Analysis
- max time kernel
30s - max time network
20s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
04/11/2026, 16:51
General
- Target 63c4e17fa9b6d87a9f4b68b854cae50e95f8de2a86929fecb8f34af0d15798e7.exe
- Size 808KB
- Sample261104-vctrxsbx2z
- SHA256 63c4e17fa9b6d87a9f4b68b854cae50e95f8de2a86929fecb8f34af0d15798e7
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\63c4e17fa9b6d87a9f4b68b854cae50e95f8de2a86929fecb8f34af0d15798e7.exe"C:\Users\Admin\AppData\Local\Temp\63c4e17fa9b6d87a9f4b68b854cae50e95f8de2a86929fecb8f34af0d15798e7.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
AgileDotNetRT.dll
memory/1164-0-0x0000000000F00000-0x0000000000FCE000-memory.dmp
memory/1164-1-0x00000000059A0000-0x00000000059B0000-memory.dmp
memory/1164-2-0x00000000058C0000-0x00000000058F8000-memory.dmp
memory/1164-100-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-116-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-134-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-132-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-130-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-128-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-126-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-124-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-122-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-120-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-118-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-114-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-112-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-111-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-108-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-106-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-104-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-102-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-98-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-96-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-94-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-92-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-90-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-88-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-86-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-84-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-82-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-78-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-76-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-74-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-72-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-71-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-66-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-64-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-62-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-60-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-56-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-54-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-52-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-48-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-46-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-44-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-42-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-41-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-39-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-36-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-34-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-32-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-30-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-28-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-26-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-24-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-22-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-20-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-18-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-16-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-14-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-12-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-10-0x0000000073770000-0x00000000737F9000-memory.dmp
memory/1164-80-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-68-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-58-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-50-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-11-0x00000000058C0000-0x00000000058F2000-memory.dmp
memory/1164-193-0x00000000059A0000-0x00000000059B0000-memory.dmp
memory/1164-194-0x00000000069A0000-0x0000000006F44000-memory.dmp
memory/1164-195-0x0000000006490000-0x0000000006522000-memory.dmp
memory/1164-196-0x00000000059A0000-0x00000000059B0000-memory.dmp