Analysis
- max time kernel
149s - max time network
23s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
- submitted
13/09/2026, 15:12
General
- Target WinOptimizer-Portable (1).exe
- Size 63.0MB
- Sample260913-sk7yeahm5s
- SHA256 097a3722998274327807a8f2c37ea2a46d34cc2dd876c2903269d0ae86e0a00a
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\WinOptimizer-Portable (1).exe"C:\Users\Admin\AppData\Local\Temp\WinOptimizer-Portable (1).exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4328-5-0x000001B1B8210000-0x000001B1B8EA0000-memory.dmp
memory/4328-13-0x000001B1B6DF0000-0x000001B1B6E10000-memory.dmp
memory/4328-25-0x000001B1B7410000-0x000001B1B7430000-memory.dmp
memory/4328-29-0x000001B1B8EA0000-0x000001B1B8F30000-memory.dmp
memory/4328-21-0x000001B1B6EC0000-0x000001B1B6EE0000-memory.dmp
memory/4328-17-0x000001B1BA1F0000-0x000001B1BA4D0000-memory.dmp
memory/4328-9-0x000001F24F980000-0x000001F250670000-memory.dmp
memory/4328-33-0x000001B1B7440000-0x000001B1B7490000-memory.dmp
memory/4328-41-0x000001B1B8FB0000-0x000001B1B8FD0000-memory.dmp
memory/4328-37-0x000001B1B7520000-0x000001B1B7540000-memory.dmp
memory/4328-51-0x000001B1B93C0000-0x000001B1B9400000-memory.dmp
memory/4328-67-0x000001B1B9450000-0x000001B1B9470000-memory.dmp
memory/4328-71-0x000001B1B94F0000-0x000001B1B9500000-memory.dmp
memory/4328-63-0x000001B1B8FD0000-0x000001B1B8FF0000-memory.dmp
memory/4328-59-0x000001B1B9350000-0x000001B1B9380000-memory.dmp
memory/4328-55-0x000001B1BA850000-0x000001B1BA9D0000-memory.dmp
memory/4328-47-0x000001B1B9020000-0x000001B1B9050000-memory.dmp
memory/4328-75-0x000001F253D50000-0x000001F253D80000-memory.dmp
memory/4328-79-0x000001F254FE0000-0x000001F255000000-memory.dmp
memory/4328-83-0x000001F255010000-0x000001F255030000-memory.dmp
memory/4328-87-0x000001F255B40000-0x000001F255C00000-memory.dmp
memory/4328-92-0x000001B1BAC30000-0x000001B1BAC40000-memory.dmp
memory/4328-95-0x000001F256000000-0x000001F256050000-memory.dmp
memory/4328-99-0x000001F255080000-0x000001F255090000-memory.dmp
memory/4328-103-0x000001B1B6DD0000-0x000001B1B6DE0000-memory.dmp
memory/4328-113-0x000001F256930000-0x000001F256A40000-memory.dmp
memory/4328-117-0x000001F256B10000-0x000001F256BE0000-memory.dmp
memory/4328-109-0x000001F256700000-0x000001F256710000-memory.dmp