c66115510691594dd61319507a41d99b367925515560afa2577093061ca45c9b

Analysis

max time kernel
149s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c66115510691594dd61319507a41d99b367925515560afa2577093061ca45c9b.exe
Size 316KB
Sample260601-w4mncsds41
SHA256 c66115510691594dd61319507a41d99b367925515560afa2577093061ca45c9b
MD5 0a73cf92d65f7e8384d94fd99bcd4767
SHA1 a52a5d7143a2e218cbc7d572293f2f52f4e51533
SHA512 332991445b3a208fe35a371dd902758d46c2d08ad589c19bbdbf71730d6f696d8ea08be5f1531f5590237947c5c2604ebf7fc6f78531b88f9aa7e44298803650
SSDEEP 6144:wQ8OyYvc36AVuc7DQd/5zlgBR4JD7yedbSCqrd:wj16Qu15yBRCDGoqrd
TLSH
T1E1648D5AF3A904F9F977923CC8529507E7B2BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4440	apprtbebe.exe
6000	apprtbebe.exe
1620	svcbebe.exe
4108	svcbebe.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppSvcbebe = "C:\\Users\\Admin\\AppData\\Local\\Programs\\bebe\\svcbebe.exe"	apprtbebe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppRtbebe = "C:\\Users\\Admin\\AppData\\Local\\AppRtbebe\\apprtbebe.exe"	c66115510691594dd61319507a41d99b367925515560afa2577093061ca45c9b.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1916	c66115510691594dd61319507a41d99b367925515560afa2577093061ca45c9b.exe
1916	c66115510691594dd61319507a41d99b367925515560afa2577093061ca45c9b.exe
4440	apprtbebe.exe
4440	apprtbebe.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 4440	1916	c66115510691594dd61319507a41d99b367925515560afa2577093061ca45c9b.exe	79
PID 4440 wrote to memory of 1620	4440	apprtbebe.exe	82

C:\Users\Admin\AppData\Local\Temp\c66115510691594dd61319507a41d99b367925515560afa2577093061ca45c9b.exe
"C:\Users\Admin\AppData\Local\Temp\c66115510691594dd61319507a41d99b367925515560afa2577093061ca45c9b.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Users\Admin\AppData\Local\AppRtbebe\apprtbebe.exe
  "C:\Users\Admin\AppData\Local\AppRtbebe\apprtbebe.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Users\Admin\AppData\Local\Programs\bebe\svcbebe.exe
    "C:\Users\Admin\AppData\Local\Programs\bebe\svcbebe.exe"
    3⤵
    - Executes dropped EXE
    PID:1620

C:\Users\Admin\AppData\Local\AppRtbebe\apprtbebe.exe
C:\Users\Admin\AppData\Local\AppRtbebe\apprtbebe.exe
1⤵
- Executes dropped EXE
PID:6000

C:\Users\Admin\AppData\Local\Programs\bebe\svcbebe.exe
C:\Users\Admin\AppData\Local\Programs\bebe\svcbebe.exe
1⤵
- Executes dropped EXE
PID:4108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprtbebe.exe

Path C:\Users\Admin\AppData\Local\AppRtbebe\apprtbebe.exe
Size 317KB
SHA256 0e37facb6df22a1eab9b479af6af67f60ff55b50c52632868ea1d4e1ebc3715e
MD5 b42b40a5efb05958417dba3f30b8b815
SHA1 a8083fb5f8c380f1c7a9a051c522853d380bac53
SHA512 0aac695d2656c959841e219824fe789c135f7efd92687700391f683021d1550a6b7a6b80e4d20b93514b5a829c2932a06e793a8943fa2849939527adc1f3dd0d
SSDEEP 6144:hQ8OyYvc36AVuc7DQd/5zlgBR4JDwye1bSOjrQ:hj16Qu15yBRCDjQjrQ
TLSH
T17C648D5AF3A904F9F977923CC8529507E772BC160760D78F27A0466A3F236A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svcbebe.exe

Path C:\Users\Admin\AppData\Local\Programs\bebe\svcbebe.exe
Size 317KB
SHA256 0a165eb482817f7cd029f8805b33c7943d98d7166ac89bb8d2c66d2e4b9d12c5
MD5 48d5569a9306c6f269475e9cab50dba9
SHA1 af22c69a3d4b357ad19cf18ea877439929a1e44f
SHA512 b48180c058225abc153fa377debf7a1ce342e28f21cf7fa99d7c99c0cc502fb5a4c233e2217a0331899c86337a7fce30ee5cc2986063f93e482450b9089d3689
SSDEEP 6144:qQ8OyYvc36AVuc7DQd/5zlgBR4JD7yeGbSnFrG:qj16Qu15yBRCDGMFrG
TLSH
T1AA648D5AF3A904F9F977923CC8529507E772BC160760D78F27A0466A3F236A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download