Analysis
- max time kernel
2s - max time network
24s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
22/10/2026, 22:45
General
- Target bin/audtool.exe
- Size 125KB
- Sample261022-2phzhsvtet
- SHA256 e1866cb4c56a4f0319663762c608f90641fef1fed9af4486797f15306e3b5449
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bin\audtool.exe"C:\Users\Admin\AppData\Local\Temp\bin\audtool.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bin\gdbus.exe"C:\Users\Admin\AppData\Local\Temp\bin\gdbus.exe" _win32_run_session_bus2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
org_gtk_gdbus_general
gdbus-nonce-file-4XPJX3
memory/1060-16-0x00007FF630E90000-0x00007FF630EA4000-memory.dmp
memory/1060-18-0x00007FFF78690000-0x00007FFF786E2000-memory.dmp
memory/1060-19-0x00007FFF73C50000-0x00007FFF73DD2000-memory.dmp
memory/1060-20-0x00007FFF78630000-0x00007FFF7868C000-memory.dmp
memory/1060-22-0x00007FFF78060000-0x00007FFF78085000-memory.dmp
memory/1060-23-0x00007FFF808C0000-0x00007FFF808CE000-memory.dmp
memory/1060-21-0x00007FFF70E10000-0x00007FFF70F2E000-memory.dmp
memory/1060-25-0x00007FFF728B0000-0x00007FFF72966000-memory.dmp
memory/1060-24-0x00007FFF80790000-0x00007FFF807A0000-memory.dmp
memory/1060-17-0x00007FFF74410000-0x00007FFF745E0000-memory.dmp
memory/4952-11-0x00007FFF78630000-0x00007FFF7868C000-memory.dmp
memory/4952-6-0x00007FF7DDEC0000-0x00007FF7DDEE5000-memory.dmp
memory/4952-7-0x00007FFF74410000-0x00007FFF745E0000-memory.dmp
memory/4952-14-0x00007FFF70E10000-0x00007FFF70F2E000-memory.dmp
memory/4952-8-0x00007FFF73C50000-0x00007FFF73DD2000-memory.dmp
memory/4952-10-0x00007FFF728B0000-0x00007FFF72966000-memory.dmp
memory/4952-9-0x00007FFF78690000-0x00007FFF786E2000-memory.dmp
memory/4952-13-0x00007FFF80790000-0x00007FFF807A0000-memory.dmp
memory/4952-12-0x00007FFF808C0000-0x00007FFF808CE000-memory.dmp
memory/4952-15-0x00007FFF78060000-0x00007FFF78085000-memory.dmp