77df2f90404e046425399ed9ca3adb77048a6652e333b1b9ffda042c93765fe9

Resubmissions

24/05/2026, 15:17

260524-spccasb13v7

09/05/2026, 17:33

260509-v5damsa16w8

Analysis

max time kernel
899s
max time network
402s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/05/2026, 17:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Cute_Program_v2/_/DontOpenMe/pic.exe
Size 119KB
Sample260509-v5damsa16w
SHA256 77df2f90404e046425399ed9ca3adb77048a6652e333b1b9ffda042c93765fe9
MD5 f5ef9b38ca6484ee2c4523897fb26081
SHA1 d1dac72c62c36e86ec4b8822c05530ee8cc93dbd
SHA512 b491489e1fcffb15ba990895fcdccbb1ec38931a1b792e29892d4ce13f7df449d048ce2aab52b962803cc280bb9baa07221639c898a417c40a2224b4091a19e2
SSDEEP 3072:C2sMWkzbJh1qZ9QW69hd1MMdxPe9N9uA0hu9TBfcXQB:jbJhs7QW69hd1MMdxPe9N9uA0hu9TBFB
TLSH
T11DC33966B2E01198DBB581F6D9921706EB7074361B15A3DB6BB853B31B2B4C68F3C3D0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 1344	1940	pic.exe	79

C:\Users\Admin\AppData\Local\Temp\Cute_Program_v2\_\DontOpenMe\pic.exe
"C:\Users\Admin\AppData\Local\Temp\Cute_Program_v2\_\DontOpenMe\pic.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\B5DE.tmp\B5DF.tmp\B5E0.bat C:\Users\Admin\AppData\Local\Temp\Cute_Program_v2\_\DontOpenMe\pic.exe"
  2⤵
  PID:1344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B5E0.bat

Path C:\Users\Admin\AppData\Local\Temp\B5DE.tmp\B5DF.tmp\B5E0.bat
Size 69B
SHA256 0005d86df5ced2fcbb1a9ecd20f4f26c91ec3a2f1e628ab4ab3b294b308104fd
MD5 8aaef9a65caaba91dbbc7b3b6dc8e5a6
SHA1 83560d9510045604b92b893757a6330ec96f5a5f
SHA512 420d6acf3d23da55f3bb18d4add5ecaa99136017ea434ba186f46c314bdf36ea0784cf85ea56228c08de53dd70d7bcb69fdb91f5d238a8f5195cfdd624d99236
TLSH
T182A012020460000032124901609E0086F96D7403C4812C0010A044642885A804706895
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1940-1066-0x0000000002830000-0x0000000002906000-memory.dmp

Download