Analysis
- user interaction
yes - max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
07/09/2026, 16:36
General
- Target Antivirus.exe
- Size 35.4MB
- Sample260907-t4dpca1dkc
- SHA256 b5999b127cb17b28c9451d015f237d6bd0336b7cd801350f8f51f03afc615f98
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 58 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Antivirus.exe"C:\Users\Admin\AppData\Local\Temp\Antivirus.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c set2⤵
- Executes a command shell one-liner
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
evb7ABA.tmp
evb7AF9.tmp
evb7B0A.tmp
memory/812-28-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/812-4-0x00007FFB92630000-0x00007FFB92825000-memory.dmp
memory/812-5-0x00007FFB92630000-0x00007FFB92825000-memory.dmp
memory/812-2-0x00007FFB92630000-0x00007FFB92825000-memory.dmp
memory/812-16-0x000000037C1A0000-0x000000037C231000-memory.dmp
memory/812-21-0x00000002E3650000-0x00000002E3666000-memory.dmp
memory/812-25-0x00007FFB92630000-0x00007FFB92825000-memory.dmp
memory/812-26-0x000000037C1A0000-0x000000037C231000-memory.dmp
memory/812-24-0x00000002E3650000-0x00000002E3666000-memory.dmp
memory/812-3-0x00007FFB92630000-0x00007FFB92825000-memory.dmp
memory/812-1-0x00007FFB926CD000-0x00007FFB926CE000-memory.dmp
memory/812-23-0x0000000356B30000-0x0000000356DE3000-memory.dmp
memory/812-8-0x0000000356B30000-0x0000000356DE3000-memory.dmp
memory/812-22-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/812-27-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/812-0-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/812-30-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/812-29-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/812-54-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/812-31-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/812-33-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/812-37-0x00000002E3650000-0x00000002E3666000-memory.dmp
memory/812-34-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/812-43-0x00007FFB92630000-0x00007FFB92825000-memory.dmp
memory/812-42-0x00007FFB926CD000-0x00007FFB926CE000-memory.dmp
memory/812-48-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/812-52-0x00007FFB92630000-0x00007FFB92825000-memory.dmp
memory/812-53-0x00007FFB92630000-0x00007FFB92825000-memory.dmp
memory/812-32-0x00007FFB92630000-0x00007FFB92825000-memory.dmp
memory/812-66-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/812-70-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/812-74-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/812-78-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/812-82-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/812-86-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/812-90-0x0000000140000000-0x00000001443BE000-memory.dmp