-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-112-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-110-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-108-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-106-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-104-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-102-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-100-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-98-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-96-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-94-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-92-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-86-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-84-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-82-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-80-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-62-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-76-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-4-0x0000000005140000-0x000000000529E000-memory.dmp
memory/4560-72-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-70-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-68-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-67-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-5-0x0000000005860000-0x0000000005E1A000-memory.dmp
memory/4560-64-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-50-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-58-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-56-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-54-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-52-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-60-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-48-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-47-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-42-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-38-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-34-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-28-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-26-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-24-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-22-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-21-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-18-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-15-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-90-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-7-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-45-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-40-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-37-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-16-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-12-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-10-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-8-0x0000000005140000-0x0000000005299000-memory.dmp
memory/4560-3-0x0000000004E70000-0x0000000004FCE000-memory.dmp
memory/4560-2043-0x00000000056C0000-0x0000000005784000-memory.dmp
memory/4560-2044-0x00000000055B0000-0x00000000055FC000-memory.dmp
memory/4560-2045-0x0000000074FC2000-0x0000000074FC3000-memory.dmp
memory/4560-2046-0x0000000074FB0000-0x000000007576C000-memory.dmp
memory/4560-2048-0x0000000074FB0000-0x000000007576C000-memory.dmp
memory/4560-2057-0x0000000074FB0000-0x000000007576C000-memory.dmp
memory/4560-2-0x0000000074FB0000-0x000000007576C000-memory.dmp
memory/4560-1-0x0000000000280000-0x00000000003E8000-memory.dmp
memory/4560-0-0x0000000074FC2000-0x0000000074FC3000-memory.dmp