Analysis
- user interaction
yes - max time kernel
45s - max time network
46s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
10/09/2026, 19:35
General
- Target 2.7.exe
- Size 55KB
- Sample260910-yaz3psed77
- SHA256 73bc2ee1c189d5798b8006db976f07ea7f21be8c7f8e4d810e1ac5f7aeb4aa5b
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 18 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2.7.exe"C:\Users\Admin\AppData\Local\Temp\2.7.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
wlrmdr.exe
memory/3080-0-0x0000022495D50000-0x0000022495D52000-memory.dmp
memory/3364-10-0x0000000180000000-0x0000000180005000-memory.dmp
memory/3364-16-0x0000000002AD0000-0x0000000002AD1000-memory.dmp
memory/3364-20-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-21-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-22-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-23-0x00007FF89F102000-0x00007FF89F103000-memory.dmp
memory/3364-24-0x00007FF89F060000-0x00007FF89F167000-memory.dmp
memory/3364-25-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-28-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-27-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-26-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-30-0x00007FF89F060000-0x00007FF89F167000-memory.dmp
memory/3364-29-0x00007FF89F060000-0x00007FF89F167000-memory.dmp
memory/3364-31-0x00007FF89F060000-0x00007FF89F167000-memory.dmp
memory/3364-32-0x00007FF89F060000-0x00007FF89F167000-memory.dmp
memory/3364-33-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-34-0x00007FF89F060000-0x00007FF89F167000-memory.dmp
memory/3364-41-0x00007FF89F060000-0x00007FF89F167000-memory.dmp
memory/3364-40-0x00007FF89F060000-0x00007FF89F167000-memory.dmp
memory/3364-39-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-38-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-37-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-36-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-35-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-45-0x00007FF89F060000-0x00007FF89F167000-memory.dmp
memory/3364-46-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-44-0x00007FF89F060000-0x00007FF89F167000-memory.dmp
memory/3364-43-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-42-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-48-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-49-0x00007FF89F060000-0x00007FF89F167000-memory.dmp
memory/3364-47-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-50-0x00007FF89F060000-0x00007FF89F167000-memory.dmp
memory/3364-51-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-52-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-53-0x00007FF89F060000-0x00007FF89F167000-memory.dmp
memory/3364-54-0x00007FF89F060000-0x00007FF89F167000-memory.dmp
memory/3364-58-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-57-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-56-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-55-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-60-0x00007FF89F060000-0x00007FF89F167000-memory.dmp
memory/3364-59-0x00007FF89F060000-0x00007FF89F167000-memory.dmp
memory/3364-61-0x00007FF89F060000-0x00007FF89F167000-memory.dmp
memory/3364-62-0x00007FF89F060000-0x00007FF89F167000-memory.dmp
memory/3364-63-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-65-0x00007FF89F060000-0x00007FF89F167000-memory.dmp
memory/3364-64-0x00007FF89F060000-0x00007FF89F167000-memory.dmp
memory/3364-72-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-66-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-71-0x00007FF89F060000-0x00007FF89F167000-memory.dmp
memory/3364-74-0x00007FF89F060000-0x00007FF89F167000-memory.dmp
memory/3364-75-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-78-0x00007FF89F060000-0x00007FF89F167000-memory.dmp
memory/3364-80-0x00007FF89F060000-0x00007FF89F167000-memory.dmp
memory/3364-77-0x00007FF89F060000-0x00007FF89F167000-memory.dmp
memory/3364-76-0x00007FF89F060000-0x00007FF89F167000-memory.dmp
memory/3364-79-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-73-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-70-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-69-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-68-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3364-67-0x0000000002A90000-0x0000000002AA0000-memory.dmp