Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
10/11/2026, 10:20
General
- Target 04ab212dd768968b1cb025b40664d997.exe
- Size 325KB
- Sample261110-mc7psa1zhy
- SHA256 2e93ca8ce2c283e68bafc0dbf16e2d50e8a370d24f74aa0c1120c8ac73b2d879
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
- Suspicious use of SetThreadContext 2 IoCs
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\04ab212dd768968b1cb025b40664d997.exe"C:\Users\Admin\AppData\Local\Temp\04ab212dd768968b1cb025b40664d997.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\DsemanagerUpdate\dsemanager.exe"dsemanager.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exeC:\Users\Admin\AppData\Roaming\DsemanagerUpdate\dsemanager.exe3⤵
- Event Triggered Execution: Netsh Helper DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd.exe" /c echo qwe > \\.\pipe\newtg_MyControlPipeaaa4⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\arp.exe"arp" -a 10.127.0.14⤵
- Network Service Discovery
-
-
-
-
C:\Users\Admin\AppData\Roaming\DsemanagerUpdate\dsemanager.exe"C:\Users\Admin\AppData\Roaming\DsemanagerUpdate\dsemanager.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exeC:\Users\Admin\AppData\Roaming\DsemanagerUpdate\dsemanager.exe2⤵
- Event Triggered Execution: Netsh Helper DLL
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
current_guid
Microsoft.Diagnostics.Tracing.EventSource.dll
Microsoft.Tools.Deploy.dll
Tracing.EventSource.check.exe
WinAppDeployCommon.dll
atiadlxy.dll
dsemanager.exe
install.dat
memory/5216-28-0x0000013899C50000-0x0000013899C88000-memory.dmp
memory/5216-29-0x0000013899C50000-0x0000013899C88000-memory.dmp
memory/5216-26-0x0000013899C50000-0x0000013899C88000-memory.dmp
memory/5216-27-0x0000013899C50000-0x0000013899C88000-memory.dmp
memory/5528-23-0x000001DBFB710000-0x000001DBFB8D2000-memory.dmp
memory/5528-14-0x000001DBE0A00000-0x000001DBE1E00000-memory.dmp
memory/5528-19-0x000001DBDE740000-0x000001DBDE74E000-memory.dmp
memory/5528-16-0x000001DBE1E40000-0x000001DBE1E78000-memory.dmp
memory/5528-30-0x000001DBDE7B0000-0x000001DBDE7C0000-memory.dmp
memory/5528-32-0x000001DBDE7C0000-0x000001DBDE7CE000-memory.dmp
memory/5528-15-0x000001DBE1E00000-0x000001DBE1E33000-memory.dmp
memory/5528-34-0x000001DBDECE0000-0x000001DBDECF2000-memory.dmp
memory/5528-35-0x000001DBDED40000-0x000001DBDED7C000-memory.dmp
memory/5528-36-0x000001DBDEAB0000-0x000001DBDEABA000-memory.dmp
memory/5528-37-0x000001DBDE7D0000-0x000001DBDE7DC000-memory.dmp
memory/5528-39-0x000001DBDEDC0000-0x000001DBDEDCA000-memory.dmp
memory/5528-41-0x000001DBDEDF0000-0x000001DBDEDFA000-memory.dmp
memory/5528-42-0x000001DBDEE00000-0x000001DBDEE08000-memory.dmp
memory/5528-43-0x000001DBFB8E0000-0x000001DBFB9D8000-memory.dmp
memory/5528-24-0x000001DBFBE10000-0x000001DBFC338000-memory.dmp
memory/5528-11-0x000001DBE1E40000-0x000001DBE1E78000-memory.dmp
memory/5528-12-0x000001DBE1E40000-0x000001DBE1E78000-memory.dmp
memory/5528-13-0x000001DBE1E40000-0x000001DBE1E78000-memory.dmp
memory/5528-73-0x000001DBE1F00000-0x000001DBE1F0E000-memory.dmp
memory/5528-75-0x000001DBE1F10000-0x000001DBE1F18000-memory.dmp
memory/5528-303-0x000001DBFB5A0000-0x000001DBFB5B0000-memory.dmp
memory/5528-307-0x000001DBFB5C0000-0x000001DBFB5CC000-memory.dmp
memory/5528-309-0x000001DBFB5E0000-0x000001DBFB5EC000-memory.dmp
memory/5528-310-0x000001DBFB9E0000-0x000001DBFBA56000-memory.dmp
memory/5528-312-0x000001DBFB620000-0x000001DBFB63E000-memory.dmp
memory/5528-313-0x000001DBFB5D0000-0x000001DBFB5D8000-memory.dmp
memory/5528-317-0x000001DBFB5F0000-0x000001DBFB5FA000-memory.dmp
memory/5528-321-0x000001DBFB600000-0x000001DBFB60C000-memory.dmp
memory/5528-324-0x000001DBFB640000-0x000001DBFB652000-memory.dmp