Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 23:58
General
- Target 901d6191e8bf99cf1a2a6b770519d18b82875294e95a55d1e87e42ef8bad213a.exe
- Size 3.7MB
- Sample260910-31lp8aztht
- SHA256 901d6191e8bf99cf1a2a6b770519d18b82875294e95a55d1e87e42ef8bad213a
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\901d6191e8bf99cf1a2a6b770519d18b82875294e95a55d1e87e42ef8bad213a.exe"C:\Users\Admin\AppData\Local\Temp\901d6191e8bf99cf1a2a6b770519d18b82875294e95a55d1e87e42ef8bad213a.exe"1⤵
- Creates a file in the Startup directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2932-2046-0x0000000000500000-0x00000000005AC000-memory.dmp
memory/2932-2047-0x0000000004AF0000-0x0000000004B00000-memory.dmp
memory/2932-2048-0x00000000049D0000-0x0000000004A5E000-memory.dmp
memory/2932-2049-0x0000000004D00000-0x0000000004E42000-memory.dmp
memory/2932-2050-0x0000000004AD0000-0x0000000004AD8000-memory.dmp
memory/2932-2052-0x0000000004AF0000-0x0000000004B00000-memory.dmp
memory/2932-2051-0x0000000005020000-0x0000000005086000-memory.dmp
memory/4432-84-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-82-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-4-0x0000000005280000-0x0000000005312000-memory.dmp
memory/4432-5-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-16-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-38-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-54-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-72-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-100-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-130-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-128-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-126-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-124-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-122-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-120-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-118-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-116-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-114-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-112-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-110-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-108-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-106-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-104-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-102-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-98-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-96-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-94-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-92-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-90-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-88-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-86-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-2-0x0000000005040000-0x000000000519E000-memory.dmp
memory/4432-76-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-80-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-3-0x0000000005750000-0x0000000005CF4000-memory.dmp
memory/4432-78-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-42-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-68-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-66-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-64-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-62-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-60-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-58-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-56-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-52-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-50-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-48-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-46-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-74-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-70-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-40-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-44-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-36-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-34-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-32-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-30-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-28-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-26-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-22-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-20-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-19-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-14-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-12-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-10-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-1-0x0000000005030000-0x0000000005040000-memory.dmp
memory/4432-0-0x00000000003E0000-0x0000000000794000-memory.dmp
memory/4432-8-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-6-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-24-0x0000000005040000-0x0000000005198000-memory.dmp
memory/4432-2041-0x0000000005360000-0x0000000005424000-memory.dmp
memory/4432-2042-0x0000000005480000-0x00000000054CC000-memory.dmp