Analysis
- max time kernel
149s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 23:58
General
- Target 901d6191e8bf99cf1a2a6b770519d18b82875294e95a55d1e87e42ef8bad213a.exe
- Size 3.7MB
- Sample260910-31lp8aztht
- SHA256 901d6191e8bf99cf1a2a6b770519d18b82875294e95a55d1e87e42ef8bad213a
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\901d6191e8bf99cf1a2a6b770519d18b82875294e95a55d1e87e42ef8bad213a.exe"C:\Users\Admin\AppData\Local\Temp\901d6191e8bf99cf1a2a6b770519d18b82875294e95a55d1e87e42ef8bad213a.exe"1⤵
- Creates a file in the Startup directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4352-0-0x0000000074CC2000-0x0000000074CC3000-memory.dmp
memory/4352-1-0x00000000004D0000-0x0000000000884000-memory.dmp
memory/4352-2-0x0000000074CB0000-0x000000007546C000-memory.dmp
memory/4352-3-0x0000000005330000-0x000000000548E000-memory.dmp
memory/4352-4-0x0000000005AA0000-0x000000000605A000-memory.dmp
memory/4352-5-0x00000000055D0000-0x0000000005662000-memory.dmp
memory/4352-6-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-7-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-39-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-67-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-117-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-119-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-131-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-129-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-127-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-125-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-123-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-122-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-115-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-113-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-111-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-109-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-107-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-105-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-103-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-101-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-99-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-97-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-95-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-93-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-91-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-89-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-87-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-84-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-85-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-81-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-79-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-73-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-71-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-69-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-76-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-77-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-65-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-63-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-61-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-59-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-57-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-55-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-53-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-51-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-49-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-47-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-45-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-43-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-41-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-35-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-33-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-31-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-29-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-27-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-25-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-23-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-19-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-37-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-21-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-17-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-13-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-11-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-9-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-16-0x0000000005330000-0x0000000005488000-memory.dmp
memory/4352-2042-0x00000000056D0000-0x0000000005794000-memory.dmp
memory/4352-2043-0x00000000057B0000-0x00000000057FC000-memory.dmp
memory/4352-2045-0x0000000074CC2000-0x0000000074CC3000-memory.dmp
memory/4352-2046-0x0000000074CB0000-0x000000007546C000-memory.dmp
memory/4352-2050-0x0000000074CB0000-0x000000007546C000-memory.dmp
memory/4352-2056-0x0000000074CB0000-0x000000007546C000-memory.dmp
memory/5728-2049-0x0000000000550000-0x00000000005FC000-memory.dmp
memory/5728-2051-0x0000000004EF0000-0x0000000004F7E000-memory.dmp
memory/5728-2053-0x00000000051D0000-0x0000000005312000-memory.dmp
memory/5728-2052-0x0000000074CB0000-0x000000007546C000-memory.dmp
memory/5728-2054-0x0000000074CB0000-0x000000007546C000-memory.dmp
memory/5728-2055-0x0000000002980000-0x0000000002988000-memory.dmp
memory/5728-2057-0x00000000054F0000-0x0000000005556000-memory.dmp
memory/5728-2058-0x0000000074CB0000-0x000000007546C000-memory.dmp
memory/5728-2059-0x0000000074CB0000-0x000000007546C000-memory.dmp