f23e0d2a4cf44cd0d1c5b710fb666872ddcb436406ae000b6eeba803acf7ee26

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dpf26422000001257905011_setup.exe
Size 129KB
Sample260527-pg9faads9j
SHA256 f23e0d2a4cf44cd0d1c5b710fb666872ddcb436406ae000b6eeba803acf7ee26
MD5 c3c49f827801032281b6a22d0bd5807b
SHA1 6a674b2b6c199ab7e9764405be4bd06ff392dce0
SHA512 14d7bc8ae047458679a9588ce387c87417df279dae5e01544ac1e67f24f5233585ded06503f84265bb075c519c1ae028f147c7b28b6297b9be4125037a6cafb7
SSDEEP 3072:oo80AtOVfRD6sLOYB+9U86p5BtWWUkVECj3NzV0:p8Xsf/OYs9y5B5lvZV0
TLSH
T1A7D34D87B6A172ECD077827484531646A772BC7107289BEF4BA046761F132D2EF3BB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1772	vafkpuz.exe
4912	vafkpuz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 1772	3884	dpf26422000001257905011_setup.exe	81

C:\Users\Admin\AppData\Local\Temp\dpf26422000001257905011_setup.exe
"C:\Users\Admin\AppData\Local\Temp\dpf26422000001257905011_setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3884
- C:\ProgramData\xfolder32\vafkpuz.exe
  "C:\ProgramData\xfolder32\vafkpuz.exe"
  2⤵
  - Executes dropped EXE
  PID:1772

C:\ProgramData\xfolder32\vafkpuz.exe
C:\ProgramData\xfolder32\vafkpuz.exe
1⤵
- Executes dropped EXE
PID:4912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vafkpuz.exe

Path C:\ProgramData\xfolder32\vafkpuz.exe
Size 129KB
SHA256 f23e0d2a4cf44cd0d1c5b710fb666872ddcb436406ae000b6eeba803acf7ee26
MD5 c3c49f827801032281b6a22d0bd5807b
SHA1 6a674b2b6c199ab7e9764405be4bd06ff392dce0
SHA512 14d7bc8ae047458679a9588ce387c87417df279dae5e01544ac1e67f24f5233585ded06503f84265bb075c519c1ae028f147c7b28b6297b9be4125037a6cafb7
SSDEEP 3072:oo80AtOVfRD6sLOYB+9U86p5BtWWUkVECj3NzV0:p8Xsf/OYs9y5B5lvZV0
TLSH
T1A7D34D87B6A172ECD077827484531646A772BC7107289BEF4BA046761F132D2EF3BB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1772-9-0x000001A06D2F0000-0x000001A06D2F1000-memory.dmp

Download