Analysis
- max time kernel
150s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 23:51
General
- Target bin/deCONZ.exe
- Size 2.4MB
- Sample261102-3wfy6sf14m
- SHA256 c3ea52f62d1f23b46c01b073f7a2807f939deebd4a881a62da5096b1998ccf5e
Malware Config
Signatures
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bin\deCONZ.exe"C:\Users\Admin\AppData\Local\Temp\bin\deCONZ.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
config.ini
config.ini.lock
memory/5092-0-0x00007FF69C460000-0x00007FF69C610000-memory.dmp
memory/5092-2-0x00000201B66D0000-0x00000201B66E0000-memory.dmp
memory/5092-1-0x00007FFF15CA0000-0x00007FFF16742000-memory.dmp
memory/5092-65-0x00007FF69C460000-0x00007FF69C610000-memory.dmp
memory/5092-66-0x00007FFF30BD0000-0x00007FFF30BF2000-memory.dmp
memory/5092-70-0x00007FFF30BA0000-0x00007FFF30BCA000-memory.dmp
memory/5092-71-0x00007FFF15190000-0x00007FFF15C94000-memory.dmp
memory/5092-76-0x00007FFF195D0000-0x00007FFF1970E000-memory.dmp
memory/5092-75-0x00007FFF1A8E0000-0x00007FFF1AA31000-memory.dmp
memory/5092-74-0x00007FFF14AB0000-0x00007FFF15189000-memory.dmp
memory/5092-73-0x00007FFF29110000-0x00007FFF291B8000-memory.dmp
memory/5092-69-0x00007FFF15CA0000-0x00007FFF16742000-memory.dmp
memory/5092-72-0x00007FFF2E9E0000-0x00007FFF2E9F6000-memory.dmp
memory/5092-68-0x00007FFF1AA40000-0x00007FFF1AC3B000-memory.dmp
memory/5092-67-0x00007FFF20FA0000-0x00007FFF211CA000-memory.dmp
memory/5092-77-0x00007FF69C460000-0x00007FF69C610000-memory.dmp
memory/5092-85-0x00007FFF29110000-0x00007FFF291B8000-memory.dmp
memory/5092-88-0x00007FFF195D0000-0x00007FFF1970E000-memory.dmp
memory/5092-86-0x00007FFF14AB0000-0x00007FFF15189000-memory.dmp
memory/5092-81-0x00007FFF15CA0000-0x00007FFF16742000-memory.dmp
memory/5092-83-0x00007FFF15190000-0x00007FFF15C94000-memory.dmp
memory/5092-89-0x00007FF69C460000-0x00007FF69C610000-memory.dmp
memory/5092-93-0x00007FFF15CA0000-0x00007FFF16742000-memory.dmp
memory/5092-100-0x00007FFF195D0000-0x00007FFF1970E000-memory.dmp
memory/5092-95-0x00007FFF15190000-0x00007FFF15C94000-memory.dmp
memory/5092-97-0x00007FFF29110000-0x00007FFF291B8000-memory.dmp
memory/5092-101-0x00007FF69C460000-0x00007FF69C610000-memory.dmp
memory/5092-109-0x00007FFF29110000-0x00007FFF291B8000-memory.dmp
memory/5092-105-0x00007FFF15CA0000-0x00007FFF16742000-memory.dmp
memory/5092-107-0x00007FFF15190000-0x00007FFF15C94000-memory.dmp
memory/5092-108-0x00007FFF2E9E0000-0x00007FFF2E9F6000-memory.dmp
memory/5092-113-0x00007FF69C460000-0x00007FF69C610000-memory.dmp
memory/5092-121-0x00007FFF29110000-0x00007FFF291B8000-memory.dmp
memory/5092-122-0x00007FFF14AB0000-0x00007FFF15189000-memory.dmp
memory/5092-124-0x00007FFF195D0000-0x00007FFF1970E000-memory.dmp
memory/5092-119-0x00007FFF15190000-0x00007FFF15C94000-memory.dmp
memory/5092-117-0x00007FFF15CA0000-0x00007FFF16742000-memory.dmp
memory/5092-125-0x00007FF69C460000-0x00007FF69C610000-memory.dmp
memory/5092-131-0x00007FFF15190000-0x00007FFF15C94000-memory.dmp
memory/5092-136-0x00007FFF195D0000-0x00007FFF1970E000-memory.dmp
memory/5092-129-0x00007FFF15CA0000-0x00007FFF16742000-memory.dmp
memory/5092-133-0x00007FFF29110000-0x00007FFF291B8000-memory.dmp
memory/5092-138-0x00007FF69C460000-0x00007FF69C610000-memory.dmp
memory/5092-142-0x00007FFF15CA0000-0x00007FFF16742000-memory.dmp
memory/5092-148-0x00007FFF1A8E0000-0x00007FFF1AA31000-memory.dmp
memory/5092-144-0x00007FFF15190000-0x00007FFF15C94000-memory.dmp
memory/5092-146-0x00007FFF29110000-0x00007FFF291B8000-memory.dmp
memory/5092-150-0x00007FF69C460000-0x00007FF69C610000-memory.dmp
memory/5092-158-0x00007FFF29110000-0x00007FFF291B8000-memory.dmp
memory/5092-161-0x00007FFF195D0000-0x00007FFF1970E000-memory.dmp
memory/5092-156-0x00007FFF15190000-0x00007FFF15C94000-memory.dmp
memory/5092-154-0x00007FFF15CA0000-0x00007FFF16742000-memory.dmp
memory/5092-162-0x00007FF69C460000-0x00007FF69C610000-memory.dmp
memory/5092-166-0x00007FFF15CA0000-0x00007FFF16742000-memory.dmp
memory/5092-168-0x00007FFF15190000-0x00007FFF15C94000-memory.dmp
memory/5092-170-0x00007FFF29110000-0x00007FFF291B8000-memory.dmp
memory/5092-182-0x00007FFF29110000-0x00007FFF291B8000-memory.dmp
memory/5092-174-0x00007FF69C460000-0x00007FF69C610000-memory.dmp
memory/5092-180-0x00007FFF15190000-0x00007FFF15C94000-memory.dmp
memory/5092-185-0x00007FFF195D0000-0x00007FFF1970E000-memory.dmp
memory/5092-178-0x00007FFF15CA0000-0x00007FFF16742000-memory.dmp
memory/5092-186-0x00007FF69C460000-0x00007FF69C610000-memory.dmp
memory/5092-194-0x00007FFF29110000-0x00007FFF291B8000-memory.dmp
memory/5092-190-0x00007FFF15CA0000-0x00007FFF16742000-memory.dmp
memory/5092-192-0x00007FFF15190000-0x00007FFF15C94000-memory.dmp