Analysis
- max time kernel
900s - max time network
503s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
21/06/2026, 12:13
General
- Target Drift.exe
- Size 22.5MB
- Sample260621-pdvgysc19l
- SHA256 2c5f12a86d163f742c0c4a3e6f724365ae2b1f424cdbc7e5ab076cb46136ff92
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Drift.exe"C:\Users\Admin\AppData\Local\Temp\Drift.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4836-0-0x00007FF7E439A000-0x00007FF7E50E5000-memory.dmp
memory/4836-2-0x00007FFDBCEA0000-0x00007FFDBCEA2000-memory.dmp
memory/4836-1-0x00007FFDBCE90000-0x00007FFDBCE92000-memory.dmp
memory/4836-3-0x00007FF7E41E0000-0x00007FF7E675C000-memory.dmp
memory/4836-7-0x00007FF7E439A000-0x00007FF7E50E5000-memory.dmp
memory/4836-8-0x00007FF7E41E0000-0x00007FF7E675C000-memory.dmp