Analysis
- max time kernel
13s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
28/09/2026, 17:29
General
- Target DLLiumFix2.1.exe
- Size 736KB
- Sample260928-v2rc4azycs
- SHA256 e63f3966ca30d9aee9aa55140ae1a0e1fbe1f5f85eb2a10e4545260860ca33ab
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Looks up external IP address via web service 1 TTPs 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Costura .NET executable packer 1 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DLLiumFix2.1.exe"C:\Users\Admin\AppData\Local\Temp\DLLiumFix2.1.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DLLium.exe"C:\Users\Admin\AppData\Local\Temp\DLLium.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\PotatoInjector.FixbySanek.exe"C:\Users\Admin\AppData\Local\Temp\PotatoInjector.FixbySanek.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" 471|QqdlxWMu7ogfLYVf44zj5NHOqhwBAILs/CuNX93sOVh2S7e23hqsV4ooe6Jdc9HoWindowsControl472|iUdtvY91jZ9V6V5sJdGe2KVy1QyC7emOTA2jwPkuhbA=C:\Program Files\junkSearch.exe" enable=yes & exit3⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\junkSearcher.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\junkSearcher.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\junkSearch.exe"C:\Program Files\junkSearch.exe"3⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"4⤵
-
-
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\userinit.exeC:\Windows\System32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Program Files\junkSearch.exe"C:\Program Files\junkSearch.exe"1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
start2.bin
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
microsoftwindows.client[1].xml
DLLium.exe
PotatoInjector.FixbySanek.exe
5a2098e080cf7ac4.automaticDestinations-ms
junk.dll
memory/1148-542-0x00007FFE8E8D0000-0x00007FFE8E8E6000-memory.dmp
memory/1148-538-0x00007FFE8E8D0000-0x00007FFE8E8E6000-memory.dmp
memory/1432-273-0x000000000A190000-0x000000000A3EF000-memory.dmp
memory/1624-321-0x00000241001E0000-0x00000241002E0000-memory.dmp
memory/1624-366-0x00000241141E0000-0x0000024114200000-memory.dmp
memory/1624-350-0x0000024102A00000-0x0000024102A20000-memory.dmp
memory/1624-352-0x0000024102C60000-0x0000024102C80000-memory.dmp
memory/1624-351-0x0000024102E20000-0x0000024102F20000-memory.dmp
memory/1624-319-0x00000241001E0000-0x00000241002E0000-memory.dmp
memory/1624-320-0x00000241001E0000-0x00000241002E0000-memory.dmp
memory/2616-6-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/2616-5-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/2616-1-0x00007FFE79ABF000-0x00007FFE79AC0000-memory.dmp
memory/2616-2-0x000000001C6D0000-0x000000001C7E2000-memory.dmp
memory/2616-10-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/2616-0-0x0000000000940000-0x00000000009FC000-memory.dmp
memory/2616-16-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/3324-87-0x000002511B0B0000-0x000002511B0D0000-memory.dmp
memory/3324-52-0x0000025109320000-0x0000025109340000-memory.dmp
memory/3324-53-0x0000025119870000-0x0000025119970000-memory.dmp
memory/3324-42-0x0000025105BD0000-0x0000025105CD0000-memory.dmp
memory/3324-73-0x0000025109670000-0x0000025109690000-memory.dmp
memory/3740-482-0x00007FFE8E8D0000-0x00007FFE8E8E6000-memory.dmp
memory/4380-525-0x0000020F00820000-0x0000020F00898000-memory.dmp
memory/4432-541-0x000000000A8B0000-0x000000000AA3E000-memory.dmp
memory/4432-540-0x00007FFE8E8D0000-0x00007FFE8E8E6000-memory.dmp
memory/5428-290-0x00000169348E0000-0x00000169348E1000-memory.dmp
memory/5428-286-0x00000169348C0000-0x00000169348C1000-memory.dmp
memory/5428-283-0x00000169348A0000-0x00000169348A1000-memory.dmp
memory/5428-282-0x00000169348A0000-0x00000169348A1000-memory.dmp
memory/5428-281-0x0000016934880000-0x0000016934881000-memory.dmp
memory/5428-280-0x0000016934880000-0x0000016934881000-memory.dmp
memory/5428-285-0x00000169348B0000-0x00000169348B1000-memory.dmp
memory/5428-537-0x00007FFE8E8D0000-0x00007FFE8E8E6000-memory.dmp
memory/5428-287-0x00000169348C0000-0x00000169348C1000-memory.dmp
memory/5428-288-0x00000169348D0000-0x00000169348D1000-memory.dmp
memory/5428-289-0x00000169348D0000-0x00000169348D1000-memory.dmp
memory/5428-291-0x00000169348E0000-0x00000169348E1000-memory.dmp
memory/5428-546-0x00007FFE8E8D0000-0x00007FFE8E8E6000-memory.dmp
memory/5428-284-0x00000169348B0000-0x00000169348B1000-memory.dmp
memory/5916-39-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/5916-23-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/5916-22-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/5916-21-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/5916-20-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/5916-19-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/5916-24-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/5916-18-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/5916-15-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/5916-17-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp
memory/5916-14-0x00000150E1EE0000-0x00000150E1FC6000-memory.dmp
memory/5916-272-0x00007FFE79930000-0x00007FFE7A2D4000-memory.dmp