5f334916a5b224bc6af7137608d63fdebcdfcc888e7e39946161bb472fab33b2

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/04/2026, 00:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BIN/Procmon.exe
Size 3.9MB
Sample260408-ap29lsgs41
SHA256 5f334916a5b224bc6af7137608d63fdebcdfcc888e7e39946161bb472fab33b2
MD5 ce92949961476e09b71107d771834e19
SHA1 769f8471c938e3ad75241b9d609aa4ad8f90bea2
SHA512 9565ad420eb50b425c0e1b28e375a33e9c94c4e65f933698bbd1aaa87b749a011788aeef2fd8245b1603894def0d5349934e7718b8c444e2964a5174a00da8e2
SSDEEP 49152:c9TJDVmHMAlNXFJelNOBLVKcu6NvhM6qHJfTJb5lmzSzko22LGywmtG6tlp0NjCX:Q4sA5JelIBs9JlmzSzko2zjCf9fJ
TLSH
T132167E1333D440E5E26952308ABBC67AD6767C79077245DB26E84E4F3F32AD52A38732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Drivers\PROCMON24.SYS	Procmon64.exe
File created	C:\Windows\system32\Drivers\PROCMON24.SYS	Procmon64.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCMON24\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCMON24.SYS"	Procmon64.exe

Executes dropped EXE 1 IoCs

pid	Process
3144	Procmon64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Procmon.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Procmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\.PML\ = "ProcMon.Logfile.1"	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\ProcMon.Logfile.1	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\ProcMon.Logfile.1\ = "ProcMon Log File"	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\ProcMon.Logfile.1\shell\open\command	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\ProcMon.Logfile.1\shell	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\ProcMon.Logfile.1\shell\open	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\ProcMon.Logfile.1\DefaultIcon	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\.PML	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\ProcMon.Logfile.1\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\BIN\\Procmon.exe\" /OpenLog \"%1\""	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\ProcMon.Logfile.1\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\BIN\\Procmon.exe\",0"	Procmon64.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3144	Procmon64.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
3144	Procmon64.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3144	Procmon64.exe
Token: SeLoadDriverPrivilege	3144	Procmon64.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3144	Procmon64.exe
3144	Procmon64.exe
3144	Procmon64.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 3144	2248	Procmon.exe	79

C:\Users\Admin\AppData\Local\Temp\BIN\Procmon.exe
"C:\Users\Admin\AppData\Local\Temp\BIN\Procmon.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Users\Admin\AppData\Local\Temp\Procmon64.exe
  "C:\Users\Admin\AppData\Local\Temp\Procmon64.exe" /originalpath "C:\Users\Admin\AppData\Local\Temp\BIN\Procmon.exe"
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Procmon64.exe

Path C:\Users\Admin\AppData\Local\Temp\Procmon64.exe
Size 2.0MB
SHA256 3e15995894f38b2eead95f7ff714585471f34f3af3d8f50a7f83344781502468
MD5 223b222ce387a7f446d49a1ee9b572bb
SHA1 8ed888a02861142e5eb576385568c2ba0ddd8589
SHA512 037b4787af5fb129a3b1e0ac9565e59d5a55ef26ccf93bc9adf685c08422071ee0d0eb4667cd2ce0d725c7dea0209c1d7d48baf58cd18dfb58de35bf7feef1a2
SSDEEP 49152:LNvhM6qHJfTJb5lmzSzko22LGywmtG6tlp0NjCw6IxKX:ElmzSzko2zjCf9
TLSH
T185A56D5723E800D8E16E927489B7CA3AE6B27C55037286EF16E84D4F3F33AD51939721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2248-59-0x0000000001380000-0x00000000013FC000-memory.dmp

Download

memory/3144-61-0x0000013415D80000-0x0000013415E2F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads