Analysis
- max time kernel
150s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
07/09/2026, 16:36
General
- Target Antivirus.exe
- Size 35.4MB
- Sample260907-t4dpca1dkc
- SHA256 b5999b127cb17b28c9451d015f237d6bd0336b7cd801350f8f51f03afc615f98
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Antivirus.exe"C:\Users\Admin\AppData\Local\Temp\Antivirus.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c set2⤵
- Executes a command shell one-liner
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
evbAD4E.tmp
evbAD9D.tmp
evbADED.tmp
memory/3620-26-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/3620-32-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/3620-5-0x00007FFFDBDE0000-0x00007FFFDC043000-memory.dmp
memory/3620-4-0x00007FFFDBDE0000-0x00007FFFDC043000-memory.dmp
memory/3620-7-0x00007FFFDBDE0000-0x00007FFFDC043000-memory.dmp
memory/3620-8-0x00007FFFDBDE0000-0x00007FFFDC043000-memory.dmp
memory/3620-3-0x00007FFFDBDE0000-0x00007FFFDC043000-memory.dmp
memory/3620-11-0x0000000356B30000-0x0000000356DE3000-memory.dmp
memory/3620-18-0x0000000356B30000-0x0000000356DE3000-memory.dmp
memory/3620-34-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/3620-20-0x000000037C1A0000-0x000000037C231000-memory.dmp
memory/3620-25-0x00000002E3650000-0x00000002E3666000-memory.dmp
memory/3620-0-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/3620-29-0x00007FFFDBDE0000-0x00007FFFDC043000-memory.dmp
memory/3620-28-0x00000002E3650000-0x00000002E3666000-memory.dmp
memory/3620-27-0x000000037C1A0000-0x000000037C231000-memory.dmp
memory/3620-35-0x00007FFFDBDE0000-0x00007FFFDC043000-memory.dmp
memory/3620-1-0x00007FFFDBF3F000-0x00007FFFDBF40000-memory.dmp
memory/3620-6-0x00007FFFDBDE0000-0x00007FFFDC043000-memory.dmp
memory/3620-30-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/3620-2-0x00007FFFDBDE0000-0x00007FFFDC043000-memory.dmp
memory/3620-31-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/3620-33-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/3620-40-0x00000002E3650000-0x00000002E3666000-memory.dmp
memory/3620-41-0x00007FFFDBDE0000-0x00007FFFDC043000-memory.dmp
memory/3620-36-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/3620-43-0x00007FFFDBDE0000-0x00007FFFDC043000-memory.dmp
memory/3620-42-0x00007FFFDBF3F000-0x00007FFFDBF40000-memory.dmp
memory/3620-37-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/3620-52-0x00007FFFDBDE0000-0x00007FFFDC043000-memory.dmp
memory/3620-57-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/3620-61-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/3620-69-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/3620-73-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/3620-81-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/3620-85-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/3620-89-0x0000000140000000-0x00000001443BE000-memory.dmp
memory/3620-93-0x0000000140000000-0x00000001443BE000-memory.dmp