Analysis
- max time kernel
149s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
20/10/2026, 07:12
General
- Target DugiGuides_1.4.0.exe
- Size 1.2MB
- Sample261020-h1z8dsay2n
- SHA256 1ae23d83c9d0a96e4c3156590f516a22bd17bf953a94bd4a848ab90381b71918
Malware Config
Signatures
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Modifies system certificate store 2 TTPs 7 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DugiGuides_1.4.0.exe"C:\Users\Admin\AppData\Local\Temp\DugiGuides_1.4.0.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exeC:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3444-33-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/3444-26-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/3444-27-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/3444-28-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/3444-29-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/3444-63-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/3444-25-0x0000000001AF0000-0x0000000001B10000-memory.dmp
memory/3444-38-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/3444-37-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/3444-36-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/3444-35-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/3444-34-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/3444-30-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/3444-31-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/3444-32-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/4328-39-0x0000000020580000-0x000000002061C000-memory.dmp
memory/4328-47-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/4328-18-0x000000001D9A0000-0x000000001DD74000-memory.dmp
memory/4328-16-0x000000001CF70000-0x000000001D480000-memory.dmp
memory/4328-17-0x000000001D480000-0x000000001D5B6000-memory.dmp
memory/4328-15-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/4328-20-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/4328-21-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/4328-22-0x000000001FCB0000-0x000000002017E000-memory.dmp
memory/4328-23-0x000000001DF60000-0x000000001DF72000-memory.dmp
memory/4328-24-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/4328-1-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/4328-40-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/4328-41-0x0000000020B00000-0x0000000020BD2000-memory.dmp
memory/4328-42-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/4328-43-0x0000000022070000-0x00000000220A4000-memory.dmp
memory/4328-44-0x00007FFBF202A000-0x00007FFBF202B000-memory.dmp
memory/4328-45-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/4328-46-0x00000000221E0000-0x000000002221C000-memory.dmp
memory/4328-19-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/4328-48-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/4328-49-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/4328-51-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/4328-50-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/4328-52-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/4328-54-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/4328-53-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/4328-55-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/4328-56-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/4328-57-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/4328-58-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/4328-59-0x000000001E0A0000-0x000000001E0AE000-memory.dmp
memory/4328-60-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/4328-61-0x0000000026470000-0x000000002648C000-memory.dmp
memory/4328-62-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/4328-0-0x00007FFBF202A000-0x00007FFBF202B000-memory.dmp
memory/4328-64-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp
memory/4328-65-0x00007FFBF1D30000-0x00007FFBF2768000-memory.dmp