Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/10/2026, 02:27
General
- Target POPTLC_Trainer_LNG.exe
- Size 6.4MB
- Sample261030-cxvwlsda87
- SHA256 3d85fcf1dce67e76b1cb70ec56693863596ac4f38ff1e3a4c3d99a9eeccac544
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Obfuscated with Agile.Net obfuscator 4 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\POPTLC_Trainer_LNG.exe"C:\Users\Admin\AppData\Local\Temp\POPTLC_Trainer_LNG.exe"1⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Bass.Net.dll
Bass.dll
memory/2992-26-0x000001EEFA860000-0x000001EEFA870000-memory.dmp
memory/2992-38-0x000001EEFA860000-0x000001EEFA870000-memory.dmp
memory/2992-9-0x000001EEFACA0000-0x000001EEFAD42000-memory.dmp
memory/2992-1-0x000001EEFA860000-0x000001EEFA870000-memory.dmp
memory/2992-18-0x000001EEFA7C0000-0x000001EEFA818000-memory.dmp
memory/2992-20-0x000001EEFAD60000-0x000001EEFADA4000-memory.dmp
memory/2992-19-0x000001EEFAC70000-0x000001EEFACA2000-memory.dmp
memory/2992-22-0x000001EEFAEA0000-0x000001EEFAF5A000-memory.dmp
memory/2992-21-0x000001EEFADD0000-0x000001EEFADF2000-memory.dmp
memory/2992-23-0x000001EEFA860000-0x000001EEFA870000-memory.dmp
memory/2992-24-0x000001EE981C0000-0x000001EE981C8000-memory.dmp
memory/2992-25-0x000001EE99710000-0x000001EE9999E000-memory.dmp
memory/2992-2-0x000001EEFAA70000-0x000001EEFABE6000-memory.dmp
memory/2992-0-0x000001EEF7950000-0x000001EEF7FB6000-memory.dmp
memory/2992-34-0x000001EEFA860000-0x000001EEFA870000-memory.dmp
memory/2992-29-0x000001EEFA860000-0x000001EEFA870000-memory.dmp
memory/2992-30-0x000001EE9C150000-0x000001EE9C250000-memory.dmp
memory/2992-33-0x000001EE9C150000-0x000001EE9C250000-memory.dmp
memory/2992-28-0x000001EEFA860000-0x000001EEFA870000-memory.dmp
memory/2992-35-0x000001EEFA860000-0x000001EEFA870000-memory.dmp
memory/2992-36-0x000001EEFA860000-0x000001EEFA870000-memory.dmp
memory/2992-37-0x000001EEFA860000-0x000001EEFA870000-memory.dmp
memory/2992-27-0x000001EE9AF20000-0x000001EE9AF26000-memory.dmp
memory/2992-39-0x000001EEFA860000-0x000001EEFA870000-memory.dmp
memory/2992-40-0x000001EE9C150000-0x000001EE9C250000-memory.dmp
memory/2992-41-0x000001EE9C150000-0x000001EE9C250000-memory.dmp