ee34aa5e5e490d6a31fa3474c02c3d942fc725656b7e469d0f9ad49a64f1172f

Analysis

max time kernel
0s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/03/2026, 04:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ee34aa5e5e490d6a31fa3474c02c3d942fc725656b7e469d0f9ad49a64f1172f.exe
Size 6.4MB
Sample260305-ep3mlab12q
SHA256 ee34aa5e5e490d6a31fa3474c02c3d942fc725656b7e469d0f9ad49a64f1172f
MD5 2ee2eff62d0d3631dd27a3dc45ed3809
SHA1 96f9dad1077eb27e362677359c8a75043dd62222
SHA512 7afa004a570d4ea142ff86f1fc78e7e9013d89622891f4557796bab8fa7a9e9a79d82b4249b766ac8a79e339a0d6429c1d71817cf0396b1576489ea0082773f2
SSDEEP 49152:CIld0fxaVaGMtmqmj+bN3rwKltXvmRUtaHcTIRkAm4pQR5QW4gM3zJj3cj0BrCUG:CAwt9LscukAPMrkZukbcEn5g
TLSH
T1EB664A03ECA155E9C0BAE2318A639252BB717C895F3123D32B90F7292F76BD06E75750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	2	Go-http-client/1.1
HTTP User-Agent header	4	Go-http-client/1.1

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	404	WMIC.exe
Token: SeSecurityPrivilege	404	WMIC.exe
Token: SeTakeOwnershipPrivilege	404	WMIC.exe
Token: SeLoadDriverPrivilege	404	WMIC.exe
Token: SeSystemProfilePrivilege	404	WMIC.exe
Token: SeSystemtimePrivilege	404	WMIC.exe
Token: SeProfSingleProcessPrivilege	404	WMIC.exe
Token: SeIncBasePriorityPrivilege	404	WMIC.exe
Token: SeCreatePagefilePrivilege	404	WMIC.exe
Token: SeBackupPrivilege	404	WMIC.exe
Token: SeRestorePrivilege	404	WMIC.exe
Token: SeShutdownPrivilege	404	WMIC.exe
Token: SeDebugPrivilege	404	WMIC.exe
Token: SeSystemEnvironmentPrivilege	404	WMIC.exe
Token: SeRemoteShutdownPrivilege	404	WMIC.exe
Token: SeUndockPrivilege	404	WMIC.exe
Token: SeManageVolumePrivilege	404	WMIC.exe
Token: 33	404	WMIC.exe
Token: 34	404	WMIC.exe
Token: 35	404	WMIC.exe
Token: 36	404	WMIC.exe
Token: SeIncreaseQuotaPrivilege	404	WMIC.exe
Token: SeSecurityPrivilege	404	WMIC.exe
Token: SeTakeOwnershipPrivilege	404	WMIC.exe
Token: SeLoadDriverPrivilege	404	WMIC.exe
Token: SeSystemProfilePrivilege	404	WMIC.exe
Token: SeSystemtimePrivilege	404	WMIC.exe
Token: SeProfSingleProcessPrivilege	404	WMIC.exe
Token: SeIncBasePriorityPrivilege	404	WMIC.exe
Token: SeCreatePagefilePrivilege	404	WMIC.exe
Token: SeBackupPrivilege	404	WMIC.exe
Token: SeRestorePrivilege	404	WMIC.exe
Token: SeShutdownPrivilege	404	WMIC.exe
Token: SeDebugPrivilege	404	WMIC.exe
Token: SeSystemEnvironmentPrivilege	404	WMIC.exe
Token: SeRemoteShutdownPrivilege	404	WMIC.exe
Token: SeUndockPrivilege	404	WMIC.exe
Token: SeManageVolumePrivilege	404	WMIC.exe
Token: 33	404	WMIC.exe
Token: 34	404	WMIC.exe
Token: 35	404	WMIC.exe
Token: 36	404	WMIC.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 3336	1872	ee34aa5e5e490d6a31fa3474c02c3d942fc725656b7e469d0f9ad49a64f1172f.exe	80
PID 3336 wrote to memory of 404	3336	CMD.exe	82

C:\Users\Admin\AppData\Local\Temp\ee34aa5e5e490d6a31fa3474c02c3d942fc725656b7e469d0f9ad49a64f1172f.exe
"C:\Users\Admin\AppData\Local\Temp\ee34aa5e5e490d6a31fa3474c02c3d942fc725656b7e469d0f9ad49a64f1172f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC BIOS GET SERIALNUMBER"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3336
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC BIOS GET SERIALNUMBER
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:404
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC DISKDRIVE GET SERIALNUMBER"
  2⤵
  PID:2136
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC DISKDRIVE GET SERIALNUMBER
    3⤵
    PID:3332
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC CPU GET ProcessorID"
  2⤵
  PID:4656
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC CPU GET ProcessorID
    3⤵
    PID:4024
- C:\Users\Admin\AppData\Local\Temp\ee34aa5e5e490d6a31fa3474c02c3d942fc725656b7e469d0f9ad49a64f1172f.exe
  "C:\Users\Admin\AppData\Local\Temp\ee34aa5e5e490d6a31fa3474c02c3d942fc725656b7e469d0f9ad49a64f1172f.exe" ae5bb3490601a4a21a90540a7ce1a05d3e68dec0d82692931a50cbbfdc5c17e45c014c4ceeee8cddf8d1f67e0d15e1a11c2f955d45a94670512775541c804a19c798040e1e45b4d9490a53a8c3714c73cacd4c06fdbb968a1711f12c014b507b3f35dd01bb81fb13359833dd50
  2⤵
  PID:4972

C:\ProgramData\Telegram\telegram.exe
C:\ProgramData\Telegram\telegram.exe
1⤵
PID:4460
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC BIOS GET SERIALNUMBER"
  2⤵
  PID:2280
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC BIOS GET SERIALNUMBER
    3⤵
    PID:2352
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC DISKDRIVE GET SERIALNUMBER"
  2⤵
  PID:4852
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC DISKDRIVE GET SERIALNUMBER
    3⤵
    PID:2012
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC CPU GET ProcessorID"
  2⤵
  PID:2704
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC CPU GET ProcessorID
    3⤵
    PID:3712
- C:\ProgramData\Telegram\telegram.exe
  "C:\ProgramData\Telegram\telegram.exe" b5d304c45615642e4a181c9d669a614cf8760e0ba09c8e06753cafcf6de120dadb9c5a3e35f6db53a7659b933d48a4d7203b16b86b1ca27e081c725d476247bd2caf82b6afc8b45c1ecc7d4671becc28ccc787f69af82a1f3db62e1c6e8a7c11c2ab0f22eb24eaeff7e0dbcc09
  2⤵
  PID:3644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

telegram.exe

Path C:\ProgramData\Telegram\telegram.exe
Size 664KB
SHA256 678b1cd117767d94c16e45d28ab15b832e28b50bdc426e544c028e013a6e306f
MD5 d32cbcfef12d40f92bc4e79976841a7e
SHA1 e6a92df56b81183bc2b3cda150f19cc097c77b0f
SHA512 f4ef2018ab30abbc8810fa18f079c14434fd65d08434a2870f2ff44cfa9a47b41183fe60027c229f7496801f378766ec4cd31a270d52aef56868bf76de4a89e0
SSDEEP 12288:lc3GgvXl6qYX51/FjakmXLugIv4jcQ4p0xYoi:lc3Ggv10Xv/JaVKqaIi
TLSH
T1EAE4E55B6CB940F8C0FEE174C666B613BD723454073837D72EA19A600F9AFE0A5B8B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download