Analysis
- max time kernel
151s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/09/2026, 18:39
General
- Target 66mods Tweaker.exe
- Size 75.1MB
- Sample260909-xa4kfsdf49
- SHA256 b65767ad6e87178e8453d410ab7cb427a40bae509d11dc340a6ef679211c229b
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
- Power Settings 1 TTPs 2 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 36 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\66mods Tweaker.exe"C:\Users\Admin\AppData\Local\Temp\66mods Tweaker.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /getactivescheme2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /list2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
baseline.json
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
wpfgfx_cor3.dll
memory/4168-78-0x000001BD83590000-0x000001BD836A0000-memory.dmp
memory/4168-61-0x000001BD83280000-0x000001BD832A0000-memory.dmp
memory/4168-69-0x000001BD833D0000-0x000001BD833F0000-memory.dmp
memory/4168-57-0x000001BD832F0000-0x000001BD83330000-memory.dmp
memory/4168-49-0x000001BD81470000-0x000001BD81490000-memory.dmp
memory/4168-88-0x000001BD836F0000-0x000001BD83720000-memory.dmp
memory/4168-84-0x000001BD84200000-0x000001BD849A0000-memory.dmp
memory/4168-92-0x000001BD83830000-0x000001BD838C0000-memory.dmp
memory/4168-128-0x000001BD80000000-0x000001BD80010000-memory.dmp
memory/4168-124-0x000001BD84F10000-0x000001BD84F50000-memory.dmp
memory/4168-120-0x000001BD84FB0000-0x000001BD85010000-memory.dmp
memory/4168-116-0x000001BD83A30000-0x000001BD83A50000-memory.dmp
memory/4168-112-0x000001BD84EB0000-0x000001BD84F00000-memory.dmp
memory/4168-108-0x000001BD83750000-0x000001BD83760000-memory.dmp
memory/4168-100-0x000001BD84DA0000-0x000001BD84E60000-memory.dmp
memory/4168-104-0x000001BD838F0000-0x000001BD83910000-memory.dmp
memory/4168-96-0x000001BD83770000-0x000001BD837A0000-memory.dmp
memory/4168-80-0x000001BD836A0000-0x000001BD836F0000-memory.dmp
memory/4168-5-0x000001BDB0C90000-0x000001BDB1920000-memory.dmp
memory/4168-53-0x000001BD83240000-0x000001BD83260000-memory.dmp
memory/4168-29-0x000001BD80BB0000-0x000001BD813E0000-memory.dmp
memory/4168-45-0x000001BD813F0000-0x000001BD81410000-memory.dmp
memory/4168-66-0x000001BD833A0000-0x000001BD833D0000-memory.dmp
memory/4168-41-0x000001BD80360000-0x000001BD80370000-memory.dmp
memory/4168-37-0x000001BD80340000-0x000001BD80360000-memory.dmp
memory/4168-33-0x000001BD800C0000-0x000001BD80140000-memory.dmp
memory/4168-17-0x000001BDAFE80000-0x000001BDAFFE0000-memory.dmp
memory/4168-13-0x000001BDB1C40000-0x000001BDB1E70000-memory.dmp
memory/4168-132-0x000001BD86310000-0x000001BD86510000-memory.dmp
memory/4168-136-0x000001BD86680000-0x000001BD867F0000-memory.dmp
memory/4168-140-0x000001BD85B70000-0x000001BD85B90000-memory.dmp
memory/4168-144-0x000001BD86970000-0x000001BD86A70000-memory.dmp
memory/4168-148-0x000001BD85B60000-0x000001BD85B70000-memory.dmp
memory/4168-152-0x000001BD86A70000-0x000001BD86AC0000-memory.dmp
memory/4168-22-0x000001BDAF860000-0x000001BDAF8B0000-memory.dmp
memory/4168-25-0x000001BDAF910000-0x000001BDAF950000-memory.dmp
memory/4168-9-0x000001BDB3050000-0x000001BDB3FB0000-memory.dmp
memory/4168-172-0x000001BD86B30000-0x000001BD86BA0000-memory.dmp
memory/4168-176-0x000001BD86DA0000-0x000001BD86F00000-memory.dmp
memory/4168-180-0x000001BD85B50000-0x000001BD85B60000-memory.dmp
memory/4168-185-0x000001BD89040000-0x000001BD89050000-memory.dmp