Analysis
- max time kernel
87s - max time network
76s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
14/10/2026, 04:02
Errors
General
- Target Mandela.exe
- Size 15.2MB
- Sample261014-elyjgaft4z
- SHA256 c6818da28a36a7ed628e5a86ede3a642b609b34b2f61ae4dba9a4814d6822d2f
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- UAC bypass 3 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Kills process with taskkill 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies registry class 6 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mandela.exe"C:\Users\Admin\AppData\Local\Temp\Mandela.exe"1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k taskkill /f /im explorer.exe2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2fc 0x4581⤵
-
C:\Windows\explorer.exeexplorer.exe , mandela.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
memory/3468-0-0x0000000000E20000-0x0000000001D54000-memory.dmp
memory/3468-1-0x000000001C990000-0x000000001C9A0000-memory.dmp
memory/3468-2-0x0000000002420000-0x0000000002421000-memory.dmp
memory/3468-3-0x0000000027370000-0x0000000029422000-memory.dmp
memory/3468-4-0x00000000026E0000-0x00000000026EC000-memory.dmp
memory/3468-6-0x000000001C2F0000-0x000000001C304000-memory.dmp
memory/3468-5-0x000000001C2E0000-0x000000001C2E8000-memory.dmp
memory/3468-7-0x000000001C300000-0x000000001C358000-memory.dmp
memory/3468-8-0x000000001C990000-0x000000001C9A0000-memory.dmp
memory/3468-9-0x000000001C990000-0x000000001C9A0000-memory.dmp
memory/3468-36-0x000000001C990000-0x000000001C9A0000-memory.dmp
memory/3468-37-0x000000001C990000-0x000000001C9A0000-memory.dmp
memory/3468-38-0x000000001C990000-0x000000001C9A0000-memory.dmp