Analysis
- max time kernel
149s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
13/11/2026, 00:26
General
- Target 81f44013765580486de77bead284d978da7f8c873873854c176873afc6f690ea.exe
- Size 798KB
- Sample261113-arax5sys6l
- SHA256 81f44013765580486de77bead284d978da7f8c873873854c176873afc6f690ea
Malware Config
Signatures
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 32 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\81f44013765580486de77bead284d978da7f8c873873854c176873afc6f690ea.exe"C:\Users\Admin\AppData\Local\Temp\81f44013765580486de77bead284d978da7f8c873873854c176873afc6f690ea.exe"2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4308-1-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-0-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-3-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-6-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-4-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-2-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-7-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-5-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-24-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-25-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-33-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-27-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-34-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-35-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-26-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-20-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-36-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-17-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-14-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-13-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-12-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-11-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-10-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-8-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-30-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-28-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-23-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-22-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-21-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-19-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-18-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-16-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-15-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-9-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-32-0x0000000003810000-0x00000000038C2000-memory.dmp
memory/4308-37-0x0000000003810000-0x00000000038C2000-memory.dmp