Analysis
- max time kernel
152s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
19/09/2026, 11:25
General
- Target Camp-Forest-Config-Editor-1.1.2-portable.exe
- Size 110.4MB
- Sample260919-njbflaef78
- SHA256 4ac1769e122e3ddb7b4ce526e44bb403dd2aa9d7f85bd2edaac379af14f43544
Malware Config
Signatures
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 11 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Camp-Forest-Config-Editor-1.1.2-portable.exe"C:\Users\Admin\AppData\Local\Temp\Camp-Forest-Config-Editor-1.1.2-portable.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CampForestCFG-Admin\Camp Forest Config Editor.exe"C:\Users\Admin\AppData\Local\Temp\CampForestCFG-Admin\Camp Forest Config Editor.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CampForestCFG-Admin\Camp Forest Config Editor.exe"C:\Users\Admin\AppData\Local\Temp\CampForestCFG-Admin\Camp Forest Config Editor.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Camp Forest Config Editor" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1704,i,1616330665936379846,9142585396195932,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1696 /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\CampForestCFG-Admin\Camp Forest Config Editor.exe"C:\Users\Admin\AppData\Local\Temp\CampForestCFG-Admin\Camp Forest Config Editor.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Camp Forest Config Editor" --field-trial-handle=2252,i,1616330665936379846,9142585396195932,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:113⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\CampForestCFG-Admin\Camp Forest Config Editor.exe"C:\Users\Admin\AppData\Local\Temp\CampForestCFG-Admin\Camp Forest Config Editor.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Camp Forest Config Editor" --app-path="C:\Users\Admin\AppData\Local\Temp\CampForestCFG-Admin\resources\app" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2360,i,1616330665936379846,9142585396195932,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\CampForestCFG-Admin\Camp Forest Config Editor.exe"C:\Users\Admin\AppData\Local\Temp\CampForestCFG-Admin\Camp Forest Config Editor.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\Camp Forest Config Editor" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=3032,i,1616330665936379846,9142585396195932,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:103⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
D3DCompiler_47.dll
chrome_100_percent.pak
chrome_200_percent.pak
ffmpeg.dll
icudtl.dat
libegl.dll
libglesv2.dll
en-US.pak
resources.pak
index-CW6oNWxm.js
index-hr3jaf2_.css
index.html
icon.png
main.js
package.json
preload.js
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
data_1
data_0
data_2
data_3
default.exc
memory/2152-270-0x00007FFF8D270000-0x00007FFF8D271000-memory.dmp
memory/2152-269-0x00007FFF8E340000-0x00007FFF8E341000-memory.dmp
memory/2652-356-0x000001C7D2350000-0x000001C7D2351000-memory.dmp
memory/2652-358-0x000001C7D2350000-0x000001C7D2351000-memory.dmp
memory/2652-362-0x000001C7D2350000-0x000001C7D2351000-memory.dmp
memory/2652-363-0x000001C7D2350000-0x000001C7D2351000-memory.dmp
memory/2652-364-0x000001C7D2350000-0x000001C7D2351000-memory.dmp
memory/2652-365-0x000001C7D2350000-0x000001C7D2351000-memory.dmp
memory/2652-366-0x000001C7D2350000-0x000001C7D2351000-memory.dmp
memory/2652-367-0x000001C7D2350000-0x000001C7D2351000-memory.dmp
memory/4648-96-0x00007FFF6B810000-0x00007FFF6C1B4000-memory.dmp
memory/4648-61-0x00007FFF6B810000-0x00007FFF6C1B4000-memory.dmp
memory/4648-13-0x00007FFF6B810000-0x00007FFF6C1B4000-memory.dmp
memory/4648-29-0x00007FFF6B810000-0x00007FFF6C1B4000-memory.dmp
memory/4648-5-0x00007FFF6B810000-0x00007FFF6C1B4000-memory.dmp
memory/4648-73-0x00007FFF6B810000-0x00007FFF6C1B4000-memory.dmp
memory/4648-2-0x0000000000550000-0x0000000001550000-memory.dmp
memory/4648-3-0x0000000009400000-0x0000000009412000-memory.dmp
memory/4648-1-0x00007FFF6B810000-0x00007FFF6C1B4000-memory.dmp
memory/4648-107-0x00007FFF6B810000-0x00007FFF6C1B4000-memory.dmp
memory/4648-0-0x00007FFF6B99F000-0x00007FFF6B9A0000-memory.dmp
memory/4648-228-0x00007FFF6B810000-0x00007FFF6C1B4000-memory.dmp
memory/4648-4-0x0000000007B30000-0x0000000007B3A000-memory.dmp