Analysis
- max time kernel
151s - max time network
161s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
26/10/2026, 15:03
General
- Target td-testx64-Tg10.25.exe
- Size 135.4MB
- Sample261026-sffclafw8q
- SHA256 863b0b82112a33d173960dc139878dcac2387ed5a9560993ac8b6aa6d9f479ae
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 4 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 5 IoCs
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious behavior: MapViewOfSection 1 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\td-testx64-Tg10.25.exe"C:\Users\Admin\AppData\Local\Temp\td-testx64-Tg10.25.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\LicenseManagerSvc\LicenseManagerSvc.exe"C:\ProgramData\LicenseManagerSvc\LicenseManagerSvc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- Enumerates video capture drivers
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k AssignedAccessManagerSvc -s AssignedAccessManagerSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Cache.pmt
LicenseManagerSvc.exe
WINSRV32.dll
System.dll
modern-wizard.bmp
nsDialogs.dll
res.dll
memory/1280-330-0x0000000180000000-0x00000001805AD000-memory.dmp
memory/1280-333-0x0000000180000000-0x00000001805AD000-memory.dmp
memory/1280-331-0x0000000180000000-0x00000001805AD000-memory.dmp
memory/1280-332-0x0000000180000000-0x00000001805AD000-memory.dmp
memory/1280-334-0x0000000180000000-0x00000001805AD000-memory.dmp
memory/1280-326-0x0000000180000000-0x00000001805AD000-memory.dmp
memory/1280-316-0x0000000180000000-0x00000001805AD000-memory.dmp
memory/1280-336-0x0000000180000000-0x00000001805AD000-memory.dmp
memory/1280-312-0x00007FFE01020000-0x00007FFE011FD000-memory.dmp
memory/1280-377-0x0000000180000000-0x00000001805AD000-memory.dmp
memory/3128-400-0x0000000010000000-0x000000001046C000-memory.dmp
memory/3128-430-0x00000000044B0000-0x0000000004564000-memory.dmp
memory/3128-396-0x0000000010000000-0x000000001046C000-memory.dmp
memory/3128-402-0x0000000010000000-0x000000001046C000-memory.dmp
memory/3128-401-0x0000000010000000-0x000000001046C000-memory.dmp
memory/3128-399-0x0000000010000000-0x000000001046C000-memory.dmp
memory/3128-397-0x0000000010000000-0x000000001046C000-memory.dmp
memory/3128-398-0x0000000010000000-0x000000001046C000-memory.dmp
memory/3128-391-0x0000000010000000-0x000000001046C000-memory.dmp
memory/3128-381-0x0000000010000000-0x000000001046C000-memory.dmp
memory/3128-395-0x0000000010000000-0x000000001046C000-memory.dmp
memory/3128-380-0x0000000001210000-0x00000000013B2000-memory.dmp
memory/3128-407-0x0000000010000000-0x000000001046C000-memory.dmp
memory/3128-413-0x0000000010000000-0x000000001046C000-memory.dmp
memory/3128-411-0x0000000010000000-0x000000001046C000-memory.dmp
memory/3128-429-0x00000000044B0000-0x0000000004564000-memory.dmp
memory/3128-424-0x00000000044B0000-0x0000000004564000-memory.dmp
memory/3128-428-0x00000000044B0000-0x0000000004564000-memory.dmp
memory/3128-419-0x00000000044B0000-0x0000000004564000-memory.dmp
memory/3128-425-0x00000000044B0000-0x0000000004564000-memory.dmp
memory/3128-427-0x00000000044B0000-0x0000000004564000-memory.dmp
memory/3128-426-0x00000000044B0000-0x0000000004564000-memory.dmp
memory/3128-418-0x0000000010000000-0x000000001046C000-memory.dmp
memory/3128-415-0x0000000010000000-0x000000001046C000-memory.dmp
memory/3128-416-0x0000000010000000-0x000000001046C000-memory.dmp
memory/4276-276-0x0000000010000000-0x00000000111AB000-memory.dmp
memory/4276-299-0x00000000061B0000-0x000000000711A000-memory.dmp
memory/4276-280-0x0000000010000000-0x00000000111AB000-memory.dmp
memory/4276-267-0x0000000010000000-0x00000000111AB000-memory.dmp
memory/4276-279-0x0000000010000000-0x00000000111AB000-memory.dmp
memory/4276-281-0x0000000010000000-0x00000000111AB000-memory.dmp
memory/4276-282-0x0000000010000000-0x00000000111AB000-memory.dmp
memory/4276-284-0x00000000061B0000-0x000000000711A000-memory.dmp
memory/4276-292-0x00000000061B0000-0x000000000711A000-memory.dmp
memory/4276-16-0x0000000073560000-0x0000000074563000-memory.dmp
memory/4276-296-0x00000000061B0000-0x000000000711A000-memory.dmp
memory/4276-298-0x00000000061B0000-0x000000000711A000-memory.dmp
memory/4276-297-0x00000000061B0000-0x000000000711A000-memory.dmp
memory/4276-311-0x0000000073560000-0x0000000074563000-memory.dmp
memory/4360-347-0x0000000180000000-0x0000000180330000-memory.dmp
memory/4360-352-0x0000000180000000-0x0000000180330000-memory.dmp
memory/4360-337-0x0000000180000000-0x0000000180330000-memory.dmp
memory/4360-351-0x0000000180000000-0x0000000180330000-memory.dmp
memory/4360-376-0x0000000180000000-0x0000000180330000-memory.dmp
memory/4360-354-0x0000000180000000-0x0000000180330000-memory.dmp
memory/4360-355-0x0000000180000000-0x0000000180330000-memory.dmp
memory/4360-353-0x0000000180000000-0x0000000180330000-memory.dmp
memory/4452-372-0x0000000180000000-0x00000001800B8000-memory.dmp
memory/4452-357-0x0000000180000000-0x00000001800B8000-memory.dmp
memory/4452-366-0x0000000180000000-0x00000001800B8000-memory.dmp
memory/4452-374-0x0000000180000000-0x00000001800B8000-memory.dmp
memory/4452-373-0x0000000180000000-0x00000001800B8000-memory.dmp
memory/4452-371-0x0000000180000000-0x00000001800B8000-memory.dmp
memory/4452-370-0x0000000180000000-0x00000001800B8000-memory.dmp