Analysis
- max time kernel
149s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
02/11/2026, 23:51
General
- Target bin/deCONZ.exe
- Size 2.4MB
- Sample261102-3wfy6sf14m
- SHA256 c3ea52f62d1f23b46c01b073f7a2807f939deebd4a881a62da5096b1998ccf5e
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bin\deCONZ.exe"C:\Users\Admin\AppData\Local\Temp\bin\deCONZ.exe"1⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
config.ini
config.ini.lock
memory/4268-0-0x00007FF6B9BD0000-0x00007FF6B9D80000-memory.dmp
memory/4268-1-0x00007FFC0CB30000-0x00007FFC0D5D2000-memory.dmp
memory/4268-2-0x000001D2086C0000-0x000001D2086D0000-memory.dmp
memory/4268-68-0x00007FFC0D5E0000-0x00007FFC0D7DB000-memory.dmp
memory/4268-70-0x00007FFC1AFF0000-0x00007FFC1B01A000-memory.dmp
memory/4268-72-0x00007FFC0BEC0000-0x00007FFC0C011000-memory.dmp
memory/4268-74-0x00007FFC24CD0000-0x00007FFC24CE6000-memory.dmp
memory/4268-76-0x00007FFC0B6A0000-0x00007FFC0B7DE000-memory.dmp
memory/4268-75-0x00007FFC0B7E0000-0x00007FFC0BEB9000-memory.dmp
memory/4268-73-0x00007FFC1AD90000-0x00007FFC1AE38000-memory.dmp
memory/4268-71-0x00007FFC0C020000-0x00007FFC0CB24000-memory.dmp
memory/4268-69-0x00007FFC0CB30000-0x00007FFC0D5D2000-memory.dmp
memory/4268-67-0x00007FFC0E120000-0x00007FFC0E34A000-memory.dmp
memory/4268-66-0x00007FFC1B2B0000-0x00007FFC1B2D2000-memory.dmp
memory/4268-65-0x00007FF6B9BD0000-0x00007FF6B9D80000-memory.dmp
memory/4268-83-0x00007FFC0C020000-0x00007FFC0CB24000-memory.dmp
memory/4268-77-0x00007FF6B9BD0000-0x00007FF6B9D80000-memory.dmp
memory/4268-88-0x00007FFC0B6A0000-0x00007FFC0B7DE000-memory.dmp
memory/4268-87-0x00007FFC0B7E0000-0x00007FFC0BEB9000-memory.dmp
memory/4268-85-0x00007FFC1AD90000-0x00007FFC1AE38000-memory.dmp
memory/4268-81-0x00007FFC0CB30000-0x00007FFC0D5D2000-memory.dmp
memory/4268-89-0x00007FF6B9BD0000-0x00007FF6B9D80000-memory.dmp
memory/4268-100-0x00007FFC0B6A0000-0x00007FFC0B7DE000-memory.dmp
memory/4268-95-0x00007FFC0C020000-0x00007FFC0CB24000-memory.dmp
memory/4268-97-0x00007FFC1AD90000-0x00007FFC1AE38000-memory.dmp
memory/4268-93-0x00007FFC0CB30000-0x00007FFC0D5D2000-memory.dmp
memory/4268-99-0x00007FFC0B7E0000-0x00007FFC0BEB9000-memory.dmp
memory/4268-101-0x00007FF6B9BD0000-0x00007FF6B9D80000-memory.dmp
memory/4268-105-0x00007FFC0CB30000-0x00007FFC0D5D2000-memory.dmp
memory/4268-110-0x00007FFC24CD0000-0x00007FFC24CE6000-memory.dmp
memory/4268-109-0x00007FFC1AD90000-0x00007FFC1AE38000-memory.dmp
memory/4268-107-0x00007FFC0C020000-0x00007FFC0CB24000-memory.dmp
memory/4268-113-0x00007FF6B9BD0000-0x00007FF6B9D80000-memory.dmp
memory/4268-117-0x00007FFC0CB30000-0x00007FFC0D5D2000-memory.dmp
memory/4268-124-0x00007FFC0B6A0000-0x00007FFC0B7DE000-memory.dmp
memory/4268-121-0x00007FFC1AD90000-0x00007FFC1AE38000-memory.dmp
memory/4268-119-0x00007FFC0C020000-0x00007FFC0CB24000-memory.dmp
memory/4268-125-0x00007FF6B9BD0000-0x00007FF6B9D80000-memory.dmp
memory/4268-136-0x00007FFC0B6A0000-0x00007FFC0B7DE000-memory.dmp
memory/4268-133-0x00007FFC1AD90000-0x00007FFC1AE38000-memory.dmp
memory/4268-131-0x00007FFC0C020000-0x00007FFC0CB24000-memory.dmp
memory/4268-129-0x00007FFC0CB30000-0x00007FFC0D5D2000-memory.dmp
memory/4268-138-0x00007FF6B9BD0000-0x00007FF6B9D80000-memory.dmp
memory/4268-144-0x00007FFC0C020000-0x00007FFC0CB24000-memory.dmp
memory/4268-146-0x00007FFC1AD90000-0x00007FFC1AE38000-memory.dmp
memory/4268-145-0x00007FFC0BEC0000-0x00007FFC0C011000-memory.dmp
memory/4268-142-0x00007FFC0CB30000-0x00007FFC0D5D2000-memory.dmp
memory/4268-154-0x00007FFC0CB30000-0x00007FFC0D5D2000-memory.dmp
memory/4268-161-0x00007FFC0B6A0000-0x00007FFC0B7DE000-memory.dmp
memory/4268-158-0x00007FFC1AD90000-0x00007FFC1AE38000-memory.dmp
memory/4268-156-0x00007FFC0C020000-0x00007FFC0CB24000-memory.dmp
memory/4268-150-0x00007FF6B9BD0000-0x00007FF6B9D80000-memory.dmp
memory/4268-166-0x00007FFC0CB30000-0x00007FFC0D5D2000-memory.dmp
memory/4268-173-0x00007FFC0B6A0000-0x00007FFC0B7DE000-memory.dmp
memory/4268-170-0x00007FFC1AD90000-0x00007FFC1AE38000-memory.dmp
memory/4268-168-0x00007FFC0C020000-0x00007FFC0CB24000-memory.dmp
memory/4268-162-0x00007FF6B9BD0000-0x00007FF6B9D80000-memory.dmp
memory/4268-178-0x00007FFC0CB30000-0x00007FFC0D5D2000-memory.dmp
memory/4268-182-0x00007FFC1AD90000-0x00007FFC1AE38000-memory.dmp
memory/4268-185-0x00007FFC0B6A0000-0x00007FFC0B7DE000-memory.dmp
memory/4268-180-0x00007FFC0C020000-0x00007FFC0CB24000-memory.dmp
memory/4268-174-0x00007FF6B9BD0000-0x00007FF6B9D80000-memory.dmp
memory/4268-190-0x00007FFC0CB30000-0x00007FFC0D5D2000-memory.dmp
memory/4268-192-0x00007FFC0C020000-0x00007FFC0CB24000-memory.dmp
memory/4268-186-0x00007FF6B9BD0000-0x00007FF6B9D80000-memory.dmp