Analysis
- max time kernel
148s - max time network
109s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
16/09/2026, 10:31
General
- Target 7c10d571f05db22c7fbd0bd7a93b59f22d44a2b9934a6583071d7fb561475225.exe
- Size 4.7MB
- Sample260916-mkl32sts7l
- SHA256 7c10d571f05db22c7fbd0bd7a93b59f22d44a2b9934a6583071d7fb561475225
Malware Config
Signatures
- Adds policy Run key to start application 2 TTPs 2 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c10d571f05db22c7fbd0bd7a93b59f22d44a2b9934a6583071d7fb561475225.exe"C:\Users\Admin\AppData\Local\Temp\7c10d571f05db22c7fbd0bd7a93b59f22d44a2b9934a6583071d7fb561475225.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7c10d571f05db22c7fbd0bd7a93b59f22d44a2b9934a6583071d7fb561475225.exeC:\Users\Admin\AppData\Local\Temp\7c10d571f05db22c7fbd0bd7a93b59f22d44a2b9934a6583071d7fb561475225.exe 47043E0458045104770461047604770458044504600469046D046A0458044504740474044004650470046504580456046B04650469046D046A0463045804600470046E0431046E045804650456044C0435044A045B0466045C04560470045C043604480457046B04560458046D0430044204310434047E0431047C043404--\k\a`2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\dtj5j\aRH1N_bXRtX2LSoR\i4F50z5x0.exe"C:\Users\Admin\AppData\Roaming\dtj5j\aRH1N_bXRtX2LSoR\i4F50z5x0.exe"3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
discord-rpc.x86.dll
i4F50z5x0.exe
i4F50z5x0.txt
steam_api.dll
memory/2812-28-0x00000000758A0000-0x00000000758A1000-memory.dmp
memory/2812-25-0x0000000003540000-0x000000000367C000-memory.dmp
memory/2812-14-0x0000000002AF0000-0x0000000002AF1000-memory.dmp
memory/2812-15-0x0000000000E40000-0x0000000000E41000-memory.dmp
memory/2812-16-0x00000000033F0000-0x000000000353D000-memory.dmp
memory/2812-17-0x0000000002B00000-0x0000000002B01000-memory.dmp
memory/2812-18-0x00000000033F0000-0x000000000353D000-memory.dmp
memory/2812-19-0x0000000010000000-0x0000000010426000-memory.dmp
memory/2812-20-0x0000000003540000-0x000000000367C000-memory.dmp
memory/2812-21-0x0000000003700000-0x0000000003756000-memory.dmp
memory/2812-12-0x0000000010000000-0x0000000010426000-memory.dmp
memory/2812-27-0x00000000033F0000-0x000000000353D000-memory.dmp
memory/2812-26-0x0000000077980000-0x0000000077981000-memory.dmp
memory/2812-13-0x00000000033F0000-0x000000000353D000-memory.dmp
memory/2812-11-0x0000000010000000-0x0000000010426000-memory.dmp
memory/2812-23-0x0000000004680000-0x000000000476B000-memory.dmp
memory/2812-22-0x0000000004680000-0x000000000476B000-memory.dmp
memory/2812-29-0x0000000005780000-0x000000000597B000-memory.dmp
memory/2812-33-0x0000000005DB0000-0x0000000005E9B000-memory.dmp
memory/2812-35-0x00000000064A0000-0x0000000006615000-memory.dmp
memory/2812-38-0x0000000003540000-0x000000000367C000-memory.dmp
memory/2812-37-0x00000000059B0000-0x00000000059B1000-memory.dmp
memory/2812-39-0x0000000005780000-0x000000000597B000-memory.dmp
memory/2812-40-0x0000000006440000-0x0000000006492000-memory.dmp
memory/2812-41-0x0000000003700000-0x0000000003756000-memory.dmp
memory/2812-42-0x0000000004680000-0x000000000476B000-memory.dmp
memory/2812-43-0x0000000005780000-0x000000000597B000-memory.dmp