Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
31/08/2026, 04:51
General
- Target ac3d323fbd142bc475632b55187be01d312fad230e04a3e1deed6a8732db09aa.exe
- Size 1.5MB
- Sample260831-fg73saveqa
- SHA256 ac3d323fbd142bc475632b55187be01d312fad230e04a3e1deed6a8732db09aa
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Suspicious use of SetThreadContext 1 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac3d323fbd142bc475632b55187be01d312fad230e04a3e1deed6a8732db09aa.exe"C:\Users\Admin\AppData\Local\Temp\ac3d323fbd142bc475632b55187be01d312fad230e04a3e1deed6a8732db09aa.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\convert.execonvert.exe2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /c move Community.eml Community.eml.bat && Community.eml.bat2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\findstr.exefindstr "bdservicehost ekrn AvastUI SophosHealth AVGUI nsWscSvc"3⤵
-
-
C:\Windows\system32\extrac32.exeextrac32 /Y Volleyball.eml *.*3⤵
-
-
C:\Windows\system32\findstr.exefindstr /V "Current" Capability3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\77608\Dark.scrDark.scr r3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\77608\Dark.scrC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\77608\Dark.scr4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\waitfor.exewaitfor /T 5 pDuRPDxZjbaONBxCwaxIYeLudzQOLwzZ3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Dark.scr
r
Accompanying.eml
Adobe
Appreciate.eml
Beginning
Bridge
Capability
Community.eml
Dns
Hidden
Learning.eml
Logo
Master
Northern
Nutten.eml
Overcome.eml
Panel
Secrets
Theaters
Utility
Volleyball.eml
Wiki.eml
memory/976-85-0x000001D8822D0000-0x000001D88236C000-memory.dmp
memory/976-86-0x000001D8822D0000-0x000001D88236C000-memory.dmp
memory/976-88-0x000001D8822D0000-0x000001D88236C000-memory.dmp
memory/976-89-0x000001D883F40000-0x000001D884340000-memory.dmp
memory/976-90-0x000001D883F40000-0x000001D884340000-memory.dmp
memory/976-92-0x00007FFBCB510000-0x00007FFBCB5CE000-memory.dmp
memory/976-93-0x00007FFBCA640000-0x00007FFBCA909000-memory.dmp
memory/976-91-0x00007FFBCCD10000-0x00007FFBCCF05000-memory.dmp
memory/976-95-0x000001D883E70000-0x000001D883EB1000-memory.dmp
memory/976-101-0x000001D883E70000-0x000001D883EB1000-memory.dmp