Analysis
- max time kernel
150s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/10/2026, 02:27
General
- Target POPTLC_Trainer_LNG.exe
- Size 6.4MB
- Sample261030-cxvwlsda87
- SHA256 3d85fcf1dce67e76b1cb70ec56693863596ac4f38ff1e3a4c3d99a9eeccac544
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Obfuscated with Agile.Net obfuscator 4 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\POPTLC_Trainer_LNG.exe"C:\Users\Admin\AppData\Local\Temp\POPTLC_Trainer_LNG.exe"1⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Bass.Net.dll
Bass.dll
memory/4932-35-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp
memory/4932-31-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp
memory/4932-4-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp
memory/4932-5-0x000001D9EC3A0000-0x000001D9EC516000-memory.dmp
memory/4932-2-0x000001D9D1210000-0x000001D9D1876000-memory.dmp
memory/4932-15-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp
memory/4932-12-0x000001D9ED170000-0x000001D9ED212000-memory.dmp
memory/4932-1-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp
memory/4932-25-0x000001D9EBEE0000-0x000001D9EBF38000-memory.dmp
memory/4932-26-0x000001D9EC520000-0x000001D9EC552000-memory.dmp
memory/4932-29-0x000001D9ED2B0000-0x000001D9ED36A000-memory.dmp
memory/4932-28-0x000001D9ED290000-0x000001D9ED2B2000-memory.dmp
memory/4932-27-0x000001D9ED220000-0x000001D9ED264000-memory.dmp
memory/4932-30-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp
memory/4932-36-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp
memory/4932-32-0x000001D9EC140000-0x000001D9EC148000-memory.dmp
memory/4932-34-0x000001D9EE6A0000-0x000001D9EE92E000-memory.dmp
memory/4932-33-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp
memory/4932-3-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp
memory/4932-0-0x00007FF9B4BAF000-0x00007FF9B4BB0000-memory.dmp
memory/4932-42-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp
memory/4932-38-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp
memory/4932-39-0x000001D9EC150000-0x000001D9EC156000-memory.dmp
memory/4932-40-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp
memory/4932-41-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp
memory/4932-37-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp
memory/4932-45-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp
memory/4932-46-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp
memory/4932-47-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp
memory/4932-48-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp
memory/4932-49-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp
memory/4932-50-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp
memory/4932-51-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp
memory/4932-52-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp
memory/4932-53-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp
memory/4932-54-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp
memory/4932-55-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp
memory/4932-56-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp
memory/4932-57-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp
memory/4932-58-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp