Overview

overview

8

Static

static

3

ce4a166e87...in.exe

windows10-2004-x64

8

ce4a166e87...in.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/06/2026, 09:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ce4a166e8758540f6622bb9b2e5339bbd2496b15fb2692ac1d3f8bad3673404a.bin.exe
  • Size 192KB
  • Sample260623-lbmsjsbz41
  • SHA256 ce4a166e8758540f6622bb9b2e5339bbd2496b15fb2692ac1d3f8bad3673404a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
persistence

Malware Config

Signatures

  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Executes dropped EXE 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2328
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of WriteProcessMemory
      PID:3472
      • C:\Users\Admin\AppData\Local\Temp\ce4a166e8758540f6622bb9b2e5339bbd2496b15fb2692ac1d3f8bad3673404a.bin.exe
        "C:\Users\Admin\AppData\Local\Temp\ce4a166e8758540f6622bb9b2e5339bbd2496b15fb2692ac1d3f8bad3673404a.bin.exe"
        2⤵
          PID:1832
      • C:\Windows\System32\RuntimeBroker.exe
        C:\Windows\System32\RuntimeBroker.exe -Embedding
        1⤵
          PID:4348
        • C:\Windows\System32\RuntimeBroker.exe
          C:\Windows\System32\RuntimeBroker.exe -Embedding
          1⤵
            PID:4416
          • C:\Windows\system32\ctfmon.exe
            /QuitInfo:0000000000000268;000000000000026C;
            1⤵
              PID:4872
            • C:\Windows\System32\smartscreen.exe
              C:\Windows\System32\smartscreen.exe -Embedding
              1⤵
                PID:5172
              • C:\Users\Admin\AppData\Local\Temp\SvcHostAnalyzer.exe
                "C:\Users\Admin\AppData\Local\Temp\SvcHostAnalyzer.exe"
                1⤵
                • Sets service image path in registry
                • Executes dropped EXE
                • Suspicious behavior: LoadsDriver
                • Suspicious use of AdjustPrivilegeToken
                PID:5424
              • C:\Users\Admin\AppData\Local\Temp\WinUpdateHelper.exe
                "C:\Users\Admin\AppData\Local\Temp\WinUpdateHelper.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:4652
              • C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
                C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
                1⤵
                • Executes dropped EXE
                PID:5584
              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
                C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
                1⤵
                • Executes dropped EXE
                PID:5916

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    EmbeddedDriverService.sys
                    • Path C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
                    • Size 34KB
                    • SHA256 70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SvcHostAnalyzer.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\SvcHostAnalyzer.exe
                    • Size 147KB
                    • SHA256 5847e5335818953dfb13c349a7f1b530c5a75a0ff671b471b5e6d8f9b55b23e8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    WinUpdateHelper.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\WinUpdateHelper.exe
                    • Size 38KB
                    • SHA256 88e6f97f29fde06637996fdf76f19bb9f71112a1c01738f1cde11794444976b7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    memory/2328-10-0x0000023726D80000-0x0000023726D83000-memory.dmp
                    Download

                    memory/3472-22-0x0000000003C10000-0x0000000003C17000-memory.dmp
                    Download

                    memory/3472-31-0x0000000003C30000-0x0000000003C31000-memory.dmp
                    Download

                    memory/3472-32-0x0000000003C40000-0x0000000003C41000-memory.dmp
                    Download

                    memory/4652-9-0x00007FFF3C500000-0x00007FFF3C763000-memory.dmp
                    Download

                    memory/4652-38-0x000001D822260000-0x000001D8224C3000-memory.dmp
                    Download

                    memory/5916-36-0x00007FFF3C500000-0x00007FFF3C763000-memory.dmp
                    Download