Analysis
- max time kernel
148s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
20/10/2026, 07:12
General
- Target DugiGuides_1.4.0.exe
- Size 1.2MB
- Sample261020-h1z8dsay2n
- SHA256 1ae23d83c9d0a96e4c3156590f516a22bd17bf953a94bd4a848ab90381b71918
Malware Config
Signatures
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Modifies system certificate store 2 TTPs 10 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DugiGuides_1.4.0.exe"C:\Users\Admin\AppData\Local\Temp\DugiGuides_1.4.0.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exeC:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1508-36-0x00007FF9CE1B0000-0x00007FF9CEB51000-memory.dmp
memory/1508-27-0x00007FF9CE1B0000-0x00007FF9CEB51000-memory.dmp
memory/1508-51-0x00007FF9CE1B0000-0x00007FF9CEB51000-memory.dmp
memory/1508-34-0x00007FF9CE1B0000-0x00007FF9CEB51000-memory.dmp
memory/1508-33-0x00007FF9CE1B0000-0x00007FF9CEB51000-memory.dmp
memory/1508-32-0x00007FF9CE1B0000-0x00007FF9CEB51000-memory.dmp
memory/1508-31-0x00007FF9CE1B0000-0x00007FF9CEB51000-memory.dmp
memory/1508-30-0x00007FF9CE1B0000-0x00007FF9CEB51000-memory.dmp
memory/1508-29-0x00007FF9CE1B0000-0x00007FF9CEB51000-memory.dmp
memory/1508-28-0x00007FF9CE1B0000-0x00007FF9CEB51000-memory.dmp
memory/1508-25-0x0000000001300000-0x0000000001320000-memory.dmp
memory/1508-26-0x00007FF9CE1B0000-0x00007FF9CEB51000-memory.dmp
memory/2360-35-0x000000001FA70000-0x000000001FB0C000-memory.dmp
memory/2360-42-0x00007FF9CE465000-0x00007FF9CE466000-memory.dmp
memory/2360-23-0x000000001BC00000-0x000000001BC12000-memory.dmp
memory/2360-22-0x000000001EFF0000-0x000000001F4BE000-memory.dmp
memory/2360-21-0x000000001D830000-0x000000001DC04000-memory.dmp
memory/2360-20-0x000000001D310000-0x000000001D446000-memory.dmp
memory/2360-19-0x000000001CCC0000-0x000000001D1CE000-memory.dmp
memory/2360-18-0x00007FF9CE1B0000-0x00007FF9CEB51000-memory.dmp
memory/2360-1-0x00007FF9CE1B0000-0x00007FF9CEB51000-memory.dmp
memory/2360-0-0x00007FF9CE465000-0x00007FF9CE466000-memory.dmp
memory/2360-17-0x00007FF9CE1B0000-0x00007FF9CEB51000-memory.dmp
memory/2360-38-0x00007FF9CE1B0000-0x00007FF9CEB51000-memory.dmp
memory/2360-39-0x00007FF9CE1B0000-0x00007FF9CEB51000-memory.dmp
memory/2360-40-0x00000000201A0000-0x00000000201D4000-memory.dmp
memory/2360-41-0x00000000201E0000-0x000000002021C000-memory.dmp
memory/2360-24-0x00007FF9CE1B0000-0x00007FF9CEB51000-memory.dmp
memory/2360-43-0x00007FF9CE1B0000-0x00007FF9CEB51000-memory.dmp
memory/2360-44-0x00007FF9CE1B0000-0x00007FF9CEB51000-memory.dmp
memory/2360-45-0x00007FF9CE1B0000-0x00007FF9CEB51000-memory.dmp
memory/2360-46-0x000000001F4D0000-0x000000001F4DE000-memory.dmp
memory/2360-47-0x00007FF9CE1B0000-0x00007FF9CEB51000-memory.dmp
memory/2360-48-0x00007FF9CE1B0000-0x00007FF9CEB51000-memory.dmp
memory/2360-49-0x00007FF9CE1B0000-0x00007FF9CEB51000-memory.dmp
memory/2360-50-0x00007FF9CE1B0000-0x00007FF9CEB51000-memory.dmp
memory/2360-37-0x000000001FFF0000-0x00000000200C2000-memory.dmp
memory/2360-52-0x00000000250B0000-0x00000000250CC000-memory.dmp
memory/2360-53-0x00007FF9CE1B0000-0x00007FF9CEB51000-memory.dmp
memory/2360-54-0x00007FF9CE1B0000-0x00007FF9CEB51000-memory.dmp
memory/2360-55-0x00007FF9CE1B0000-0x00007FF9CEB51000-memory.dmp
memory/2360-56-0x00007FF9CE1B0000-0x00007FF9CEB51000-memory.dmp