Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
15/09/2026, 17:21
General
- Target net472/PulsarModified.exe
- Size 6.3MB
- Sample260915-vxcddayxet
- SHA256 f258ccbfce1e10daea3244538bdf0f84a2abe7949fffcabfc51a8aa29c3c6aa5
Malware Config
Signatures
- PulsaRAT library module 1 IoCs
Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\net472\PulsarModified.exe"C:\Users\Admin\AppData\Local\Temp\net472\PulsarModified.exe"1⤵
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x324 0x2481⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1604-0-0x0000027CF1D80000-0x0000027CF23DE000-memory.dmp
memory/1604-1-0x0000027CF27B0000-0x0000027CF27CE000-memory.dmp
memory/1604-2-0x0000027CF27A0000-0x0000027CF27B0000-memory.dmp
memory/1604-3-0x0000027CF53C0000-0x0000027CF55DC000-memory.dmp
memory/1604-4-0x0000027CF41F0000-0x0000027CF4210000-memory.dmp
memory/1604-5-0x0000027CF7C20000-0x0000027CF7C46000-memory.dmp
memory/1604-6-0x0000027CF7C00000-0x0000027CF7C08000-memory.dmp
memory/1604-7-0x0000027CF7C70000-0x0000027CF7C8E000-memory.dmp
memory/1604-8-0x0000027CF7C50000-0x0000027CF7C66000-memory.dmp
memory/1604-9-0x0000027CF53A0000-0x0000027CF53A8000-memory.dmp
memory/1604-10-0x0000027CF7CC0000-0x0000027CF7D40000-memory.dmp
memory/1604-11-0x0000027CF7D80000-0x0000027CF7DB4000-memory.dmp
memory/1604-12-0x0000027CF7D40000-0x0000027CF7D82000-memory.dmp
memory/1604-13-0x0000027CF7DE0000-0x0000027CF7DEA000-memory.dmp
memory/1604-14-0x0000027CF40D0000-0x0000027CF40DA000-memory.dmp
memory/1604-15-0x0000027CF7DF0000-0x0000027CF7EA2000-memory.dmp
memory/1604-16-0x0000027CF8430000-0x0000027CF8452000-memory.dmp
memory/1604-17-0x0000027CF7DC0000-0x0000027CF7DDC000-memory.dmp
memory/1604-18-0x0000027CF27A0000-0x0000027CF27B0000-memory.dmp
memory/1604-21-0x0000027CF84F0000-0x0000027CF8508000-memory.dmp
memory/1604-22-0x0000027CF8510000-0x0000027CF8636000-memory.dmp
memory/1604-23-0x0000027CF8680000-0x0000027CF86D0000-memory.dmp
memory/1604-24-0x0000027CF8790000-0x0000027CF8842000-memory.dmp
memory/1604-25-0x0000027CF8D20000-0x0000027CF91EC000-memory.dmp
memory/1604-26-0x0000027CF86D0000-0x0000027CF870C000-memory.dmp
memory/1604-27-0x0000027CF8710000-0x0000027CF875A000-memory.dmp
memory/1604-28-0x0000027CF8850000-0x0000027CF889E000-memory.dmp
memory/1604-29-0x0000027CF27A0000-0x0000027CF27B0000-memory.dmp
memory/1604-30-0x0000027CF27A0000-0x0000027CF27B0000-memory.dmp
memory/1604-31-0x0000027CF27A0000-0x0000027CF27B0000-memory.dmp
memory/1604-32-0x0000027CF27A0000-0x0000027CF27B0000-memory.dmp
memory/1604-33-0x0000027CF27A0000-0x0000027CF27B0000-memory.dmp
memory/1604-34-0x0000027CF27A0000-0x0000027CF27B0000-memory.dmp