Analysis
- max time kernel
151s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 19:54
General
- Target XMT2_Win_Setup_20.7.28.exe
- Size 91.3MB
- Sample261024-ymst6abz4y
- SHA256 fc16a73ee55b2a601b923eabf03c28180a7345f2d4e1da7dcdc9716a03ed5aa6
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XMT2_Win_Setup_20.7.28.exe"C:\Users\Admin\AppData\Local\Temp\XMT2_Win_Setup_20.7.28.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Xiaomi\XiaomiTool2\XiaoMiTool.exe"C:\Xiaomi\XiaomiTool2\XiaoMiTool.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Xiaomi\XiaomiTool2\bin\javaw.exe"C:\Xiaomi\XiaomiTool2\.\bin\javaw.exe" -jar "C:\Xiaomi\XiaomiTool2\XiaoMiTool.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
InstallOptions.dll
System.dll
ioSpecial.ini
ioSpecial.ini
ioSpecial.ini
modern-wizard.bmp
XiaoMiTool.exe
XiaoMiTool.jar
VCRUNTIME140.dll
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
java.dll
javaw.exe
jimage.dll
jli.dll
msvcp140.dll
net.dll
nio.dll
jvm.dll
zip.dll
jvm.cfg
modules
NOTICE.txt
memory/4612-351-0x0000000000400000-0x000000000042D000-memory.dmp
memory/5124-483-0x000002A3E1640000-0x000002A3E1650000-memory.dmp
memory/5124-509-0x000002A3E16C0000-0x000002A3E16D0000-memory.dmp
memory/5124-384-0x000002A3E1360000-0x000002A3E15D0000-memory.dmp
memory/5124-441-0x000002A3E15E0000-0x000002A3E15F0000-memory.dmp
memory/5124-440-0x000002A3E15D0000-0x000002A3E15E0000-memory.dmp
memory/5124-443-0x000002A3E15F0000-0x000002A3E1600000-memory.dmp
memory/5124-445-0x000002A3E1600000-0x000002A3E1610000-memory.dmp
memory/5124-448-0x000002A3E1610000-0x000002A3E1620000-memory.dmp
memory/5124-447-0x000002A3E0DD0000-0x000002A3E1040000-memory.dmp
memory/5124-451-0x000002A3E1620000-0x000002A3E1630000-memory.dmp
memory/5124-450-0x000002A3E1360000-0x000002A3E15D0000-memory.dmp
memory/5124-453-0x000002A3E1630000-0x000002A3E1640000-memory.dmp
memory/5124-456-0x000002A3E1640000-0x000002A3E1650000-memory.dmp
memory/5124-455-0x000002A3E8890000-0x000002A3E8B00000-memory.dmp
memory/5124-458-0x000002A3E1650000-0x000002A3E1660000-memory.dmp
memory/5124-460-0x000002A3E1660000-0x000002A3E1670000-memory.dmp
memory/5124-462-0x000002A3E15D0000-0x000002A3E15E0000-memory.dmp
memory/5124-464-0x000002A3E1670000-0x000002A3E1680000-memory.dmp
memory/5124-469-0x000002A3E15F0000-0x000002A3E1600000-memory.dmp
memory/5124-468-0x000002A3E1690000-0x000002A3E16A0000-memory.dmp
memory/5124-467-0x000002A3E1680000-0x000002A3E1690000-memory.dmp
memory/5124-466-0x000002A3E15E0000-0x000002A3E15F0000-memory.dmp
memory/5124-472-0x000002A3E1600000-0x000002A3E1610000-memory.dmp
memory/5124-475-0x000002A3E1610000-0x000002A3E1620000-memory.dmp
memory/5124-474-0x000002A3E16B0000-0x000002A3E16C0000-memory.dmp
memory/5124-473-0x000002A3E16A0000-0x000002A3E16B0000-memory.dmp
memory/5124-478-0x000002A3E16C0000-0x000002A3E16D0000-memory.dmp
memory/5124-477-0x000002A3E1620000-0x000002A3E1630000-memory.dmp
memory/5124-481-0x000002A3E16D0000-0x000002A3E16E0000-memory.dmp
memory/5124-480-0x000002A3E1630000-0x000002A3E1640000-memory.dmp
memory/5124-375-0x000002A3E0DD0000-0x000002A3E1040000-memory.dmp
memory/5124-484-0x000002A3E16E0000-0x000002A3E16F0000-memory.dmp
memory/5124-488-0x000002A3E16F0000-0x000002A3E1700000-memory.dmp
memory/5124-487-0x000002A3E1650000-0x000002A3E1660000-memory.dmp
memory/5124-491-0x000002A3E1700000-0x000002A3E1710000-memory.dmp
memory/5124-490-0x000002A3E1660000-0x000002A3E1670000-memory.dmp
memory/5124-494-0x000002A3E1710000-0x000002A3E1720000-memory.dmp
memory/5124-493-0x000002A3E1670000-0x000002A3E1680000-memory.dmp
memory/5124-497-0x000002A3E1690000-0x000002A3E16A0000-memory.dmp
memory/5124-496-0x000002A3E1680000-0x000002A3E1690000-memory.dmp
memory/5124-498-0x000002A3E1720000-0x000002A3E1730000-memory.dmp
memory/5124-500-0x000002A3E1730000-0x000002A3E1740000-memory.dmp
memory/5124-504-0x000002A3E16B0000-0x000002A3E16C0000-memory.dmp
memory/5124-503-0x000002A3E16A0000-0x000002A3E16B0000-memory.dmp
memory/5124-505-0x000002A3E1740000-0x000002A3E1750000-memory.dmp
memory/5124-507-0x000002A3E1750000-0x000002A3E1760000-memory.dmp
memory/5124-510-0x000002A3E1760000-0x000002A3E1770000-memory.dmp
memory/5124-385-0x000002A3E8890000-0x000002A3E8B00000-memory.dmp
memory/5124-512-0x000002A3E16D0000-0x000002A3E16E0000-memory.dmp
memory/5124-513-0x000002A3E1770000-0x000002A3E1780000-memory.dmp
memory/5124-516-0x000002A3E1780000-0x000002A3E1790000-memory.dmp
memory/5124-515-0x000002A3E16E0000-0x000002A3E16F0000-memory.dmp
memory/5124-518-0x000002A3E16F0000-0x000002A3E1700000-memory.dmp
memory/5124-519-0x000002A3E1790000-0x000002A3E17A0000-memory.dmp
memory/5124-523-0x000002A3E17A0000-0x000002A3E17B0000-memory.dmp
memory/5124-522-0x000002A3E1700000-0x000002A3E1710000-memory.dmp
memory/5124-530-0x000002A3E1720000-0x000002A3E1730000-memory.dmp
memory/5124-529-0x000002A3E17D0000-0x000002A3E17E0000-memory.dmp
memory/5124-528-0x000002A3E17C0000-0x000002A3E17D0000-memory.dmp
memory/5124-527-0x000002A3E17B0000-0x000002A3E17C0000-memory.dmp
memory/5124-526-0x000002A3E1710000-0x000002A3E1720000-memory.dmp
memory/5124-533-0x000002A3E1730000-0x000002A3E1740000-memory.dmp
memory/5124-534-0x000002A3E17E0000-0x000002A3E17F0000-memory.dmp
memory/5124-537-0x000002A3E17F0000-0x000002A3E1800000-memory.dmp
memory/5124-536-0x000002A3E1740000-0x000002A3E1750000-memory.dmp
memory/5124-539-0x000002A3E1750000-0x000002A3E1760000-memory.dmp
memory/5124-540-0x000002A3E1800000-0x000002A3E1810000-memory.dmp
memory/5124-543-0x000002A3E1810000-0x000002A3E1820000-memory.dmp
memory/5124-542-0x000002A3E1760000-0x000002A3E1770000-memory.dmp
memory/5124-552-0x000002A3E1840000-0x000002A3E1850000-memory.dmp
memory/5124-553-0x000002A3E1780000-0x000002A3E1790000-memory.dmp
memory/5124-551-0x000002A3E1830000-0x000002A3E1840000-memory.dmp
memory/5124-558-0x000002A3E17A0000-0x000002A3E17B0000-memory.dmp
memory/5124-557-0x000002A3E1860000-0x000002A3E1870000-memory.dmp
memory/5124-556-0x000002A3E1850000-0x000002A3E1860000-memory.dmp
memory/5124-555-0x000002A3E1790000-0x000002A3E17A0000-memory.dmp
memory/5124-550-0x000002A3E1820000-0x000002A3E1830000-memory.dmp
memory/5124-548-0x000002A3E1770000-0x000002A3E1780000-memory.dmp
memory/5124-573-0x000002A3E18C0000-0x000002A3E18D0000-memory.dmp
memory/5124-570-0x000002A3E1890000-0x000002A3E18A0000-memory.dmp
memory/5124-567-0x000002A3E17D0000-0x000002A3E17E0000-memory.dmp
memory/5124-564-0x000002A3E17B0000-0x000002A3E17C0000-memory.dmp
memory/5124-572-0x000002A3E18B0000-0x000002A3E18C0000-memory.dmp
memory/5124-576-0x000002A3E18D0000-0x000002A3E18E0000-memory.dmp
memory/5124-575-0x000002A3E17E0000-0x000002A3E17F0000-memory.dmp
memory/5124-571-0x000002A3E18A0000-0x000002A3E18B0000-memory.dmp
memory/5124-569-0x000002A3E1880000-0x000002A3E1890000-memory.dmp
memory/5124-568-0x000002A3E1870000-0x000002A3E1880000-memory.dmp
memory/5124-565-0x000002A3E17C0000-0x000002A3E17D0000-memory.dmp
memory/5124-578-0x000002A3E17F0000-0x000002A3E1800000-memory.dmp
memory/5124-579-0x000002A3E18E0000-0x000002A3E18F0000-memory.dmp
memory/5124-583-0x000002A3E18F0000-0x000002A3E1900000-memory.dmp
memory/5124-582-0x000002A3E1800000-0x000002A3E1810000-memory.dmp
memory/5124-586-0x000002A3E1900000-0x000002A3E1910000-memory.dmp
memory/5124-585-0x000002A3E1810000-0x000002A3E1820000-memory.dmp
memory/5124-588-0x000002A3E1820000-0x000002A3E1830000-memory.dmp