Analysis
- max time kernel
10s - max time network
19s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
07/11/2026, 12:17
General
- Target JAVser.exe
- Size 475KB
- Sample261107-pgb5saeg82
- SHA256 40933557efc19ff59a8c2bfb20e65f2aef3c89ebb9753e5ecdf5b3ad3e3c2f73
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JAVser.exe"C:\Users\Admin\AppData\Local\Temp\JAVser.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\JAVser.exeC:\Users\Admin\AppData\Local\Temp\JAVser.exe2⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
install.id.txt
jna12571375963119951988.dll
client-config.txt
favorite_collections.txt
favorites-moved-to-lists.txt
i18n-languages.txt
memory/3296-56-0x000001D4A5020000-0x000001D4A5030000-memory.dmp
memory/3296-66-0x000001D4A5040000-0x000001D4A5050000-memory.dmp
memory/3296-37-0x000001D4A4FA0000-0x000001D4A4FB0000-memory.dmp
memory/3296-39-0x000001D4A4FB0000-0x000001D4A4FC0000-memory.dmp
memory/3296-40-0x000001D4AC240000-0x000001D4AC4B0000-memory.dmp
memory/3296-42-0x000001D4A4FC0000-0x000001D4A4FD0000-memory.dmp
memory/3296-41-0x000001D4A4D10000-0x000001D4A4F80000-memory.dmp
memory/3296-44-0x000001D4A4FD0000-0x000001D4A4FE0000-memory.dmp
memory/3296-47-0x000001D4A4FE0000-0x000001D4A4FF0000-memory.dmp
memory/3296-46-0x000001D4AC7D0000-0x000001D4ACA40000-memory.dmp
memory/3296-49-0x000001D4A4FF0000-0x000001D4A5000000-memory.dmp
memory/3296-52-0x000001D4A5000000-0x000001D4A5010000-memory.dmp
memory/3296-53-0x000001D4A5010000-0x000001D4A5020000-memory.dmp
memory/3296-32-0x000001D4A4F80000-0x000001D4A4F90000-memory.dmp
memory/3296-5-0x000001D4AC240000-0x000001D4AC4B0000-memory.dmp
memory/3296-55-0x000001D4A4F80000-0x000001D4A4F90000-memory.dmp
memory/3296-63-0x000001D4A5030000-0x000001D4A5040000-memory.dmp
memory/3296-62-0x000001D4A4F90000-0x000001D4A4FA0000-memory.dmp
memory/3296-65-0x000001D4A4FA0000-0x000001D4A4FB0000-memory.dmp
memory/3296-35-0x000001D4A4F90000-0x000001D4A4FA0000-memory.dmp
memory/3296-91-0x000001D4A4FB0000-0x000001D4A4FC0000-memory.dmp
memory/3296-113-0x000001D4B6FC0000-0x000001D4B6FC1000-memory.dmp
memory/3296-112-0x000001D4B6FC0000-0x000001D4B6FC1000-memory.dmp
memory/3296-111-0x000001D4B6FC0000-0x000001D4B6FC1000-memory.dmp
memory/3296-110-0x000001D4B6FC0000-0x000001D4B6FC1000-memory.dmp
memory/3296-109-0x000001D4B6FC0000-0x000001D4B6FC1000-memory.dmp
memory/3296-107-0x000001D4B6FC0000-0x000001D4B6FC1000-memory.dmp
memory/3296-108-0x000001D4B6FC0000-0x000001D4B6FC1000-memory.dmp
memory/3296-132-0x000001D4A4FC0000-0x000001D4A4FD0000-memory.dmp
memory/3296-29-0x000001D4B6FC0000-0x000001D4B6FC1000-memory.dmp
memory/3296-30-0x000001D4B6FC0000-0x000001D4B6FC1000-memory.dmp
memory/3296-28-0x000001D4B6FC0000-0x000001D4B6FC1000-memory.dmp
memory/3296-14-0x000001D4A4D10000-0x000001D4A4F80000-memory.dmp
memory/3296-15-0x000001D4AC7D0000-0x000001D4ACA40000-memory.dmp
memory/3296-183-0x000001D4A4FD0000-0x000001D4A4FE0000-memory.dmp
memory/3296-221-0x000001D4A4FE0000-0x000001D4A4FF0000-memory.dmp
memory/3296-240-0x000001D4A4FF0000-0x000001D4A5000000-memory.dmp