Analysis
- max time kernel
300s - max time network
336s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
16/09/2026, 14:07
General
- Target tancerscanner.exe
- Size 68.3MB
- Sample260916-re76jsbc53
- SHA256 5c7889967b024a5a22832cc6aa442463a98a0c33f932e71920a9d0e92a9e5416
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tancerscanner.exe"C:\Users\Admin\AppData\Local\Temp\tancerscanner.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
WMSDKNS.XML.bak
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
wpfgfx_cor3.dll
memory/3476-137-0x0000014FD72F0000-0x0000014FD7300000-memory.dmp
memory/3476-116-0x0000019074D00000-0x0000019074D20000-memory.dmp
memory/3476-29-0x00000190713D0000-0x0000019071C00000-memory.dmp
memory/3476-45-0x0000014FD9A50000-0x0000014FD9A70000-memory.dmp
memory/3476-69-0x0000014FDAF00000-0x0000014FDAF20000-memory.dmp
memory/3476-25-0x0000014FD99E0000-0x0000014FD9A20000-memory.dmp
memory/3476-84-0x0000019074390000-0x0000019074B30000-memory.dmp
memory/3476-88-0x0000019073880000-0x00000190738B0000-memory.dmp
memory/3476-92-0x0000019073990000-0x0000019073A20000-memory.dmp
memory/3476-112-0x0000019073B80000-0x0000019073BD0000-memory.dmp
memory/3476-120-0x0000019074E40000-0x0000019074E90000-memory.dmp
memory/3476-13-0x0000014FD95E0000-0x0000014FD9810000-memory.dmp
memory/3476-129-0x0000019075050000-0x00000190750C0000-memory.dmp
memory/3476-133-0x00000190752C0000-0x0000019075420000-memory.dmp
memory/3476-6-0x0000014FD8720000-0x0000014FD93B0000-memory.dmp
memory/3476-141-0x0000019075A40000-0x0000019075BB0000-memory.dmp
memory/3476-17-0x0000014FD7920000-0x0000014FD7A80000-memory.dmp
memory/3476-21-0x0000014FD74C0000-0x0000014FD7510000-memory.dmp
memory/3476-9-0x0000019070470000-0x00000190713D0000-memory.dmp
memory/3476-145-0x0000019074FB0000-0x0000019074FC0000-memory.dmp
memory/3476-108-0x0000019073B40000-0x0000019073B60000-memory.dmp
memory/3476-104-0x0000019074BF0000-0x0000019074CB0000-memory.dmp
memory/3476-100-0x00000190738C0000-0x00000190738F0000-memory.dmp
memory/3476-96-0x0000014FDB8E0000-0x0000014FDB8F0000-memory.dmp
memory/3476-80-0x0000014FDB030000-0x0000014FDB080000-memory.dmp
memory/3476-76-0x0000014FDAF20000-0x0000014FDB030000-memory.dmp
memory/3476-65-0x0000014FDAED0000-0x0000014FDAF00000-memory.dmp
memory/3476-61-0x0000014FDADB0000-0x0000014FDADD0000-memory.dmp
memory/3476-57-0x0000014FDAE20000-0x0000014FDAE60000-memory.dmp
memory/3476-53-0x0000014FDAD70000-0x0000014FDAD90000-memory.dmp
memory/3476-49-0x0000014FDAD50000-0x0000014FDAD70000-memory.dmp
memory/3476-41-0x0000014FD7350000-0x0000014FD7360000-memory.dmp
memory/3476-37-0x0000014FD9A20000-0x0000014FD9A40000-memory.dmp
memory/3476-33-0x0000014FDAA70000-0x0000014FDAAF0000-memory.dmp
memory/3476-158-0x000001907A5C0000-0x000001907A620000-memory.dmp