Analysis
- max time kernel
148s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/09/2026, 11:09
General
- Target Trololo.exe
- Size 3.0MB
- Sample260930-m9b95sdg46
- SHA256 3d0efd55bde5fb7a73817940bac2a901d934b496738b7c5cab7ea0f6228e28fe
Malware Config
Signatures
- Disables Task Manager via registry modification
- Kills process with taskkill 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Trololo.exe"C:\Users\Admin\AppData\Local\Temp\Trololo.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\taskkill.exetaskkill.exe /f /im explorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill.exe /f /im taskmgr.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3f4 0x3ec1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3852-0-0x00007FF8E7345000-0x00007FF8E7346000-memory.dmp
memory/3852-1-0x000000001C2A0000-0x000000001C346000-memory.dmp
memory/3852-2-0x00007FF8E7090000-0x00007FF8E7A31000-memory.dmp
memory/3852-3-0x000000001C820000-0x000000001CCEE000-memory.dmp
memory/3852-4-0x000000001CD90000-0x000000001CE2C000-memory.dmp
memory/3852-5-0x00007FF8E7090000-0x00007FF8E7A31000-memory.dmp
memory/3852-6-0x0000000001AE0000-0x0000000001AE8000-memory.dmp
memory/3852-7-0x000000001CF00000-0x000000001CF4C000-memory.dmp
memory/3852-8-0x00007FF8E7090000-0x00007FF8E7A31000-memory.dmp
memory/3852-9-0x00007FF8E7090000-0x00007FF8E7A31000-memory.dmp
memory/3852-10-0x00007FF8E7090000-0x00007FF8E7A31000-memory.dmp
memory/3852-11-0x00007FF8E7090000-0x00007FF8E7A31000-memory.dmp
memory/3852-12-0x00007FF8E7090000-0x00007FF8E7A31000-memory.dmp
memory/3852-13-0x00007FF8E7090000-0x00007FF8E7A31000-memory.dmp
memory/3852-14-0x00007FF8E7090000-0x00007FF8E7A31000-memory.dmp
memory/3852-15-0x00007FF8E7090000-0x00007FF8E7A31000-memory.dmp
memory/3852-16-0x00007FF8E7090000-0x00007FF8E7A31000-memory.dmp
memory/3852-17-0x00007FF8E7090000-0x00007FF8E7A31000-memory.dmp
memory/3852-18-0x00007FF8E7345000-0x00007FF8E7346000-memory.dmp
memory/3852-19-0x00007FF8E7090000-0x00007FF8E7A31000-memory.dmp
memory/3852-20-0x00007FF8E7090000-0x00007FF8E7A31000-memory.dmp
memory/3852-21-0x00007FF8E7090000-0x00007FF8E7A31000-memory.dmp
memory/3852-22-0x00007FF8E7090000-0x00007FF8E7A31000-memory.dmp