Analysis
- max time kernel
150s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
16/09/2026, 11:21
General
- Target 758c60e8e56fece917066be8be48fc0e61f40e2a63de70097bfa435def02732d.exe
- Size 488KB
- Sample260916-nf32faap2s
- SHA256 758c60e8e56fece917066be8be48fc0e61f40e2a63de70097bfa435def02732d
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Drops file in System32 directory 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 45 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\758c60e8e56fece917066be8be48fc0e61f40e2a63de70097bfa435def02732d.exe"C:\Users\Admin\AppData\Local\Temp\758c60e8e56fece917066be8be48fc0e61f40e2a63de70097bfa435def02732d.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\boottvwr\ddod_ssp.exe"C:\Users\Admin\AppData\Roaming\boottvwr"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~96BD.tmp3288 499720 3976 14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
-
-
C:\Windows\SysWOW64\RdpSware.exeC:\Windows\SysWOW64\RdpSware.exe -s1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\boottvwr\ddod_ssp.exeC:\Users\Admin\AppData\Roaming\boottvwr\ddod_ssp.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
~96BD.tmp
ddod_ssp.exe
memory/2340-15-0x00000000006D0000-0x0000000000753000-memory.dmp
memory/2340-14-0x0000000000400000-0x0000000000480000-memory.dmp
memory/3288-74-0x00007FFF7A950000-0x00007FFF7AA57000-memory.dmp
memory/3288-43-0x00007FFF7A950000-0x00007FFF7AA57000-memory.dmp
memory/3288-120-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-18-0x00000000088E0000-0x000000000896A000-memory.dmp
memory/3288-25-0x00000000088E0000-0x000000000896A000-memory.dmp
memory/3288-26-0x0000000002C50000-0x0000000002C56000-memory.dmp
memory/3288-119-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-116-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-30-0x0000000002BF0000-0x0000000002BF1000-memory.dmp
memory/3288-29-0x0000000002BE0000-0x0000000002BE1000-memory.dmp
memory/3288-118-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-117-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-115-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-114-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-39-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-40-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-41-0x00007FFF7A9F2000-0x00007FFF7A9F3000-memory.dmp
memory/3288-42-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-80-0x00007FFF7A950000-0x00007FFF7AA57000-memory.dmp
memory/3288-44-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-45-0x00007FFF7A950000-0x00007FFF7AA57000-memory.dmp
memory/3288-49-0x00007FFF7A950000-0x00007FFF7AA57000-memory.dmp
memory/3288-48-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-47-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-46-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-51-0x00007FFF7A950000-0x00007FFF7AA57000-memory.dmp
memory/3288-50-0x00007FFF7A950000-0x00007FFF7AA57000-memory.dmp
memory/3288-52-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-54-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-53-0x00007FFF7A950000-0x00007FFF7AA57000-memory.dmp
memory/3288-59-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-58-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-57-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-56-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-79-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-61-0x00007FFF7A9F2000-0x00007FFF7A9F3000-memory.dmp
memory/3288-65-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-69-0x00007FFF7A950000-0x00007FFF7AA57000-memory.dmp
memory/3288-68-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-67-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-66-0x00007FFF7A950000-0x00007FFF7AA57000-memory.dmp
memory/3288-64-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-63-0x00007FFF7A950000-0x00007FFF7AA57000-memory.dmp
memory/3288-62-0x00007FFF7A950000-0x00007FFF7AA57000-memory.dmp
memory/3288-60-0x00007FFF7A950000-0x00007FFF7AA57000-memory.dmp
memory/3288-70-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-27-0x0000000002D30000-0x0000000002D3D000-memory.dmp
memory/3288-73-0x00007FFF7A950000-0x00007FFF7AA57000-memory.dmp
memory/3288-55-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-113-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-99-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-77-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-76-0x00007FFF7A950000-0x00007FFF7AA57000-memory.dmp
memory/3288-75-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-72-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-71-0x00007FFF7A950000-0x00007FFF7AA57000-memory.dmp
memory/3288-81-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-82-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-86-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-85-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-84-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-83-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-88-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-89-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-87-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-90-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-91-0x00007FFF7A950000-0x00007FFF7AA57000-memory.dmp
memory/3288-92-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-93-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-94-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-95-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-97-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-96-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-98-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-78-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-103-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-102-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-101-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-100-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-104-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-105-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-106-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-107-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-108-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-109-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-110-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-111-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3288-112-0x0000000002CF0000-0x0000000002D00000-memory.dmp
memory/3744-34-0x0000000000480000-0x0000000000503000-memory.dmp
memory/3744-36-0x0000000000400000-0x0000000000480000-memory.dmp
memory/3744-35-0x0000000000650000-0x0000000000655000-memory.dmp
memory/3744-33-0x0000000000400000-0x0000000000480000-memory.dmp
memory/3976-9-0x0000000000400000-0x0000000000480000-memory.dmp
memory/3976-12-0x00000000006A0000-0x0000000000723000-memory.dmp
memory/3976-13-0x0000000000570000-0x0000000000575000-memory.dmp
memory/4604-0-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4604-1-0x0000000000560000-0x00000000005E3000-memory.dmp
memory/4604-28-0x0000000000400000-0x0000000000480000-memory.dmp