48c34722cad350d49ae8f9f865e150b918caaae9b981600ac3150d10f775b74a

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
48c34722cad350d49ae8f9f865e150b918caaae9b981600ac3150d10f775b74a.exe
Size 317KB
Sample260602-e2k83se14j
SHA256 48c34722cad350d49ae8f9f865e150b918caaae9b981600ac3150d10f775b74a
MD5 a5134af0939479a38e4a3f36319a9bc6
SHA1 a115b60a8a8033640a1740b487dd1c3406ddab04
SHA512 adac2c1c53cfaf02b812b52ae6a394e500b188c4547e06980373e644031bfbfb893ebc5cd3bd5fddf7edf15aafc6ea3033d82303f948db847b89ef6aa9025e1f
SSDEEP 6144:qQ8OyYvc36AVuc7DQd/5zlgBR4JD2ye5bSPLr7t:qj16Qu15yBRCDFRLr7t
TLSH
T1D3648D5AF3A804F9F977923CC9529507E772BC160760D78F27A0466A3F236A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
956	apprt75d6.exe
3412	apprt75d6.exe
1192	svc75d6.exe
3868	svc75d6.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppRt75d6 = "C:\\Users\\Admin\\AppData\\Local\\AppRt75d6\\apprt75d6.exe"	48c34722cad350d49ae8f9f865e150b918caaae9b981600ac3150d10f775b74a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppSvc75d6 = "C:\\Users\\Admin\\AppData\\Local\\Programs\\75d6\\svc75d6.exe"	apprt75d6.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4504	48c34722cad350d49ae8f9f865e150b918caaae9b981600ac3150d10f775b74a.exe
4504	48c34722cad350d49ae8f9f865e150b918caaae9b981600ac3150d10f775b74a.exe
956	apprt75d6.exe
956	apprt75d6.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 956	4504	48c34722cad350d49ae8f9f865e150b918caaae9b981600ac3150d10f775b74a.exe	80
PID 956 wrote to memory of 1192	956	apprt75d6.exe	83

C:\Users\Admin\AppData\Local\Temp\48c34722cad350d49ae8f9f865e150b918caaae9b981600ac3150d10f775b74a.exe
"C:\Users\Admin\AppData\Local\Temp\48c34722cad350d49ae8f9f865e150b918caaae9b981600ac3150d10f775b74a.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Users\Admin\AppData\Local\AppRt75d6\apprt75d6.exe
  "C:\Users\Admin\AppData\Local\AppRt75d6\apprt75d6.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Users\Admin\AppData\Local\Programs\75d6\svc75d6.exe
    "C:\Users\Admin\AppData\Local\Programs\75d6\svc75d6.exe"
    3⤵
    - Executes dropped EXE
    PID:1192

C:\Users\Admin\AppData\Local\AppRt75d6\apprt75d6.exe
C:\Users\Admin\AppData\Local\AppRt75d6\apprt75d6.exe
1⤵
- Executes dropped EXE
PID:3412

C:\Users\Admin\AppData\Local\Programs\75d6\svc75d6.exe
C:\Users\Admin\AppData\Local\Programs\75d6\svc75d6.exe
1⤵
- Executes dropped EXE
PID:3868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprt75d6.exe

Path C:\Users\Admin\AppData\Local\AppRt75d6\apprt75d6.exe
Size 317KB
SHA256 a990a8ccdaf58b95ec146cfd79067142f980d97211fe9922c5ded38124da79c0
MD5 51158c4fa6fe1a2ae9a2c22c522ce21c
SHA1 3929b84001b58d308b473ca51eeafb011d27742f
SHA512 2569d8b5d2ded6cdc5a9ea99ba0a596d5b649b6439ffff12ceaaa20969aaeaecf2e0a2195c73fa9df2826a2dd20cce093041309eb0f0fe9ed770fccac2f3b4c3
SSDEEP 6144:EQ8OyYvc36AVuc7DQd/5zlgBR4JDvyeEbSv5rqd:Ej16Qu15yBRCD6+5rqd
TLSH
T153648D5AF3A904F9F977923CC8529507E772BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc75d6.exe

Path C:\Users\Admin\AppData\Local\Programs\75d6\svc75d6.exe
Size 317KB
SHA256 32bb0d65ac8d064dbd769fa220af1b34eb6a2fb7577c735d10e73b3a2cf47d40
MD5 757446535ae5d8d97f446ef398299e5e
SHA1 82f3ea3a07a70444c25ac71b3132dca2524364c2
SHA512 7fac8f7c59bdc5433bb4f18f740790d2db797aeff47ca62d1081536a89817f573a98f7b7521f436bf7d30d6340922159a70890e2856cc59941b9fcc5ebdd62ba
SSDEEP 6144:2Q8OyYvc36AVuc7DQd/5zlgBR4JDsyejbSYVrrO:2j16Qu15yBRCD/UVrrO
TLSH
T1C9648C5AF3A904F9F977923CC8529507E772BC160760D78F27A0466A3F236A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download