Analysis
- max time kernel
149s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
09/10/2026, 15:00
General
- Target NoTokenLimit IDE.exe
- Size 221.6MB
- Sample261009-sdchxsh19x
- SHA256 5e2936f99b2c1a8ac8cfef6d7befc3ac19de67da667d6924a53b5e7f282aa37a
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NoTokenLimit IDE.exe"C:\Users\Admin\AppData\Local\Temp\NoTokenLimit IDE.exe"1⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NoTokenLimit IDE.exe"C:\Users\Admin\AppData\Local\Temp\NoTokenLimit IDE.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\notokenlimit-ide" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1700,i,2277837101814107158,17590420310461204480,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1704,i,16027248109354738171,502891597408880643,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1692 /prefetch:22⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NoTokenLimit IDE.exe"C:\Users\Admin\AppData\Local\Temp\NoTokenLimit IDE.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\notokenlimit-ide" --field-trial-handle=1700,i,2277837101814107158,17590420310461204480,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1704,i,16027248109354738171,502891597408880643,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1868 /prefetch:32⤵
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Users\Admin\AppData\Local\Temp\NoTokenLimit IDE.exe"C:\Users\Admin\AppData\Local\Temp\NoTokenLimit IDE.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\notokenlimit-ide" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1700,i,2277837101814107158,17590420310461204480,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1704,i,16027248109354738171,502891597408880643,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2476 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Temp\NoTokenLimit IDE.exe"C:\Users\Admin\AppData\Local\Temp\NoTokenLimit IDE.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\notokenlimit-ide" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1700,i,2277837101814107158,17590420310461204480,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1704,i,16027248109354738171,502891597408880643,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2412 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
default.dic
data_0
data_1
data_2
data_3
CURRENT
memory/4152-23-0x00007FFFDC170000-0x00007FFFDC171000-memory.dmp
memory/4152-22-0x00007FFFDC750000-0x00007FFFDC751000-memory.dmp
memory/4288-105-0x0000018EF14E0000-0x0000018EF14E1000-memory.dmp
memory/4288-107-0x0000018EF14E0000-0x0000018EF14E1000-memory.dmp
memory/4288-106-0x0000018EF14E0000-0x0000018EF14E1000-memory.dmp
memory/4288-111-0x0000018EF14E0000-0x0000018EF14E1000-memory.dmp
memory/4288-112-0x0000018EF14E0000-0x0000018EF14E1000-memory.dmp
memory/4288-117-0x0000018EF14E0000-0x0000018EF14E1000-memory.dmp
memory/4288-116-0x0000018EF14E0000-0x0000018EF14E1000-memory.dmp
memory/4288-115-0x0000018EF14E0000-0x0000018EF14E1000-memory.dmp
memory/4288-114-0x0000018EF14E0000-0x0000018EF14E1000-memory.dmp
memory/4288-113-0x0000018EF14E0000-0x0000018EF14E1000-memory.dmp