Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
28/09/2026, 04:04
General
- Target file.exe
- Size 912KB
- Sample260928-em2yaawsa1
- SHA256 0593552ee0df53f8e2fb80f5748606403989d14536d076d4328e4956f5455a46
Malware Config
Signatures
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Drops file in Program Files directory 5 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 32 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2076-0-0x0000000003460000-0x00000000034D6000-memory.dmp
memory/2076-3-0x0000000003460000-0x00000000034D6000-memory.dmp
memory/2076-2-0x0000000003460000-0x00000000034D6000-memory.dmp
memory/2076-1-0x0000000003460000-0x00000000034D6000-memory.dmp
memory/2076-17-0x0000000003460000-0x00000000034D6000-memory.dmp
memory/2076-10-0x0000000003460000-0x00000000034D6000-memory.dmp
memory/2076-7-0x0000000003460000-0x00000000034D6000-memory.dmp
memory/2076-20-0x0000000003460000-0x00000000034D6000-memory.dmp
memory/2076-4-0x0000000003460000-0x00000000034D6000-memory.dmp
memory/2076-18-0x0000000003460000-0x00000000034D6000-memory.dmp
memory/2076-15-0x0000000003460000-0x00000000034D6000-memory.dmp
memory/2076-16-0x0000000003460000-0x00000000034D6000-memory.dmp
memory/2076-13-0x0000000003460000-0x00000000034D6000-memory.dmp
memory/2076-12-0x0000000003460000-0x00000000034D6000-memory.dmp
memory/2076-11-0x0000000003460000-0x00000000034D6000-memory.dmp
memory/2076-8-0x0000000003460000-0x00000000034D6000-memory.dmp
memory/2076-6-0x0000000003460000-0x00000000034D6000-memory.dmp
memory/2076-5-0x0000000003460000-0x00000000034D6000-memory.dmp
memory/2076-25-0x0000000003460000-0x00000000034D6000-memory.dmp
memory/2076-24-0x0000000003460000-0x00000000034D6000-memory.dmp
memory/2076-21-0x0000000003460000-0x00000000034D6000-memory.dmp
memory/2076-23-0x0000000003460000-0x00000000034D6000-memory.dmp