6f171c152fcac1e735252559fb9b90e8aaa564f78d32e0a1cb4b0b39bc318bc1

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
stager.exe
Size 140KB
Sample260628-trpabaat9n
SHA256 6f171c152fcac1e735252559fb9b90e8aaa564f78d32e0a1cb4b0b39bc318bc1
MD5 c771cd63bcf026d3b14a215c7bf6bb29
SHA1 b824100eae2f86807c173fad52ea1a42cbeb8db5
SHA512 a70f82bfbc69c5ee7a9d41bc286f1f59851d00a3ddeac4cba88164c67e034c7aeae7789b1d3b5a870f606846968a7d715fce6a23151042365dc9a641ea421be7
SSDEEP 1536:iYAXd8Rb1WfnakaqrDzVa48gMuYHo6voYVmisqX7ZjjnqjsKP0HLIOEj4VU2kv84:iYAXaRklaqrX4NO6kIHLIOEj4Fq
TLSH
T12EE32AC6BBC69CEBDA16123889AA8339133CFBC51BC65703083972351E53AD1ADD7647
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1536	svchost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5280 wrote to memory of 1536	5280	stager.exe	89

C:\Users\Admin\AppData\Local\Temp\stager.exe
"C:\Users\Admin\AppData\Local\Temp\stager.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5280
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\svchost.exe
  2⤵
  - Executes dropped EXE
  PID:1536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 1.3MB
SHA256 05b72f18a8856faa15dd03fcb2e0300dc4016c26aa4c1c026a615f1b64c97173
MD5 24adcf5a78baf945317708ffa3a5504e
SHA1 298765ddd44175bea54265ed926e6563645b3cb5
SHA512 1cdcae6194f586ccb1b63726eb13efb22c804a2435412136307ef6f6ce9d220e8a9de98381220eff2c01e5f4842eeae46c347c6323b76cbeb8b73b9853cfdf89
SSDEEP 24576:2p76RtT/Sn6/KlHNkB+jhpzwawcvLalH7Yh180tl56Z9kA5zb7FMDyPETGc1tDeq:2iKntlmB+fwP48H7Yh180tl58ka2pDeq
TLSH
T11855BF01B075ACEBC147B1B80647CA76363EE59CD6B36B028CB47A25452ACB3BB4D54F
MD5 SHA1 SHA512 SSDEEP TLSH