Analysis
- max time kernel
149s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
10/11/2026, 10:20
General
- Target 04ab212dd768968b1cb025b40664d997.exe
- Size 325KB
- Sample261110-mc7psa1zhy
- SHA256 2e93ca8ce2c283e68bafc0dbf16e2d50e8a370d24f74aa0c1120c8ac73b2d879
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 2 IoCs
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\04ab212dd768968b1cb025b40664d997.exe"C:\Users\Admin\AppData\Local\Temp\04ab212dd768968b1cb025b40664d997.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\DsemanagerUpdate\dsemanager.exe"dsemanager.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exeC:\Users\Admin\AppData\Roaming\DsemanagerUpdate\dsemanager.exe3⤵
- Event Triggered Execution: Netsh Helper DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd.exe" /c echo qwe > \\.\pipe\newtg_MyControlPipeaaa4⤵
- Executes a command shell one-liner
-
-
-
-
C:\Users\Admin\AppData\Roaming\DsemanagerUpdate\dsemanager.exeC:\Users\Admin\AppData\Roaming\DsemanagerUpdate\dsemanager.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exeC:\Users\Admin\AppData\Roaming\DsemanagerUpdate\dsemanager.exe2⤵
- Event Triggered Execution: Netsh Helper DLL
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
current_guid
Microsoft.Diagnostics.Tracing.EventSource.dll
Microsoft.Tools.Deploy.dll
Tracing.EventSource.check.exe
WinAppDeployCommon.dll
atiadlxy.dll
dsemanager.exe
install.dat
memory/728-30-0x000001EFAA6F0000-0x000001EFAA700000-memory.dmp
memory/728-14-0x000001EFAC1A0000-0x000001EFAD5A0000-memory.dmp
memory/728-23-0x000001EFAA850000-0x000001EFAAA12000-memory.dmp
memory/728-24-0x000001EFC6850000-0x000001EFC6D78000-memory.dmp
memory/728-78-0x000001EFAAAE0000-0x000001EFAAAEC000-memory.dmp
memory/728-76-0x000001EFAAAD0000-0x000001EFAAAD8000-memory.dmp
memory/728-74-0x000001EFAAAB0000-0x000001EFAAAC0000-memory.dmp
memory/728-73-0x000001EFAAAA0000-0x000001EFAAAA8000-memory.dmp
memory/728-15-0x000001EFAA270000-0x000001EFAA2A8000-memory.dmp
memory/728-32-0x000001EFAA710000-0x000001EFAA71E000-memory.dmp
memory/728-16-0x000001EFAA230000-0x000001EFAA263000-memory.dmp
memory/728-34-0x000001EFAA740000-0x000001EFAA752000-memory.dmp
memory/728-35-0x000001EFAA7A0000-0x000001EFAA7DC000-memory.dmp
memory/728-36-0x000001EFAA760000-0x000001EFAA76A000-memory.dmp
memory/728-37-0x000001EFAA720000-0x000001EFAA72C000-memory.dmp
memory/728-39-0x000001EFAA780000-0x000001EFAA78A000-memory.dmp
memory/728-41-0x000001EFAA830000-0x000001EFAA83A000-memory.dmp
memory/728-42-0x000001EFAA840000-0x000001EFAA848000-memory.dmp
memory/728-43-0x000001EFC64C0000-0x000001EFC65B8000-memory.dmp
memory/728-19-0x000001EFAD600000-0x000001EFAD60E000-memory.dmp
memory/728-11-0x000001EFAA270000-0x000001EFAA2A8000-memory.dmp
memory/728-12-0x000001EFAA270000-0x000001EFAA2A8000-memory.dmp
memory/728-13-0x000001EFAA270000-0x000001EFAA2A8000-memory.dmp
memory/5064-29-0x000002C68F470000-0x000002C68F4A8000-memory.dmp
memory/5064-27-0x000002C68F470000-0x000002C68F4A8000-memory.dmp
memory/5064-28-0x000002C68F470000-0x000002C68F4A8000-memory.dmp
memory/5064-26-0x000002C68F470000-0x000002C68F4A8000-memory.dmp