Analysis
- max time kernel
149s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/10/2026, 02:50
General
- Target DungeonsUpdater.exe
- Size 40KB
- Sample261030-db1qeah19k
- SHA256 d825882ebe8c708993465eb5155e09449db19f99641088a8caab9cac53a5be89
Malware Config
Signatures
- Downloads MZ/PE file 23 IoCs
- Writes a Windows system DLL name to a user directory 2 TTPs 1 IoCs
A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DungeonsUpdater.exe"C:\Users\Admin\AppData\Local\Temp\DungeonsUpdater.exe"1⤵
- Downloads MZ/PE file
- Writes a Windows system DLL name to a user directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2652-0-0x00007FFAA252F000-0x00007FFAA2530000-memory.dmp
memory/2652-1-0x0000021586A20000-0x0000021586A2E000-memory.dmp
memory/2652-2-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp
memory/2652-3-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp
memory/2652-4-0x0000021588680000-0x000002158869C000-memory.dmp
memory/2652-5-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp
memory/2652-6-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp
memory/2652-7-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp
memory/2652-9-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp
memory/2652-10-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp
memory/2652-11-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp
memory/2652-12-0x00000215A31B0000-0x00000215A31EE000-memory.dmp
memory/2652-13-0x00000215A2640000-0x00000215A264E000-memory.dmp
memory/2652-14-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp
memory/2652-15-0x0000021DA39D0000-0x0000021DA4176000-memory.dmp
memory/2652-17-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp
memory/2652-16-0x0000021584300000-0x0000021584400000-memory.dmp
memory/2652-19-0x00000215A3170000-0x00000215A3182000-memory.dmp
memory/2652-20-0x0000021DA3260000-0x0000021DA329C000-memory.dmp
memory/2652-21-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp
memory/2652-22-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp
memory/2652-29-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp
memory/2652-39-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp
memory/2652-73-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp
memory/2652-76-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp
memory/2652-79-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp
memory/2652-82-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp