Analysis
- max time kernel
148s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 11:48
General
- Target PoiTime.exe
- Size 180KB
- Sample261102-nynpgaeh55
- SHA256 e1056dea7d83087696f881e16a27ec9b3fd274c275bf371a5bf594aed7584bbd
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PoiTime.exe"C:\Users\Admin\AppData\Local\Temp\PoiTime.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\PoiTime.exeC:\Users\Admin\AppData\Local\Temp\PoiTime.exe1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3488-10-0x000000000B6F0000-0x000000000B708000-memory.dmp
memory/3488-1-0x0000000000820000-0x0000000000852000-memory.dmp
memory/3488-2-0x0000000005A60000-0x000000000601A000-memory.dmp
memory/3488-3-0x0000000005390000-0x0000000005422000-memory.dmp
memory/3488-4-0x0000000074DF0000-0x00000000755AC000-memory.dmp
memory/3488-5-0x0000000005470000-0x000000000547A000-memory.dmp
memory/3488-6-0x000000000B290000-0x000000000B344000-memory.dmp
memory/3488-7-0x000000000B680000-0x000000000B68A000-memory.dmp
memory/3488-9-0x000000000B690000-0x000000000B698000-memory.dmp
memory/3488-8-0x000000000B6C0000-0x000000000B6E6000-memory.dmp
memory/3488-12-0x000000000B720000-0x000000000B728000-memory.dmp
memory/3488-11-0x000000000B6B0000-0x000000000B6BA000-memory.dmp
memory/3488-0-0x0000000074E02000-0x0000000074E03000-memory.dmp
memory/3488-13-0x000000000B730000-0x000000000B73A000-memory.dmp
memory/3488-14-0x000000000B7E0000-0x000000000B7FE000-memory.dmp
memory/3488-15-0x0000000074DF0000-0x00000000755AC000-memory.dmp
memory/3488-19-0x0000000074DF0000-0x00000000755AC000-memory.dmp
memory/3488-18-0x0000000074E02000-0x0000000074E03000-memory.dmp
memory/4880-17-0x0000000074DF0000-0x00000000755AC000-memory.dmp
memory/4880-16-0x0000000074DF0000-0x00000000755AC000-memory.dmp