Analysis
- user interaction
yes - max time kernel
29s - max time network
32s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
10/09/2026, 09:24
General
- Target main.exe
- Size 449KB
- Sample260910-ldhlls1dla
- SHA256 c57ea97c70c9ba2056f94f035ec23348ae3921f63af35368be785f8c26f91c6c
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
Processes
-
C:\Users\Admin\AppData\Local\Temp\main.exe"C:\Users\Admin\AppData\Local\Temp\main.exe"1⤵
- Creates a file in the Startup directory
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\UnblockDeny.xlsx"1⤵
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\UnblockDeny.xlsx"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1772-5-0x00007FF997830000-0x00007FF997840000-memory.dmp
memory/1772-14-0x00007FF9D77B0000-0x00007FF9D79A8000-memory.dmp
memory/1772-4-0x00007FF9D784D000-0x00007FF9D784E000-memory.dmp
memory/1772-3-0x00007FF997830000-0x00007FF997840000-memory.dmp
memory/1772-2-0x00007FF997830000-0x00007FF997840000-memory.dmp
memory/1772-8-0x00007FF9D77B0000-0x00007FF9D79A8000-memory.dmp
memory/1772-1-0x00007FF997830000-0x00007FF997840000-memory.dmp
memory/1772-11-0x00007FF9D77B0000-0x00007FF9D79A8000-memory.dmp
memory/1772-6-0x00007FF997830000-0x00007FF997840000-memory.dmp
memory/1772-12-0x00007FF9D77B0000-0x00007FF9D79A8000-memory.dmp
memory/1772-10-0x00007FF9D77B0000-0x00007FF9D79A8000-memory.dmp
memory/1772-13-0x00007FF9950D0000-0x00007FF9950E0000-memory.dmp
memory/1772-9-0x00007FF9D77B0000-0x00007FF9D79A8000-memory.dmp
memory/1772-7-0x00007FF9D77B0000-0x00007FF9D79A8000-memory.dmp
memory/2164-0-0x00007FF658FE0000-0x00007FF659046000-memory.dmp