Analysis
- user interaction
yes - max time kernel
72s - max time network
74s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
12/11/2026, 04:25
Behavioral task
behavioral1
Sample
Dad.exe
Resource
win11-20260911-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target Dad.exe
- Size 36KB
- Sample261112-e172fsdz8l
- SHA256 6b7ece115e29834acb4dc498ed319c2481551d740692154a8139b7973a4eac26
- MD5 ce49bde6a80faf20683a1acb61607126
- SHA1 78ca547a394345ea2152c11af7073ea225a737dd
- SHA512 23bde6c9c3d935c9a54f6a0e073c78f262246ee56569b1ba23afaca6b5ec7f9c3a4bc75e464450933384859a2939d227004cdb0e9894b993990e9c6f9e018e9b
- SSDEEP 384:CmOs0IiejvCVLO309QmykrtG+dA+VfwvOSifrAF+rMRTyN/0L+EcoinblneHQM3M:MFdGdkrgYRwWS0rM+rMRa8NuOqt
- TLSH T147F2294D7BE181A8C4FE167B05B2D4130777E04B5E23DD0D8EE6A4EA37236D18B54AE2
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3540 netsh.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Panther\UnattendGC\setupact.log UserOOBEBroker.exe File opened for modification C:\Windows\Panther\UnattendGC\setuperr.log UserOOBEBroker.exe File opened for modification C:\Windows\Panther\UnattendGC\diagerr.xml UserOOBEBroker.exe File opened for modification C:\Windows\Panther\UnattendGC\diagwrn.xml UserOOBEBroker.exe - Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9 Dad.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Dad.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Dad.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FileCoAuth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FileCoAuth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dad.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeDebugPrivilege 4440 Dad.exe Token: 33 4440 Dad.exe Token: SeIncBasePriorityPrivilege 4440 Dad.exe Token: 33 4440 Dad.exe Token: SeIncBasePriorityPrivilege 4440 Dad.exe Token: 33 4440 Dad.exe Token: SeIncBasePriorityPrivilege 4440 Dad.exe Token: SeDebugPrivilege 5896 taskmgr.exe Token: SeSystemProfilePrivilege 5896 taskmgr.exe Token: SeCreateGlobalPrivilege 5896 taskmgr.exe Token: 33 4440 Dad.exe Token: SeIncBasePriorityPrivilege 4440 Dad.exe Token: 33 4440 Dad.exe Token: SeIncBasePriorityPrivilege 4440 Dad.exe Token: 33 4440 Dad.exe Token: SeIncBasePriorityPrivilege 4440 Dad.exe Token: 33 4440 Dad.exe Token: SeIncBasePriorityPrivilege 4440 Dad.exe Token: 33 4440 Dad.exe Token: SeIncBasePriorityPrivilege 4440 Dad.exe - Suspicious use of FindShellTrayWindow 52 IoCs
pid Process 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe - Suspicious use of SendNotifyMessage 52 IoCs
pid Process 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe 5896 taskmgr.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4440 wrote to memory of 3540 4440 Dad.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dad.exe"C:\Users\Admin\AppData\Local\Temp\Dad.exe"1⤵
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Dad.exe" "Dad.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3540
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:5748
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
PID:5472
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
PID:5072
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
PID:3548
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5896
Network
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2026-11-12.425.5072.1.odl
- Size 706B
- SHA256 722b3b09debd3f81e6b00b874a4632d063359f4fd4538644730ee248e095e724
- MD5 fb04f59a4c330678b4c2ba17207e5420
- SHA1 88e852bc1933dd1cb90b75edfaf00bd750e2cd21
- SHA512 171a58f2ef4ce1cb0330f8af9b739f909ea18a1472a1c28e7494d22c60eca2ccf37743e531a104efe39041f5649c9830e627bda011e87ff07bdf23e8865ae41d
- TLSH T1DD01E9AFBD571575DE32553CC40DF30D58476A56384D6022C59907A6850F6A0221EE33
- MD5 SHA1 SHA512 TLSH