Analysis
- max time kernel
148s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
15/09/2026, 17:21
General
- Target net472/PulsarModified.exe
- Size 6.3MB
- Sample260915-vxcddayxet
- SHA256 f258ccbfce1e10daea3244538bdf0f84a2abe7949fffcabfc51a8aa29c3c6aa5
Malware Config
Signatures
- PulsaRAT library module 1 IoCs
Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\net472\PulsarModified.exe"C:\Users\Admin\AppData\Local\Temp\net472\PulsarModified.exe"1⤵
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004C01⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1528-0-0x00007FFD973EF000-0x00007FFD973F0000-memory.dmp
memory/1528-1-0x000002370D6D0000-0x000002370DD2E000-memory.dmp
memory/1528-2-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/1528-3-0x000002370F980000-0x000002370F99E000-memory.dmp
memory/1528-4-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/1528-5-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/1528-6-0x0000023728690000-0x00000237288AC000-memory.dmp
memory/1528-7-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/1528-8-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/1528-9-0x000002370FA70000-0x000002370FA90000-memory.dmp
memory/1528-11-0x000002370FC80000-0x000002370FC88000-memory.dmp
memory/1528-12-0x0000023728670000-0x000002372868E000-memory.dmp
memory/1528-10-0x000002372B6C0000-0x000002372B6E6000-memory.dmp
memory/1528-13-0x000002370FC60000-0x000002370FC76000-memory.dmp
memory/1528-14-0x000002370FC90000-0x000002370FC98000-memory.dmp
memory/1528-17-0x000002372B760000-0x000002372B7A2000-memory.dmp
memory/1528-18-0x000002372B8B0000-0x000002372B8BA000-memory.dmp
memory/1528-19-0x000002370FAA0000-0x000002370FAAA000-memory.dmp
memory/1528-16-0x000002372B840000-0x000002372B874000-memory.dmp
memory/1528-15-0x000002372B7C0000-0x000002372B840000-memory.dmp
memory/1528-20-0x000002372B8C0000-0x000002372B972000-memory.dmp
memory/1528-21-0x000002372BD20000-0x000002372BD42000-memory.dmp
memory/1528-22-0x000002372B890000-0x000002372B8AC000-memory.dmp
memory/1528-23-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/1528-24-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/1528-25-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/1528-28-0x000002372BDB0000-0x000002372BDC8000-memory.dmp
memory/1528-29-0x000002372BDD0000-0x000002372BEF6000-memory.dmp
memory/1528-30-0x000002372BF40000-0x000002372BF90000-memory.dmp
memory/1528-31-0x000002372C050000-0x000002372C102000-memory.dmp
memory/1528-32-0x000002372C5E0000-0x000002372CAAC000-memory.dmp
memory/1528-33-0x000002372BF90000-0x000002372BFCC000-memory.dmp
memory/1528-34-0x000002372BFD0000-0x000002372C01A000-memory.dmp
memory/1528-35-0x000002372C110000-0x000002372C15E000-memory.dmp
memory/1528-36-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/1528-37-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/1528-38-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/1528-39-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/1528-40-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp