Analysis
- max time kernel
149s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
16/09/2026, 15:19
General
- Target 916337ff10518c3c820a90dd3dfb485740b62d70e003108ce0f4fcccb4c8c795.exe
- Size 2.2MB
- Sample260916-sqlx5azzbw
- SHA256 916337ff10518c3c820a90dd3dfb485740b62d70e003108ce0f4fcccb4c8c795
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Drops file in System32 directory 7 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 3 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\916337ff10518c3c820a90dd3dfb485740b62d70e003108ce0f4fcccb4c8c795.exe"C:\Users\Admin\AppData\Local\Temp\916337ff10518c3c820a90dd3dfb485740b62d70e003108ce0f4fcccb4c8c795.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\jthmcjs\jthmcjs\mgoouxa\tvmfohq.exeC:\Windows\system32\jthmcjs\jthmcjs\mgoouxa\tvmfohq.exe -close2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe -NetworkService3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 124⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2320 -ip 23201⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
0202021dsfsd.ini
1.jthmcjs
2.jthmcjs
m.ini
tvmfohq.exe
thmcjsj000.IMD
thmcjsj001.IMD
thmcjsj002.IMD
thmcjsj003.IMD
thmcjsj004.IMD
thmcjsj005.IMD
thmcjsj006.IMD
thmcjsj007.IMD
thmcjsj008.IMD
thmcjsj009.IMD
memory/2320-127-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/3960-27-0x00000000024A0000-0x00000000024A1000-memory.dmp
memory/3960-69-0x0000000003610000-0x0000000003611000-memory.dmp
memory/3960-34-0x0000000002630000-0x0000000002631000-memory.dmp
memory/3960-33-0x0000000002500000-0x0000000002501000-memory.dmp
memory/3960-32-0x0000000002510000-0x0000000002511000-memory.dmp
memory/3960-31-0x00000000024E0000-0x00000000024E1000-memory.dmp
memory/3960-30-0x00000000024F0000-0x00000000024F1000-memory.dmp
memory/3960-29-0x00000000024C0000-0x00000000024C1000-memory.dmp
memory/3960-47-0x0000000002B70000-0x0000000002B71000-memory.dmp
memory/3960-46-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/3960-28-0x00000000024D0000-0x00000000024D1000-memory.dmp
memory/3960-0-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/3960-26-0x00000000024B0000-0x00000000024B1000-memory.dmp
memory/3960-25-0x0000000002480000-0x0000000002481000-memory.dmp
memory/3960-24-0x0000000002490000-0x0000000002491000-memory.dmp
memory/3960-23-0x0000000002460000-0x0000000002461000-memory.dmp
memory/3960-22-0x0000000002470000-0x0000000002471000-memory.dmp
memory/3960-21-0x0000000002440000-0x0000000002441000-memory.dmp
memory/3960-20-0x0000000002450000-0x0000000002451000-memory.dmp
memory/3960-19-0x0000000002420000-0x0000000002421000-memory.dmp
memory/3960-18-0x0000000002430000-0x0000000002431000-memory.dmp
memory/3960-16-0x0000000002400000-0x0000000002401000-memory.dmp
memory/3960-15-0x0000000002410000-0x0000000002411000-memory.dmp
memory/3960-14-0x0000000002380000-0x0000000002381000-memory.dmp
memory/3960-13-0x0000000002330000-0x0000000002331000-memory.dmp
memory/3960-12-0x0000000002320000-0x0000000002321000-memory.dmp
memory/3960-10-0x00000000023F0000-0x00000000023F1000-memory.dmp
memory/3960-9-0x00000000023E0000-0x00000000023E1000-memory.dmp
memory/3960-8-0x0000000002340000-0x0000000002349000-memory.dmp
memory/3960-4-0x0000000000640000-0x0000000000641000-memory.dmp
memory/3960-3-0x0000000002140000-0x0000000002141000-memory.dmp
memory/3960-2-0x00000000022F0000-0x00000000022F1000-memory.dmp
memory/3960-66-0x00000000035D0000-0x00000000035D1000-memory.dmp
memory/3960-64-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/3960-67-0x00000000020F0000-0x0000000002133000-memory.dmp
memory/3960-65-0x00000000035B0000-0x00000000035B1000-memory.dmp
memory/3960-63-0x00000000035E0000-0x00000000035E1000-memory.dmp
memory/3960-62-0x00000000035F0000-0x00000000035F1000-memory.dmp
memory/3960-60-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/3960-59-0x0000000003580000-0x0000000003581000-memory.dmp
memory/3960-56-0x0000000003570000-0x0000000003571000-memory.dmp
memory/3960-61-0x00000000035C0000-0x00000000035C1000-memory.dmp
memory/3960-58-0x0000000003590000-0x0000000003591000-memory.dmp
memory/3960-57-0x0000000003560000-0x0000000003561000-memory.dmp
memory/3960-70-0x0000000003600000-0x0000000003601000-memory.dmp
memory/3960-35-0x0000000002620000-0x0000000002621000-memory.dmp
memory/3960-78-0x0000000003660000-0x0000000003661000-memory.dmp
memory/3960-77-0x0000000003670000-0x0000000003671000-memory.dmp
memory/3960-76-0x0000000003640000-0x0000000003641000-memory.dmp
memory/3960-75-0x0000000003650000-0x0000000003651000-memory.dmp
memory/3960-74-0x0000000003620000-0x0000000003621000-memory.dmp
memory/3960-73-0x0000000003630000-0x0000000003631000-memory.dmp
memory/3960-36-0x0000000002650000-0x0000000002651000-memory.dmp
memory/3960-103-0x0000000003680000-0x0000000003681000-memory.dmp
memory/3960-102-0x0000000003790000-0x0000000003791000-memory.dmp
memory/3960-107-0x00000000037C0000-0x00000000037C1000-memory.dmp
memory/3960-106-0x00000000037D0000-0x00000000037D1000-memory.dmp
memory/3960-105-0x00000000037A0000-0x00000000037A1000-memory.dmp
memory/3960-104-0x00000000037B0000-0x00000000037B1000-memory.dmp
memory/3960-144-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/3960-143-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/3960-37-0x0000000002640000-0x0000000002641000-memory.dmp
memory/3960-38-0x0000000002670000-0x0000000002671000-memory.dmp
memory/3960-39-0x0000000002660000-0x0000000002661000-memory.dmp
memory/3960-40-0x0000000002690000-0x0000000002691000-memory.dmp
memory/3960-41-0x0000000002680000-0x0000000002681000-memory.dmp
memory/3960-42-0x00000000026C0000-0x00000000026C1000-memory.dmp
memory/3960-43-0x00000000026B0000-0x00000000026B1000-memory.dmp
memory/3960-44-0x00000000026E0000-0x00000000026E1000-memory.dmp
memory/3960-11-0x0000000002370000-0x0000000002371000-memory.dmp
memory/3960-45-0x00000000026D0000-0x00000000026D1000-memory.dmp
memory/3960-17-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/3960-5-0x00000000022D0000-0x00000000022D1000-memory.dmp
memory/3960-6-0x0000000002310000-0x0000000002311000-memory.dmp
memory/3960-7-0x0000000002360000-0x0000000002363000-memory.dmp
memory/3960-1-0x00000000020F0000-0x0000000002133000-memory.dmp
memory/3960-142-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/3960-141-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/3960-131-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/3960-132-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/3960-133-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/3960-134-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/3960-135-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/3960-136-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/3960-137-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/3960-138-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/3960-139-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/3960-140-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/4944-130-0x0000000002120000-0x0000000002163000-memory.dmp
memory/4944-129-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/4944-112-0x0000000002120000-0x0000000002163000-memory.dmp
memory/4944-111-0x0000000000400000-0x00000000004A0000-memory.dmp