87e4036121851a9afbede84da329c5ebff0cc3c22142a6dad7122d90466541cf

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
87e4036121851a9afbede84da329c5ebff0cc3c22142a6dad7122d90466541cf.exe
Size 316KB
Sample260601-w2ejzaev9m
SHA256 87e4036121851a9afbede84da329c5ebff0cc3c22142a6dad7122d90466541cf
MD5 cb6d8c82714157fc06c68f8daa097f09
SHA1 4290cda80acc41037f4f9e17fb72dbd4432095fe
SHA512 4ba39a1be1e5bdee7527a1dd07053a6058975e9db64ef669d1465fb90af37fa8327b8150e74bdba4f2a85689c1b5ebf6556c7daa88d8f7e42e071710d942ea0b
SSDEEP 6144:kQ8OyYvc36AVuc7DQd/5zlgBR4JDayesbSeur7x:kj16Qu15yBRCDJvur7x
TLSH
T14E648D5AF3A814F9F977923CC8529607E772BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1832	apprtf607.exe
3832	apprtf607.exe
4808	svcf607.exe
2492	svcf607.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppRtf607 = "C:\\Users\\Admin\\AppData\\Local\\AppRtf607\\apprtf607.exe"	87e4036121851a9afbede84da329c5ebff0cc3c22142a6dad7122d90466541cf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppSvcf607 = "C:\\Users\\Admin\\AppData\\Local\\Programs\\f607\\svcf607.exe"	apprtf607.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3760	87e4036121851a9afbede84da329c5ebff0cc3c22142a6dad7122d90466541cf.exe
3760	87e4036121851a9afbede84da329c5ebff0cc3c22142a6dad7122d90466541cf.exe
1832	apprtf607.exe
1832	apprtf607.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 1832	3760	87e4036121851a9afbede84da329c5ebff0cc3c22142a6dad7122d90466541cf.exe	80
PID 1832 wrote to memory of 4808	1832	apprtf607.exe	83

C:\Users\Admin\AppData\Local\Temp\87e4036121851a9afbede84da329c5ebff0cc3c22142a6dad7122d90466541cf.exe
"C:\Users\Admin\AppData\Local\Temp\87e4036121851a9afbede84da329c5ebff0cc3c22142a6dad7122d90466541cf.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Users\Admin\AppData\Local\AppRtf607\apprtf607.exe
  "C:\Users\Admin\AppData\Local\AppRtf607\apprtf607.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Users\Admin\AppData\Local\Programs\f607\svcf607.exe
    "C:\Users\Admin\AppData\Local\Programs\f607\svcf607.exe"
    3⤵
    - Executes dropped EXE
    PID:4808

C:\Users\Admin\AppData\Local\AppRtf607\apprtf607.exe
C:\Users\Admin\AppData\Local\AppRtf607\apprtf607.exe
1⤵
- Executes dropped EXE
PID:3832

C:\Users\Admin\AppData\Local\Programs\f607\svcf607.exe
C:\Users\Admin\AppData\Local\Programs\f607\svcf607.exe
1⤵
- Executes dropped EXE
PID:2492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprtf607.exe

Path C:\Users\Admin\AppData\Local\AppRtf607\apprtf607.exe
Size 316KB
SHA256 18d07b95813786a96c61f12dfa6116e1247e806b7250490019e1f7147cfb0b57
MD5 e043ad0e74cfd4f12e72baa1de6eef7c
SHA1 c2dcef482c3a8f243f80d64b96b6324fab242b2b
SHA512 18e6be9ec50692fbe6c6fcbab19b87faede1f9d3a03c3df882b4c0f66c4a1ee243ee03730ffffd576fcb2ce223c4ff72b83679dbae4168968277703e70055e8a
SSDEEP 6144:FQ8OyYvc36AVuc7DQd/5zlgBR4JDMyeHbSwvrQ:Fj16Qu15yBRCDfwvrQ
TLSH
T1F2648D5AF3A814F9F977923CC8529607E772BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svcf607.exe

Path C:\Users\Admin\AppData\Local\Programs\f607\svcf607.exe
Size 316KB
SHA256 5c9040ad98f1cf48d4c986704daff71778fb3e30698742bf73058fd335ae1253
MD5 92ec67d0edc605e7237205243cc88682
SHA1 8720c574ad84107e37e62b094dafa01071855772
SHA512 9c3ca214f8e2864bb7fae4f3c3518c2933f2fa4288451705dbec54bc24fe1ae05985e4d776cdbfb1472352ff63cce4ceb4affc48e1ba33c533d17072f0c741f0
SSDEEP 6144:5Q8OyYvc36AVuc7DQd/5zlgBR4JD4yeGbSBHWrO:5j16Qu15yBRCDrS2rO
TLSH
T179648D5AF3A814F9F977923CC8529607E772BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download