Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
16/09/2026, 18:57
General
- Target 0c33e4b8c5454e24d43dbb90d85ac448ec10f07d77e8cad5d7be67d0261b4331.exe
- Size 91KB
- Sample260916-xlwzravbme
- SHA256 0c33e4b8c5454e24d43dbb90d85ac448ec10f07d77e8cad5d7be67d0261b4331
Score
7/10
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Discovers systems in the same network 1 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c33e4b8c5454e24d43dbb90d85ac448ec10f07d77e8cad5d7be67d0261b4331.exe"C:\Users\Admin\AppData\Local\Temp\0c33e4b8c5454e24d43dbb90d85ac448ec10f07d77e8cad5d7be67d0261b4331.exe"1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\SearchNow\SearchSP.exe"C:\Users\Admin\AppData\Local\Programs\SearchNow\SearchSP.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\net.exe"net.exe" view \\10.127.0.1623⤵
- Discovers systems in the same network
-
-
-
C:\Users\Admin\AppData\Local\Programs\SearchNow\SearchSP.exeC:\Users\Admin\AppData\Local\Programs\SearchNow\SearchSP.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
SearchSP.exe
debug.log
debug.log
debug.log
debug.log
debug.log
memory/4868-0-0x0000024FF9CD0000-0x0000024FF9CEC000-memory.dmp
memory/4868-1-0x0000024FFA160000-0x0000024FFA1D6000-memory.dmp
memory/4868-11-0x0000024FFC420000-0x0000024FFC430000-memory.dmp
memory/4868-12-0x0000024FFA100000-0x0000024FFA11E000-memory.dmp
memory/5416-23-0x000001BCED4B0000-0x000001BCED4CC000-memory.dmp