dbfde43065a6240fbcd7afcacefb515ca217d54e160d337b3c7d1f97cf23ec44

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 23:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dbfde43065a6240fbcd7afcacefb515ca217d54e160d337b3c7d1f97cf23ec44.exe
Size 316KB
Sample260601-3c3c3aav2p
SHA256 dbfde43065a6240fbcd7afcacefb515ca217d54e160d337b3c7d1f97cf23ec44
MD5 faced00dc3b5eb391c8b8af9b4c3cad9
SHA1 ceb53f3f3e660665818905e110ea6cf04a286808
SHA512 c2aa8a48461be816762d6a64426518704b351b3f4f974d3a69bbfc15bcfd10ea8402858c2c2ccc4b468042d2621b91e6b6c5facf4e8814fd77c2cc7ded0ef6c1
SSDEEP 6144:rQ8OyYvc36AVuc7DQd/5zlgBR4JDiyebbSkjrH:rj16Qu15yBRCDRMjrH
TLSH
T183648D5AF3A814F9F977923CC8529507E772BC160760D78F27A046663F236A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2492	apprtf607.exe
4208	apprtf607.exe
1140	svcf607.exe
3140	svcf607.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppRtf607 = "C:\\Users\\Admin\\AppData\\Local\\AppRtf607\\apprtf607.exe"	dbfde43065a6240fbcd7afcacefb515ca217d54e160d337b3c7d1f97cf23ec44.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppSvcf607 = "C:\\Users\\Admin\\AppData\\Local\\Programs\\f607\\svcf607.exe"	apprtf607.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2864	dbfde43065a6240fbcd7afcacefb515ca217d54e160d337b3c7d1f97cf23ec44.exe
2864	dbfde43065a6240fbcd7afcacefb515ca217d54e160d337b3c7d1f97cf23ec44.exe
2492	apprtf607.exe
2492	apprtf607.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2492	2864	dbfde43065a6240fbcd7afcacefb515ca217d54e160d337b3c7d1f97cf23ec44.exe	80
PID 2492 wrote to memory of 1140	2492	apprtf607.exe	83

C:\Users\Admin\AppData\Local\Temp\dbfde43065a6240fbcd7afcacefb515ca217d54e160d337b3c7d1f97cf23ec44.exe
"C:\Users\Admin\AppData\Local\Temp\dbfde43065a6240fbcd7afcacefb515ca217d54e160d337b3c7d1f97cf23ec44.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Users\Admin\AppData\Local\AppRtf607\apprtf607.exe
  "C:\Users\Admin\AppData\Local\AppRtf607\apprtf607.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Users\Admin\AppData\Local\Programs\f607\svcf607.exe
    "C:\Users\Admin\AppData\Local\Programs\f607\svcf607.exe"
    3⤵
    - Executes dropped EXE
    PID:1140

C:\Users\Admin\AppData\Local\AppRtf607\apprtf607.exe
C:\Users\Admin\AppData\Local\AppRtf607\apprtf607.exe
1⤵
- Executes dropped EXE
PID:4208

C:\Users\Admin\AppData\Local\Programs\f607\svcf607.exe
C:\Users\Admin\AppData\Local\Programs\f607\svcf607.exe
1⤵
- Executes dropped EXE
PID:3140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprtf607.exe

Path C:\Users\Admin\AppData\Local\AppRtf607\apprtf607.exe
Size 316KB
SHA256 3b02bba886f67048c4acd830399b6f3d5b04a86c47178e5112f7741877bace2e
MD5 23348fdd0708c11c4d72ee21bfe7b8b6
SHA1 8110ac59f77ff11216b2bdfa901ef7712aba32af
SHA512 992d4b0a15c9247c39ef3eb45c78ce65d7ef082edc87b9b576d5f38d5c4358bb82539be5015415523cefa9337b5b3885f2016e2405366d76d8cc4aeabb55f6ee
SSDEEP 6144:WQ8OyYvc36AVuc7DQd/5zlgBR4JDcyeAbS5urr:Wj16Qu15yBRCDvQurr
TLSH
T125648D5AF3A814F9F977923CC9529507E772BC160760D78F27A0466A3F232A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svcf607.exe

Path C:\Users\Admin\AppData\Local\Programs\f607\svcf607.exe
Size 317KB
SHA256 d8457a7759aaf18895fbd71faa5f3f85ca93815e2602cdd1752dec03d099b7cb
MD5 cac6bc0b1a2b032e7e4ed388e6e4401b
SHA1 d36a1c356c6dcf31a0c0721e47989c52c275f702
SHA512 79ac049f43881fbb9fe5bc13a8f252e2514f6abdbb0dc80b02c57a31ace6d1915bde2793204c77d9dc2219771c379fb5710aad2040f10c262e3eda54c13cebe8
SSDEEP 6144:8Q8OyYvc36AVuc7DQd/5zlgBR4JDqDyeGbSPsri:8j16Qu15yBRCDqu8sri
TLSH
T164648D5AF3A814F9F977923CC8529507E772BC160760D78F27A0466A3F236A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download