5034527200e190e8320b78313067e839d3a47fc3c243013a2c1706448cdac846

Analysis

max time kernel
54s
max time network
54s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 10:04

Target
katclient.exe
Size 2.5MB
Sample260701-l37l2adv7x
SHA256 5034527200e190e8320b78313067e839d3a47fc3c243013a2c1706448cdac846
MD5 f5b0f82e35a29dfa52efe8b7a6e7b421
SHA1 efdb191f11eaa5a34d39e5754a5f91e4ad5e8ec2
SHA512 84abb0c6e0b3c4e15535404297565995e5f7b964ccf892dad43aef4f47e20fa3133ffb69728542771609599d4f0c538bdfe6baf939fcf56ff3456d9d798a09ff
SSDEEP 49152:I2Hap4cHyKJKgl7s0A+rPdnjz3gjxlnPDh/IU6iJaDu:I26OF6dPgnPC+cD
TLSH
T120C57D13E2A680F9C06BC175C3969733FA31B88946347B6B1BE4CB212E69F605F5D718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\webhelper.lnk	katclient.exe

Executes dropped EXE 2 IoCs

pid	Process
5720	webhelper.exe
4196	webhelper.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6076 wrote to memory of 5720	6076	katclient.exe	88

C:\Users\Admin\AppData\Local\Temp\katclient.exe
"C:\Users\Admin\AppData\Local\Temp\katclient.exe"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:6076
- C:\Users\Admin\AppData\Roaming\webhelper.exe
  "C:\Users\Admin\AppData\Roaming\webhelper.exe"
  2⤵
  - Executes dropped EXE
  PID:5720

C:\Users\Admin\AppData\Roaming\webhelper.exe
C:\Users\Admin\AppData\Roaming\webhelper.exe
1⤵
- Executes dropped EXE
PID:4196

webhelper.exe

Path C:\Users\Admin\AppData\Roaming\webhelper.exe
Size 2.5MB
SHA256 5034527200e190e8320b78313067e839d3a47fc3c243013a2c1706448cdac846
MD5 f5b0f82e35a29dfa52efe8b7a6e7b421
SHA1 efdb191f11eaa5a34d39e5754a5f91e4ad5e8ec2
SHA512 84abb0c6e0b3c4e15535404297565995e5f7b964ccf892dad43aef4f47e20fa3133ffb69728542771609599d4f0c538bdfe6baf939fcf56ff3456d9d798a09ff
SSDEEP 49152:I2Hap4cHyKJKgl7s0A+rPdnjz3gjxlnPDh/IU6iJaDu:I26OF6dPgnPC+cD
TLSH
T120C57D13E2A680F9C06BC175C3969733FA31B88946347B6B1BE4CB212E69F605F5D718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4196-5-0x00007FF6F0AC0000-0x00007FF6F0D3A000-memory.dmp

Download

memory/4196-11-0x00007FF6F0AC0000-0x00007FF6F0D3A000-memory.dmp

Download

memory/5720-4-0x00007FF6F0AC0000-0x00007FF6F0D3A000-memory.dmp

Download

memory/6076-2-0x00007FF7C6960000-0x00007FF7C6BDA000-memory.dmp

Download