Analysis
- max time kernel
165s - max time network
172s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
05/09/2026, 00:12
General
- Target main module/Main Startup AI.exe
- Size 15.3MB
- Sample260905-ahcelssgre
- SHA256 290e4aa7ed64c728138711c011e89aab7aa48dbc1ae430371dc2be4100b92bf0
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\main module\Main Startup AI.exe"C:\Users\Admin\AppData\Local\Temp\main module\Main Startup AI.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /query /fo CSV /v /nh2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Tmp3CE0.tmp
memory/5960-7-0x0000027B62F10000-0x0000027B62F64000-memory.dmp
memory/5960-5-0x00007FFF67A8F000-0x00007FFF67A90000-memory.dmp
memory/5960-0-0x0000027B48780000-0x0000027B48785000-memory.dmp
memory/5960-6-0x00007FFF67900000-0x00007FFF682A4000-memory.dmp
memory/5960-8-0x0000027B4AB40000-0x0000027B4AB58000-memory.dmp
memory/5960-9-0x0000027B62FD0000-0x0000027B6301C000-memory.dmp
memory/5960-10-0x00007FFF67900000-0x00007FFF682A4000-memory.dmp
memory/5960-11-0x00007FFF67900000-0x00007FFF682A4000-memory.dmp
memory/5960-4-0x0000027B4A9A0000-0x0000027B4A9A8000-memory.dmp
memory/5960-22-0x00007FFF67900000-0x00007FFF682A4000-memory.dmp
memory/5960-23-0x00007FFF67900000-0x00007FFF682A4000-memory.dmp
memory/5960-24-0x00007FFF67900000-0x00007FFF682A4000-memory.dmp