Analysis
- user interaction
yes - max time kernel
60s - max time network
56s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
23/10/2026, 02:42
General
- Target collar.exe
- Size 142.6MB
- Sample261023-c69fcszs8l
- SHA256 6ad127dd0e61ca3c4cf033e66a67587b71e3ad7b58ebf7afc545e19d1ee8e733
Malware Config
Signatures
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Disables RegEdit via registry modification 1 IoCs
- Disables Task Manager via registry modification
- Disables cmd.exe use via registry modification 1 IoCs
- Disables use of System Restore points 1 TTPs
- Executes dropped EXE 2 IoCs
- Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
- Loads dropped DLL 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Modifies WinLogon 2 TTPs 4 IoCs
- Drops file in System32 directory 2 IoCs
- Drops file in Windows directory 4 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Modifies Control Panel 6 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- System policy modification 1 TTPs 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\collar.exe"C:\Users\Admin\AppData\Local\Temp\collar.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /Delete /TN Collar /F2⤵
-
-
C:\ProgramData\Collar\collar.exeC:\ProgramData\Collar\collar.exe --service1⤵
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Modifies WinLogon
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\reagentc.exe"reagentc" /disable2⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Windows\system32\vssadmin.exe"vssadmin" delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\schtasks.exe"schtasks" /Delete /TN Collar /F2⤵
-
-
C:\ProgramData\Collar\collar.exe"C:\ProgramData\Collar\collar.exe" --agent2⤵
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
.collar_write_probe.tmp
session.info
memory/1192-24-0x00007FF82B0F0000-0x00007FF82B100000-memory.dmp
memory/1192-28-0x00007FF7F83E0000-0x00007FF7F83F0000-memory.dmp
memory/1192-27-0x00007FF7D4D90000-0x00007FF7D4DA0000-memory.dmp
memory/1192-26-0x00007FF82B0F0000-0x00007FF82B100000-memory.dmp
memory/1192-29-0x00007FF7F83E0000-0x00007FF7F83F0000-memory.dmp
memory/1192-23-0x00007FF82B0F0000-0x00007FF82B100000-memory.dmp
memory/1192-22-0x00007FF82B0F0000-0x00007FF82B100000-memory.dmp
memory/1192-21-0x00007FF7F83E0000-0x00007FF7F83F0000-memory.dmp
memory/1192-19-0x00007FF7F83E0000-0x00007FF7F83F0000-memory.dmp
memory/1192-18-0x00007FF7F83E0000-0x00007FF7F83F0000-memory.dmp
memory/1192-20-0x00007FF7F83E0000-0x00007FF7F83F0000-memory.dmp
memory/1192-25-0x00007FF82B0F0000-0x00007FF82B100000-memory.dmp