Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/09/2026, 00:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dollar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
dollar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target dollar.exe
- Size 538KB
- Sample260909-ake9aaac26
- SHA256 a75d32c6eba92012707da7a2ad8b800f4ab081947aa7b793ae14d7348fd2d27b
- MD5 080147ed04c5a1e16cd85f975aa4fdab
- SHA1 a20cc329748f9ea497397f526a05f918d7a6abba
- SHA512 70742bff4ec19e8fec0296e47adf5f158805f5217e4533f2a28221a6b1ad6bb1dbecc83454b8ec9d68f27d30f6e7483ada31170960d7111b533c4eeb60c318e8
- SSDEEP 12288:U6W+8ztB5Z5LWUamuri3Ii04UnUNZ+xVJ5:jG5ZVlag3504UUP+F5
- TLSH T1C2C4F111F69540F5D026C5B9886285B1E6B2B8517F61CEEF03B006573F27AD4AF3EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\ansel\twepsursisly dollar.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4972 explorer.exe - Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 4972 explorer.exe Token: SeCreatePagefilePrivilege 4972 explorer.exe Token: SeShutdownPrivilege 4972 explorer.exe Token: SeCreatePagefilePrivilege 4972 explorer.exe Token: SeShutdownPrivilege 4972 explorer.exe Token: SeCreatePagefilePrivilege 4972 explorer.exe Token: SeShutdownPrivilege 4972 explorer.exe Token: SeCreatePagefilePrivilege 4972 explorer.exe Token: SeShutdownPrivilege 4972 explorer.exe Token: SeCreatePagefilePrivilege 4972 explorer.exe Token: SeShutdownPrivilege 4972 explorer.exe Token: SeCreatePagefilePrivilege 4972 explorer.exe Token: SeShutdownPrivilege 4972 explorer.exe Token: SeCreatePagefilePrivilege 4972 explorer.exe Token: SeShutdownPrivilege 4972 explorer.exe Token: SeCreatePagefilePrivilege 4972 explorer.exe Token: SeShutdownPrivilege 4972 explorer.exe Token: SeCreatePagefilePrivilege 4972 explorer.exe Token: SeShutdownPrivilege 4972 explorer.exe Token: SeCreatePagefilePrivilege 4972 explorer.exe Token: SeShutdownPrivilege 4972 explorer.exe Token: SeCreatePagefilePrivilege 4972 explorer.exe Token: SeShutdownPrivilege 4972 explorer.exe Token: SeCreatePagefilePrivilege 4972 explorer.exe Token: SeShutdownPrivilege 4972 explorer.exe Token: SeCreatePagefilePrivilege 4972 explorer.exe Token: SeShutdownPrivilege 4972 explorer.exe Token: SeCreatePagefilePrivilege 4972 explorer.exe Token: SeShutdownPrivilege 4972 explorer.exe Token: SeCreatePagefilePrivilege 4972 explorer.exe Token: SeShutdownPrivilege 4972 explorer.exe Token: SeCreatePagefilePrivilege 4972 explorer.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5404 dollar.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5404 wrote to memory of 4972 5404 dollar.exe 81
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\dollar.exe"C:\Users\Admin\AppData\Local\Temp\dollar.exe"2⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5404
-