7571ede0485f6d88a7ac1b305e6af52752e850959a286df706d0c1fe18312999

Resubmissions

11/05/2026, 14:16

260511-rllacsb1718

11/05/2026, 13:31

260511-qssscabs2s8

Analysis

max time kernel
298s
max time network
331s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 13:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SAP-GUI-770/system/sap/lang/wdtllogsk.txt
Size 4KB
Sample260511-qssscabs2s
SHA256 7571ede0485f6d88a7ac1b305e6af52752e850959a286df706d0c1fe18312999
MD5 6c03602be700c2d85ccadfc2415131d0
SHA1 114acaddc4e632c59fe96196c3218ecde063d8c4
SHA512 c85b69c10b389a808e38a17fd587eb5d78835149c5dcc68d068659fb515be0ad36a4ec166e2eac949ae7866bf92507779521fa3b2bbd85fc050cba1dfe5422a0
SSDEEP 96:piLR9wnV+EevNugo3raBra2z1XF53bwa02iBlmhFm1s:koJqg039B5es
TLSH
T11BB1D06917841E51C6CDE5E9349B9F03B3DC9746090A052D328DA8C1A7B4A73FFB3A86
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 2944	2804	cmd.exe	79

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\SAP-GUI-770\system\sap\lang\wdtllogsk.txt
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\SAP-GUI-770\system\sap\lang\wdtllogsk.txt
  2⤵
  PID:2944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2944-0-0x00000136AE120000-0x00000136AE23E000-memory.dmp

Download