811219de8c6575123f9385872376abca7adee7bcec68d8ead1f1f7a6249c9fe8

Analysis

max time kernel
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 00:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ida-pro_91_x64win.exe
Size 470.1MB
Sample260702-baa29ag12j
SHA256 811219de8c6575123f9385872376abca7adee7bcec68d8ead1f1f7a6249c9fe8
MD5 86e2f4e12bba2cbb159da8e320c2f5b6
SHA1 3e39664c2006ca30fe75adb16d4aeae13cd58195
SHA512 31bc2987dac6b1cb20736b374efff85e057090a9d3079dc5c35b3d9323310f508ca7b113d9f1038013274d3120ce4f31af5a44c223240278d252b55620f13efb
SSDEEP 12582912:UU469+S6tGNU1A9xxtCypOOZsZquwbxvPEvqNTzV3LblJ/i:UB69+3tGN+4/ObquGJPp31lJ/
TLSH
T12D393399FF4B90F5EA279436852BE13F4A25AD01C006EE77FF0D3B85F8336666819205
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery trojan

Malware Config

Signatures

Loads dropped DLL 18 IoCs

pid	Process
1108	ida-pro_91_x64win.exe
1108	ida-pro_91_x64win.exe
1108	ida-pro_91_x64win.exe
1108	ida-pro_91_x64win.exe
1108	ida-pro_91_x64win.exe
1108	ida-pro_91_x64win.exe
1108	ida-pro_91_x64win.exe
1108	ida-pro_91_x64win.exe
1108	ida-pro_91_x64win.exe
1108	ida-pro_91_x64win.exe
1108	ida-pro_91_x64win.exe
1108	ida-pro_91_x64win.exe
1108	ida-pro_91_x64win.exe
1108	ida-pro_91_x64win.exe
1108	ida-pro_91_x64win.exe
1108	ida-pro_91_x64win.exe
1108	ida-pro_91_x64win.exe
1108	ida-pro_91_x64win.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ida-pro_91_x64win.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ida-pro_91_x64win.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ida-pro_91_x64win.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	ida-pro_91_x64win.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ida-pro_91_x64win.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1108	ida-pro_91_x64win.exe
1108	ida-pro_91_x64win.exe

C:\Users\Admin\AppData\Local\Temp\ida-pro_91_x64win.exe
"C:\Users\Admin\AppData\Local\Temp\ida-pro_91_x64win.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BRAA9E.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000454\BRAA9E.tmp
Size 43KB
SHA256 09db806002dd23cf97d5b8057a792fc90d11fe5c595f63f92f5c4494b33cbc6f
MD5 99b50db8d177a51b7077084bb75673b5
SHA1 ff68863631241c2159cecdd03f5101e628b25bf7
SHA512 fc5b6d06f95fedfbd929ecb2ed5f86cd0fd797140b54be29b23c8096925c3025504d0613f85ea4c2f0e459b8cd59dba22395c8348801a332d6595bd83d87d4e0
SSDEEP 768:1kyXtmrxg+/7sL3p6ikKz2CsO3GwOiyJRfg/JQefSk2Hf:dXtqs7pWwFsRo/JQefSkGf
TLSH
T1C91351D1BEC61CD6FA51123C919AD32B5A7CF9D4C5035B03D624763ACB23E8238C662E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BRAB0C.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000454\BRAB0C.tmp
Size 288KB
SHA256 f675eba3b22e0a2238ec4961d99de3bacca0ab553ab26eecb49800a12a9371ab
MD5 122a3741699fb5c0950273245c9dea15
SHA1 811f9149e3310a8e6521da156f92f3aaab012145
SHA512 567c480f70fdc78769ae45bf83b6632f7ab380ebeb00689028d39ff03840c8b778149a3fafe1dab2ac77a1fd17a23b09f58774b1c5e791bfd33b99528225eccc
SSDEEP 6144:yfmgpf/EQmPK6Yrzp2FaujGwkvmriOPNyh:af/ENPK/Fq8vJqNyh
TLSH
T1C0545B6339E2C831C69B017125495F13EFF475A02DFFBA83BF95CC5A996A282563070E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BRAB8A.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000454\BRAB8A.tmp
Size 35KB
SHA256 78827e2b1ef0aad4f8b1b42d0964064819aa22bfcd537ebaacb30d817edc06d8
MD5 08ad4cd2a940379f1dcdbdb9884a1375
SHA1 c302b7589ba4f05c6429e7f89ad0cb84dd9dfbac
SHA512 f37bd071994c31b361090a149999e8b2d4a7839f19ea63e1d4563aada1371be37f2bfcc474e24de95ff77ca4124a39580c9f711e2fbe54265713ab76f631835a
SSDEEP 384:i760QouLg/TgeoyZQ82FXRivC4yPTyNeOnEOqjLtKjIUZuVnrufvS0QOwOP2H:pxR1u9CpKVZuFBNOeH
TLSH
T125F2A995EEC26CA7EA1052388596D327173DF9C1CE178F4785243B364F63A8239C672B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BRABBA.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000454\BRABBA.tmp
Size 121KB
SHA256 00ec351fd1e77bcb5bf452b9e8dc5b386c65d74d02815b0adebb70fb57db5416
MD5 2f427b95ab4d18e83f89a001c6b861ad
SHA1 56d10658f71f102961ebc334d277728025d01cdf
SHA512 ebe0b9ca89c2ac2e70d23043b495a21d5c29b5e22ee458641119b7394ac307ae50cc2f636fc409ddbb2039361547106961dabcae0c123055c315f8f900074d97
SSDEEP 1536:DISmH83Fqr7AZOZZjgKb1j2omuU4WnA8MnNh/dPQlN:8Z83Mr7AZOZ19Snmh/GlN
TLSH
T1D1C3D8C8FA67E4F9E9931435859FE2BF1738E5408099FF62FB282716DDB3909214520D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BRABCB.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000454\BRABCB.tmp
Size 532KB
SHA256 5dd27e845af9333ad7b907a37ab3d239b75be6ccc1f51ef4b21e59b037ce778c
MD5 a6f7a08b0676f0564a51b5c47973e635
SHA1 d56f5f9e2580b81717317da6582da9d379426d5b
SHA512 1101813034db327af1c16d069a4dfa91ab97ee8188f9ed1a6da9d25558866e7e9af59102e58127e64441d3e4a768b2ad788fd0e5a16db994a14637bfbade2954
SSDEEP 12288:Qw1Hlm6R2DcKd8wux3cb6PejVKpcPY03bKMhAy:Qwx06AwKd8wux3cb6PejVKpcPYSXh3
TLSH
T12BC43944EA871AF7ED531935555BF33B4E60AA198010EEF2FF0C2A5DEA3B71D100A936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BRAC0A.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000454\BRAC0A.tmp
Size 72KB
SHA256 5ddee4aab3cf33e505f52199d64809125b26de04fb9970ca589cd8619c859d80
MD5 c04970b55bcf614f24ca75b1de641ae2
SHA1 52b182caef513ed1c36f28eb45cedb257fa8ce40
SHA512 a5f2660e336bf74a1936fb2e1c724220d862632907f5fd690b365009ac3e1bf35fa6689071f3da4049e495f340ff83f8438b79079ef1f248b9dcaedbdd5d3e40
SSDEEP 768:bC4uF9R4GHnSiWo3xRFTo5THDMOBPw6s//vABzvBcdWlNK2nPpjCesWjcdgMLsZt:bCHQ5HDMK2ADBcd5esWjcdA1jQ5J
TLSH
T14873290077E1C0B2E4BF0B35687486124ABE7D529AF9DC973FC9164E6DB11D0AA34B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BRAC3A.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000454\BRAC3A.tmp
Size 14KB
SHA256 b017168c69ef40115141813e47122391602e1af28af342c56495b09f1c3c7522
MD5 77fe66d74901495f4b41a5918acd02ff
SHA1 ce5bbd53152cd5b03df8bcc232a1aea36a012764
SHA512 cc6e323d0076577a0a04dbe2c33d90dc616cb5ec3637d3df67cbf169766ca2e6de567fcff4f32938fd6118d98e4796642a3010b7264f0ae247fa8f0fe079bd70
SSDEEP 384:rHvsqY62moTfzR8VPBnOOOOOOOOOOOOrOOkHyMH:z0qzozzSV5nOOOOOOOOOOOOrOOkSK
TLSH
T17862D68ADD0B78F3D64651B206B3EAFA5E3D7E020D55CE35D361D0A8893E0F4B618A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BRACD7.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000454\BRACD7.tmp
Size 14KB
SHA256 f1029f5cca3dabfeffe2c9db6ad84a9ff0f64f5b2fb85cb6ab348740f756e07d
MD5 d74aadd701bfacc474c431acab7b9265
SHA1 8a2b424d1f949430ddc1faddee3e9ccb79c95de2
SHA512 0ef85e311fb4843997fd5f87f0a2eec9715e26eae76bfb7bb701d8c043720aeaf7f4825d25187bf35e0a9f00def15ed071120128805445f1330c07c3e0ea5ced
SSDEEP 192:vLBvanDsGzcSu8M6fB+8yTzSJvwZ6Slp2sWOq9+moFelNtflD9Ndk:DBvCDsGzcSDMc+D6FxWR8wF6NP9k
TLSH
T18D620786BE1758BFD9430A7404D3AFBB49363503443F4972CBA4CCA2D9661E1E52E52E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BRAE20.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000454\BRAE20.tmp
Size 74KB
SHA256 41788435f245133ec5511111e2c5d52f7515e359876180067e0b5ba85c729322
MD5 924b90c3d9e645dfad53f61ea4e91942
SHA1 65d397199ff191e5078095036e49f08376f9ae4e
SHA512 76833708828c8f3fad941abeea158317aff98cf0691b5d5dfa4bca15279cdad1cc23a771258e4de41cf12a58f7033a3ee08b0b5eb834d22be568ea98b183ccd9
SSDEEP 768:f5eCnPrwdD7+HgVqoQKJ03cu9F/HTTuDNV3ILkjVSWTn1ytIddmV1TQW/2Y:f5eCMFqHgV1J03cu99HGRCS1yt73Qk
TLSH
T1C973EAC6FA4718E5DD651A3846CFEF2F1A3CF68480519B22DB0F16299933752384F61E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BRAE31.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000454\BRAE31.tmp
Size 102KB
SHA256 5101c472779b552f3ce044bc2542f726068d914c0d396c8dc1d99ec1aab80767
MD5 78de24eb7826b1338849ff0348a7e82b
SHA1 03080b8f1c9a7a46951d35f8623ed39c4ba4f722
SHA512 f24ec06717cfbe0d2fcc4ce591b6b5161183c8f62a2db0a43512c676fa1345ddab397f7db6f612c4587ab431274d56bba58c71943afbf60276e45d404429ff64
SSDEEP 768:rk2/NvkWxqoSZdelQBWFunEmdvo0p7ikHHDC8G1nMbmhwwRU3WMxdFtySA7JiexP:rvNsVoBtQv/p7LHDC8G1c3ndFtbANiC
TLSH
T138A38448EA47A8E4EE951F35C76FF12B1E2CA5008C13ABFFFE885655D83365B744120A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BRAE71.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000454\BRAE71.tmp
Size 24KB
SHA256 e69a9d06f2c17cc021ebf9b62ca110548facdc147b67dea4846e09865043d2d9
MD5 4cf27e0747e5719a5478aa2624f6b996
SHA1 13df901e34f77e5ea11f36c0afedda7f86a2c003
SHA512 4b0ddcbd7321128f977e1dbbe18cc76c7e489d4ee84b7775989e99778b5a60daa683c6063c5b700794b7f2070ae381fef20b19b3cb35c1babef9be79ff264941
SSDEEP 96:3OeQrkZUMQl0sLw1pljKegUlelUEYP2OaSOdOfDUj5y2RUI32IyyymvNTB:bQAlQl/UzjBPleOE5VoUjVRUKJyo
TLSH
T1C7B2F831CEC184E0D84610B162A41737E97F0A7AA2D6F5D393D5EC3AB677680E62E606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BRAE81.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000454\BRAE81.tmp
Size 24KB
SHA256 27ea1b57a3024aec4a03188e80fdb2aa301fa5179c19be9c8b0dfc2aac73a114
MD5 124e89d0fcc409ede3595a253b788708
SHA1 bc88e037c3edea02dd20aeff10818105be9f4033
SHA512 7cd0ca268a5dbd2aa22dbce1f253a2d067ca30c5195e059c3f431d546a20d1811592f8bd8fe88b6ad9cb5c6fdd6a4666ff451b84a5e790a9d5058865d48790b1
SSDEEP 192:w6Aw4G01nltNu1qqSyjjc1Pcrhve+fAzsI:w6Awe1ltUv3c1AveKAzs
TLSH
T18EB207C3CE4287F1E24C257CA0D63377E9B99FA609D1A13B4D53C93C41F24E0A6E9588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BRAE92.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000454\BRAE92.tmp
Size 100KB
SHA256 c71a16b1056e522cd0365449448116d06f37a3273d77694d170340064511dd25
MD5 606f13d4d580b1f322b3f3d3df423bba
SHA1 02cb375e13b415edc8b5360dffdba531e47827ed
SHA512 867a45dc15e99148f24fc528fbc9255582e5534bb4696700292b70163fddb15f35ddf2acd0536a9cd78b4d8f9d827bf7530d2303bfd7e428f11573b381a0986c
SSDEEP 1536:RgeYsGOAkT1xZXRyrjGA9KOsZDmwd1/MAjVkZJEJ6PZ2:WBVw1xHef9amwDMAjUJ0
TLSH
T1DDA37DC3A082E0F1E6872B396AABE73FDF351787005DEB428740EE616447742F624679
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BRAEA2.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000454\BRAEA2.tmp
Size 56KB
SHA256 59182f092b59a3005ada6b2f2855c7e860e53e8adf6e41cd8cd515578ae7815a
MD5 145d5c49fe34a44662beaffe641d58c7
SHA1 95d5e92523990b614125d66fa3fa395170a73bfe
SHA512 48cb0048f4fcf460e791a5b0beca40dbf2399b70f1784236b6d1f17835201d70dfa64c498814b872f57e527793c58a5959230fe40ddf5ebdcb0b1de57e9c53ef
SSDEEP 384:AfMFAoyIdlBM2y3yKy8i0s7xxgx9lRD4Pich2vzLfp6kVtWVG80TTqV5axSwHAuz:Af7KBM2vcLlRDYncLfp43HTaxOPxP0
TLSH
T119434B45C6C182FEF8B4543A94EB7739DF327646865E8E8BB20DD6652812118F7823CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1108-69-0x00000000013C0000-0x00000000013D9000-memory.dmp

Download

memory/1108-77-0x00000000013A0000-0x00000000013AE000-memory.dmp

Download

memory/1108-83-0x00000000710C0000-0x00000000710DF000-memory.dmp

Download

memory/1108-88-0x0000000067E00000-0x0000000067E1B000-memory.dmp

Download

memory/1108-87-0x0000000066C00000-0x0000000066C14000-memory.dmp

Download

memory/1108-86-0x0000000066C40000-0x0000000066C4B000-memory.dmp

Download

memory/1108-85-0x00000000745A0000-0x00000000745AB000-memory.dmp

Download

memory/1108-84-0x0000000067C80000-0x0000000067D0C000-memory.dmp

Download

memory/1108-80-0x0000000000850000-0x0000000000B23000-memory.dmp

Download

memory/1108-82-0x0000000066680000-0x000000006668E000-memory.dmp

Download

memory/1108-81-0x00000000749B0000-0x00000000749BE000-memory.dmp

Download