Analysis
- user interaction
yes - max time kernel
299s - max time network
187s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 22:44
General
- Target tancerscanner.exe
- Size 68.3MB
- Sample260910-2n4vlahn6w
- SHA256 b642b115f1434cf45e120a90c5643d03ef58478be899a100572f06b3c9b3036b
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 4 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tancerscanner.exe"C:\Users\Admin\AppData\Local\Temp\tancerscanner.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Enumerates connected drives
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\ipconfig.exe"ipconfig.exe" /displaydns2⤵
- Gathers network information
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x24c 0x3081⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
WMSDKNS.XML.bak
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
vcruntime140_cor3.dll
wpfgfx_cor3.dll
tancer_bg_media.gif
memory/2780-104-0x00000309D0070000-0x00000309D0130000-memory.dmp
memory/2780-208-0x00000309D8800000-0x00000309D8900000-memory.dmp
memory/2780-45-0x000002C935F60000-0x000002C935F80000-memory.dmp
memory/2780-41-0x000002C934E90000-0x000002C934EA0000-memory.dmp
memory/2780-37-0x000002C934E70000-0x000002C934E90000-memory.dmp
memory/2780-33-0x000002C935EA0000-0x000002C935F20000-memory.dmp
memory/2780-57-0x000002C936290000-0x000002C9362D0000-memory.dmp
memory/2780-61-0x000002C936220000-0x000002C936240000-memory.dmp
memory/2780-69-0x000002C936BA0000-0x000002C936BC0000-memory.dmp
memory/2780-29-0x00000309CC810000-0x00000309CD040000-memory.dmp
memory/2780-80-0x000002C936BC0000-0x000002C936C10000-memory.dmp
memory/2780-76-0x00000309CEBF0000-0x00000309CED00000-memory.dmp
memory/2780-65-0x000002C936B70000-0x000002C936BA0000-memory.dmp
memory/2780-53-0x000002C9361E0000-0x000002C936200000-memory.dmp
memory/2780-84-0x00000309CF810000-0x00000309CFFB0000-memory.dmp
memory/2780-88-0x000002C936D30000-0x000002C936D60000-memory.dmp
memory/2780-92-0x00000309CEDE0000-0x00000309CEE70000-memory.dmp
memory/2780-96-0x00000309CED10000-0x00000309CED20000-memory.dmp
memory/2780-112-0x00000309CF000000-0x00000309CF050000-memory.dmp
memory/2780-108-0x00000309CEF60000-0x00000309CEF80000-memory.dmp
memory/2780-100-0x00000309CEFB0000-0x00000309CEFE0000-memory.dmp
memory/2780-116-0x00000309D0180000-0x00000309D01A0000-memory.dmp
memory/2780-6-0x000002C933B50000-0x000002C9347E0000-memory.dmp
memory/2780-120-0x00000309D02B0000-0x00000309D0300000-memory.dmp
memory/2780-49-0x000002C9361C0000-0x000002C9361E0000-memory.dmp
memory/2780-22-0x000002C934DA0000-0x000002C934DF0000-memory.dmp
memory/2780-183-0x00000309D7F20000-0x00000309D7FD0000-memory.dmp
memory/2780-133-0x00000309D0B30000-0x00000309D0C90000-memory.dmp
memory/2780-137-0x000002C931140000-0x000002C931150000-memory.dmp
memory/2780-141-0x00000309D0EB0000-0x00000309D1020000-memory.dmp
memory/2780-17-0x000002C932D50000-0x000002C932EB0000-memory.dmp
memory/2780-154-0x00000309D0420000-0x00000309D0430000-memory.dmp
memory/2780-159-0x00000309D6310000-0x00000309D6320000-memory.dmp
memory/2780-166-0x00000309D6350000-0x00000309D6370000-memory.dmp
memory/2780-171-0x00000309D6430000-0x00000309D65E0000-memory.dmp
memory/2780-129-0x00000309D04C0000-0x00000309D0530000-memory.dmp
memory/2780-179-0x00000309D6800000-0x00000309D6870000-memory.dmp
memory/2780-175-0x00000309D6620000-0x00000309D6660000-memory.dmp
memory/2780-162-0x00000309D7A70000-0x00000309D7C70000-memory.dmp
memory/2780-191-0x00000309D63F0000-0x00000309D6410000-memory.dmp
memory/2780-187-0x00000309D8240000-0x00000309D82D0000-memory.dmp
memory/2780-199-0x00000309D6770000-0x00000309D6790000-memory.dmp
memory/2780-195-0x00000309D6680000-0x00000309D66B0000-memory.dmp
memory/2780-205-0x00000309D8420000-0x00000309D8480000-memory.dmp
memory/2780-25-0x000002C934E30000-0x000002C934E70000-memory.dmp
memory/2780-212-0x00000309D82D0000-0x00000309D8300000-memory.dmp
memory/2780-13-0x000002C934A10000-0x000002C934C40000-memory.dmp
memory/2780-221-0x00000309D7FD0000-0x00000309D7FE0000-memory.dmp
memory/2780-225-0x00000309D80A0000-0x00000309D8100000-memory.dmp
memory/2780-230-0x00000309D7FE0000-0x00000309D7FF0000-memory.dmp
memory/2780-10-0x00000309CB8B0000-0x00000309CC810000-memory.dmp