04f78726f4b3dcf57492391515a4c609b71578b0f5b40d445df022440e48308a

Analysis

user interaction
yes
max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/06/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Toolsrepair.exe
Size 526KB
Sample260624-tr4d8sdv31
SHA256 04f78726f4b3dcf57492391515a4c609b71578b0f5b40d445df022440e48308a
MD5 23d7d2472a1bb49316c5f40d391a330b
SHA1 8febdbc3ee0f431d855cf8861a49bb3e2e30b019
SHA512 f2364a66a85b7ea9cc909a2c334ffb11739b7eda19f2e9329d05bd624e720dbc8b76358ee88df0ae441f5be87e098e7679d1f0a96be557b83e347828c30d6a96
SSDEEP 12288:vZ2tQpzUwHAk06tSorkh8N2pVfNI241QjOuHakdYj:gupzUwHAk06tSmkhtpdy1clHamYj
TLSH
T144B41256AB88008CD5AA9B3094E4DA67C772BC552479C08F57C0FF8F2F36351AD1A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
5392	Toolsrepair.exe
5392	Toolsrepair.exe
5392	Toolsrepair.exe
5392	Toolsrepair.exe
5392	Toolsrepair.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
4748	taskkill.exe
924	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4748	taskkill.exe
Token: SeDebugPrivilege	924	taskkill.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5392 wrote to memory of 4748	5392	Toolsrepair.exe	88
PID 5392 wrote to memory of 924	5392	Toolsrepair.exe	91

C:\Users\Admin\AppData\Local\Temp\Toolsrepair.exe
"C:\Users\Admin\AppData\Local\Temp\Toolsrepair.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5392
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /T /IM steam.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4748
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /T /IM steamwebhelper.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsaDEC3.tmp\System.dll
Size 12KB
SHA256 9d81c2e901e59350e33f0c33f44e033e727a4d962e245ecb23561da8feccdfad
MD5 67fc1324e53b1f3854557f23b0c22654
SHA1 d36528a0468951a90a67a8e71881eee655d65c7c
SHA512 0fe91fd5e2267c3f21712f0a921539a13868e57e0f5444d86704a3e3ca15e383130ece5433ff9948e8772c777c401270ccfa99eab65527039333946ff662f4e4
SSDEEP 192:K5zfH361apH705aW7DSGb6KVFEc+Js68XDEKjbR493oJZnxxYCBm9:K5zfX61apHg5a+SIJFESACGISCm9
TLSH
T1D4424B5AEB72207BD01385BD9795E107D335B8DA79E0974F0AE8AA3A2F137902C5434E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsaDEC3.tmp\modern-wizard.bmp
Size 150KB
SHA256 16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b
MD5 3614a4be6b610f1daf6c801574f161fe
SHA1 6edee98c0084a94caa1fe0124b4c19f42b4e7de6
SHA512 06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281
SSDEEP 48:ZQEM+jeAwtwVUoYxq+HQiNE/7o+f3cbqBtpozK8lHl/GGKOFHNPf33zFYsvwL:ZkWeftwV1enu/7ozCeu8RGGvP/jFYsv
TLSH
T1F8E3E9AEB933693ECD9911B41164A7FD8B306C5C7A40666E411FF8DC0FF31CA3569852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsaDEC3.tmp\nsDialogs.dll
Size 10KB
SHA256 abd16682aa1531229e5aa727dda379050f66bd788c12fe61a38551f96dfcacb5
MD5 b9cf10930a5144fdda9479613ee3c84b
SHA1 5110556ff6ed1559c73cdd444f6e2408db570653
SHA512 bb9947763fea6915e90e662438d1247678576ff944f9918dcbb0c93d669f8a0dd7dd60db95f53e52faf1e0d3d627789cbcd6196441113556acaa6711b6b6f350
SSDEEP 192:VvvwccHJBa8oStSigfl6dblJDBUorNuCjLUoaTOt37Eezqm:VvvwVPa8oStSTUDiorNRjwoT7EeWm
TLSH
T15C22E85BFAA4D2EEC4974136D5BB5B06CBB170125692DA4E0B3096897F233433A2D74C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsaDEC3.tmp\nsExec.dll
Size 6KB
SHA256 a22e9b6a0d511872cd572fe5758026a26e90ee3f19fa992a02abe4f6d34f5535
MD5 cf0cac49c427a501d7806033941a6da1
SHA1 92acf906cc962b7e4c4138aac8ecec67c9629b4a
SHA512 7ad31611d7c0657d70318c16c781b7da793c8a19e4dfafcc90abcd4c8eb0dbad3aacf643b558b573502e50f504bb9f384b4df95f0db840e68763f03a7d8e85d6
SSDEEP 96:wC66T7ItPQcwPbfTA3Ck3lKYHxFYSdt4RTUR+4nz:dT7+EEjje4
TLSH
T15CD1CA2AA7C102A8C82F51F0A93F4A07EBA5308125785A3F2A688C0E4F53AF1737C745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5392-18-0x00007FFA88BD0000-0x00007FFA88BD7000-memory.dmp

Download

memory/5392-17-0x00007FFA88BD5000-0x00007FFA88BD6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads