Analysis
- max time kernel
56s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
07/09/2026, 03:51
General
- Target velarion.exe
- Size 443KB
- Sample260907-eespmswwbv
- SHA256 e79223cd6676f1807cf8f2b3c9ff77a27ddb148f6cb1e791b6f6cb1c04d886ee
Malware Config
Signatures
- Drops desktop.ini file(s) 18 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 14 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: AddClipboardFormatListener 7 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\velarion.exe"C:\Users\Admin\AppData\Local\Temp\velarion.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe C:\ProgramData\SystemInfo2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe C:\ProgramData\SystemInfo2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe C:\ProgramData\SystemInfo2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe C:\ProgramData\SystemInfo2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe C:\ProgramData\SystemInfo2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe C:\ProgramData\SystemInfo2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe C:\ProgramData\SystemInfo2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe C:\ProgramData\SystemInfo2⤵
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe C:\ProgramData\SystemInfo2⤵
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe C:\ProgramData\SystemInfo2⤵
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe C:\ProgramData\SystemInfo2⤵
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe C:\ProgramData\SystemInfo2⤵
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe C:\ProgramData\SystemInfo2⤵
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe C:\ProgramData\SystemInfo2⤵
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe C:\ProgramData\SystemInfo2⤵
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe C:\ProgramData\SystemInfo2⤵
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe C:\ProgramData\SystemInfo2⤵
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe C:\ProgramData\SystemInfo2⤵
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe C:\ProgramData\SystemInfo2⤵
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe C:\ProgramData\SystemInfo2⤵
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe C:\ProgramData\SystemInfo2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/832-47-0x000000000E300000-0x000000000E3A9000-memory.dmp
memory/908-107-0x0000000000400000-0x000000000051A000-memory.dmp
memory/908-41-0x0000000000400000-0x000000000051A000-memory.dmp
memory/908-128-0x0000000000400000-0x000000000051A000-memory.dmp
memory/908-5-0x0000000000400000-0x000000000051A000-memory.dmp
memory/908-21-0x0000000000400000-0x000000000051A000-memory.dmp
memory/908-149-0x0000000000400000-0x000000000051A000-memory.dmp
memory/908-9-0x0000000000400000-0x000000000051A000-memory.dmp
memory/908-0-0x0000000000400000-0x000000000051A000-memory.dmp
memory/908-14-0x0000000000400000-0x000000000051A000-memory.dmp
memory/908-57-0x0000000000400000-0x000000000051A000-memory.dmp
memory/908-3-0x0000000000400000-0x000000000051A000-memory.dmp
memory/908-90-0x0000000000400000-0x000000000051A000-memory.dmp
memory/908-72-0x0000000000400000-0x000000000051A000-memory.dmp
memory/908-29-0x0000000000400000-0x000000000051A000-memory.dmp
memory/908-1-0x0000000000400000-0x000000000051A000-memory.dmp
memory/908-2-0x0000000000400000-0x000000000051A000-memory.dmp
memory/1584-8-0x000000000E2F0000-0x000000000E399000-memory.dmp
memory/2124-4-0x000000000DEB0000-0x000000000DF59000-memory.dmp
memory/2216-24-0x000000000E4F0000-0x000000000E599000-memory.dmp
memory/3364-32-0x000000000E490000-0x000000000E539000-memory.dmp
memory/3632-39-0x000000000E920000-0x000000000E9C9000-memory.dmp
memory/3828-16-0x000000000E9C0000-0x000000000EA69000-memory.dmp
memory/3964-20-0x000000000E170000-0x000000000E219000-memory.dmp
memory/4268-161-0x000000000D840000-0x000000000D8E9000-memory.dmp
memory/4848-11-0x000000000D500000-0x000000000D5A9000-memory.dmp
memory/5092-60-0x000000000DE20000-0x000000000DEC9000-memory.dmp
memory/5648-6-0x000000000E0E0000-0x000000000E189000-memory.dmp
memory/6056-146-0x000000000DEA0000-0x000000000DF49000-memory.dmp
memory/6256-69-0x000000000E0E0000-0x000000000E189000-memory.dmp
memory/6552-79-0x000000000E670000-0x000000000E719000-memory.dmp
memory/6852-132-0x000000000DCF0000-0x000000000DD99000-memory.dmp
memory/6864-93-0x000000000E8E0000-0x000000000E989000-memory.dmp
memory/6956-119-0x000000000DE50000-0x000000000DEF9000-memory.dmp
memory/7164-103-0x000000000E1C0000-0x000000000E269000-memory.dmp