531472edf392aaecf9cb3216f9da57a1b1014aed275e5bf7683915f69c34afd9

Analysis

max time kernel
150s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 08:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
531472edf392aaecf9cb3216f9da57a1b1014aed275e5bf7683915f69c34afd9.exe
Size 9.2MB
Sample260706-j2cn6aby91
SHA256 531472edf392aaecf9cb3216f9da57a1b1014aed275e5bf7683915f69c34afd9
MD5 14ce7c8943f4e123261c8e63e8e70039
SHA1 b959bc038d59239f000c668667b61af501ca50e9
SHA512 560689c2c314c22e47888e7a08b7fb6f699823de2327a2229e0a27ea0cf9ba1077dce7ddf82597ffc08a7b9c874f79dbca96544f79c5bce89b07fa76f7ee2065
SSDEEP 98304:3jDHCo4Kc341ghmulKqo08vgthSoDU56MEY:3jTXc341ghZlKG8Ghvd
TLSH
T1F6A63947ECB106E5D0A99135CA329257BEB17C885B3163D32B50F7682F77BD0AAB9700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

defense_evasion

Malware Config

Signatures

Kills process with taskkill 15 IoCs

defense_evasion

pid	Process
5356	taskkill.exe
6908	taskkill.exe
5392	taskkill.exe
2520	taskkill.exe
1156	taskkill.exe
5372	taskkill.exe
4844	taskkill.exe
5224	taskkill.exe
1352	taskkill.exe
5132	taskkill.exe
4952	taskkill.exe
4296	taskkill.exe
1744	taskkill.exe
7156	taskkill.exe
3688	taskkill.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	5224	taskkill.exe
Token: SeDebugPrivilege	7156	taskkill.exe
Token: SeDebugPrivilege	5392	taskkill.exe
Token: SeDebugPrivilege	3688	taskkill.exe
Token: SeDebugPrivilege	1352	taskkill.exe
Token: SeDebugPrivilege	5356	taskkill.exe
Token: SeDebugPrivilege	2520	taskkill.exe
Token: SeDebugPrivilege	1156	taskkill.exe
Token: SeDebugPrivilege	5372	taskkill.exe
Token: SeDebugPrivilege	4844	taskkill.exe
Token: SeDebugPrivilege	6908	taskkill.exe
Token: SeDebugPrivilege	5132	taskkill.exe
Token: SeDebugPrivilege	4952	taskkill.exe
Token: SeDebugPrivilege	4296	taskkill.exe
Token: SeDebugPrivilege	1744	taskkill.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 6056 wrote to memory of 5224	6056	531472edf392aaecf9cb3216f9da57a1b1014aed275e5bf7683915f69c34afd9.exe	89
PID 6056 wrote to memory of 7156	6056	531472edf392aaecf9cb3216f9da57a1b1014aed275e5bf7683915f69c34afd9.exe	92
PID 6056 wrote to memory of 5392	6056	531472edf392aaecf9cb3216f9da57a1b1014aed275e5bf7683915f69c34afd9.exe	94
PID 6056 wrote to memory of 3688	6056	531472edf392aaecf9cb3216f9da57a1b1014aed275e5bf7683915f69c34afd9.exe	96
PID 6056 wrote to memory of 1352	6056	531472edf392aaecf9cb3216f9da57a1b1014aed275e5bf7683915f69c34afd9.exe	98
PID 6056 wrote to memory of 5356	6056	531472edf392aaecf9cb3216f9da57a1b1014aed275e5bf7683915f69c34afd9.exe	100
PID 6056 wrote to memory of 2520	6056	531472edf392aaecf9cb3216f9da57a1b1014aed275e5bf7683915f69c34afd9.exe	102
PID 6056 wrote to memory of 1156	6056	531472edf392aaecf9cb3216f9da57a1b1014aed275e5bf7683915f69c34afd9.exe	104
PID 6056 wrote to memory of 5372	6056	531472edf392aaecf9cb3216f9da57a1b1014aed275e5bf7683915f69c34afd9.exe	106
PID 6056 wrote to memory of 4844	6056	531472edf392aaecf9cb3216f9da57a1b1014aed275e5bf7683915f69c34afd9.exe	108
PID 6056 wrote to memory of 6908	6056	531472edf392aaecf9cb3216f9da57a1b1014aed275e5bf7683915f69c34afd9.exe	110
PID 6056 wrote to memory of 5132	6056	531472edf392aaecf9cb3216f9da57a1b1014aed275e5bf7683915f69c34afd9.exe	112
PID 6056 wrote to memory of 4952	6056	531472edf392aaecf9cb3216f9da57a1b1014aed275e5bf7683915f69c34afd9.exe	114
PID 6056 wrote to memory of 4296	6056	531472edf392aaecf9cb3216f9da57a1b1014aed275e5bf7683915f69c34afd9.exe	116
PID 6056 wrote to memory of 1744	6056	531472edf392aaecf9cb3216f9da57a1b1014aed275e5bf7683915f69c34afd9.exe	118

C:\Users\Admin\AppData\Local\Temp\531472edf392aaecf9cb3216f9da57a1b1014aed275e5bf7683915f69c34afd9.exe
"C:\Users\Admin\AppData\Local\Temp\531472edf392aaecf9cb3216f9da57a1b1014aed275e5bf7683915f69c34afd9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6056
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5224
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:7156
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM brave.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5392
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM opera.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3688
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM kometa.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1352
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM orbitum.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5356
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM centbrowser.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2520
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM 7star.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1156
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM sputnik.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5372
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM vivaldi.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4844
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM epicprivacybrowser.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6908
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM msedge.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5132
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM uran.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4952
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM yandex.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4296
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM iridium.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1744

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads