99bda4887c96cedec4140e766e98d167dad52fdd85135a97b32cd68aae64c6a3

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
99bda4887c96cedec4140e766e98d167dad52fdd85135a97b32cd68aae64c6a3.exe
Size 343KB
Sample260709-phfvcsbt4s
SHA256 99bda4887c96cedec4140e766e98d167dad52fdd85135a97b32cd68aae64c6a3
MD5 c4b9e5af6c6ed818c230cdf4afc1ab67
SHA1 40ca76ffcbe247c0f18b3c7f0dbe74af4e2c135a
SHA512 a798ec0b06bc1de0f19114a78223fa25e3dbb88dd70aecbfa9fd4231ce5307ef2a0fbb20d93c1830060190125577dcaf5080d480c43bb9dd24a6a84d8918f6d4
SSDEEP 6144:vhjzHCLKVI3xdIJql3ProSEE2eS0JE2akcuuRVPZ1K49K/llvFbO5:vhiGexfXEES0J4kwRRfK44/lBF
TLSH
T1EE74BE2766E032E2E77F25318347DE8EA7337E304244DB9B46D25F940E326915DA9E23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion persistence trojan

Malware Config

Signatures

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Executes dropped EXE 2 IoCs

pid	Process
6096	active_desktop_launcher_x64.exe
4724	active_desktop_launcher_x64.exe

Loads dropped DLL 2 IoCs

pid	Process
6096	active_desktop_launcher_x64.exe
4724	active_desktop_launcher_x64.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mSFHZQIUBqS = "C:\\Users\\Public\\lazau8nr1q\\active_desktop_launcher_x64.exe"	active_desktop_launcher_x64.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	active_desktop_launcher_x64.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
6096	active_desktop_launcher_x64.exe
6096	active_desktop_launcher_x64.exe
6096	active_desktop_launcher_x64.exe
6096	active_desktop_launcher_x64.exe
4724	active_desktop_launcher_x64.exe
4724	active_desktop_launcher_x64.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6096	active_desktop_launcher_x64.exe
4724	active_desktop_launcher_x64.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 6096	4316	99bda4887c96cedec4140e766e98d167dad52fdd85135a97b32cd68aae64c6a3.exe	86

C:\Users\Admin\AppData\Local\Temp\99bda4887c96cedec4140e766e98d167dad52fdd85135a97b32cd68aae64c6a3.exe
"C:\Users\Admin\AppData\Local\Temp\99bda4887c96cedec4140e766e98d167dad52fdd85135a97b32cd68aae64c6a3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Users\Public\lazau8nr1q\active_desktop_launcher_x64.exe
  "C:\Users\Public\lazau8nr1q\active_desktop_launcher_x64.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:6096

C:\Users\Public\lazau8nr1q\active_desktop_launcher_x64.exe
C:\Users\Public\lazau8nr1q\active_desktop_launcher_x64.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\ProgramData\D1AC873300005FC2\1
Size 330KB
SHA256 2854b55e6c3b4fb642007b0230137c4f374fdd28f44647ddf48d339e7813a1e2
MD5 39a9dfa7fef3e7e524bdcbabe709d938
SHA1 357fb2eb725feb1dbfc0564376048b12198cdf35
SHA512 0f37dc73afe58a9ae3241e5fd3273c8c3fcf7f5930d36f4e9ed8f7553eddc8dcc37ab693da4eccd940e6ff027072a0ed2060dc44bf12b9af6c81f12169cb8704
SSDEEP 6144:fuihvvPOOvZMs7WYE8c2OzNXD+xmfiILkAuoft6poEJhFQTleWtbxgyggbg:fdhvOOGT/DXamfieooV6pBBAlewlgnn
TLSH
T12B742365E734ABC55C98B100D13B22BAE45157886ED02BDD3078A62A9043F3F7EE53E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GROUP

Path C:\ProgramData\D1AC873300005FC2\GROUP
Size 4B
SHA256 b1441fb610c44a4cf71233b0f3f75fb1f47193005b3ea33f6b6259b1448c918b
MD5 4ff1b6ba4f7de9f91a343f4f164320ae
SHA1 f8eb88c0d17aea11f5c077a063825ed07458c74a
SHA512 7c41f2c232fdc553c01cc2fc16bc3607826635ae63cd9fe60b4e7b6c826aeff0177b8f38dabe36e0e6a1fd9db49737baef866e01eb608e4b718847a6427938d8
MD5 SHA1 SHA512

Submit Download

INSTALL_TIME

Path C:\ProgramData\D1AC873300005FC2\INSTALL_TIME
Size 38B
SHA256 cf5ff5012dc22e91c6ef86e9c8ac45646e0c39fa994b56fcdeb12b6cd64bbcf1
MD5 71f113ce2cbdb3a192bfb4b2d26dba2c
SHA1 c1b1a7b11b5edc80415c87377a35b91b47d2991c
SHA512 f87514c8f8e1c6fc2643a27ad2be9e58240c2057b07780275c934790c3b27cec4dddd77ea9a2f7df14b47a17453abc81a42d0ac2f62f3560aaf17dc07e6d7b08
MD5 SHA1 SHA512

Submit Download

index.dat

Path C:\ProgramData\D1AC873300005FC2\Modules\x64\index.dat
Size 20B
SHA256 d52ddc15326ddea423887f8b43f547d96427030c56cb9f779c22afb766450373
MD5 bf07b31e9ec33822af85beabee363434
SHA1 bc9536d8697bae502f4d3238d862f4a305721d33
SHA512 647983f21eb8b82e9d8e8e29ba3710dc13b6070f12a8071f10d722d6c53a50a487daaa30bcff4ea2a08c6c736c51f221e3dc2f793fb60bf5699b4b80b4aa834e
MD5 SHA1 SHA512

Submit Download

index.dat

Path C:\ProgramData\D1AC873300005FC2\Modules\x64\index.dat
Size 20B
SHA256 bb9b4b016cc9ef965d537f895bdeba13fb255ae6691cca5fd8f759b5ba005c3c
MD5 0392658db986c0fb049a6bd6170f3bc7
SHA1 d226575acc1a5ca80e955fdb393af30e4deee6f4
SHA512 24b461415e6862375f0d198ffec5fc85c26ba17a49b9a7ea067f9cac2358a565e7579001d90495a07019457820aeed0e6303253171cfcfcd64ede1bd7fd0940e
MD5 SHA1 SHA512

Submit Download

REMARK

Path C:\ProgramData\D1AC873300005FC2\REMARK
Size 6B
SHA256 f3fb9e94f813be2cc4fb1d38777634a8dc079600027b5d19cd373ed21e327347
MD5 88997787da31308fb88f4f723e2ba2c8
SHA1 b5e93ca4eb0d335223ac9c6c6754fea00d49299f
SHA512 ea8f9a1c20e31addb4678c605fd2eb18f21773a2412fea0f0d405434992098f80e7bbba53c6788872d95282563ed1395a835e5a8a1c033013271161a7325da39
MD5 SHA1 SHA512

Submit Download

active_desktop_launcher_x64.exe

Path C:\Users\Public\lazau8nr1q\active_desktop_launcher_x64.exe
Size 100KB
SHA256 f712c2a8b4abf2e299a2b480020333deb0f43364e9686cda78b1243c62e4830d
MD5 1ea7d59053d8bd45bea95355b3d8d499
SHA1 de0c8fba8d7ac8f547c88b6e5f7f5cd422ec2903
SHA512 6e978f16c2f7a8d5918f4ebc8f71fc4b796487aa1e3dbc02faeac35a2d4ec0cb0d35408297778fbbe0d77a4247b9f4e9a7733252fef4f575d17b33374c07bc40
SSDEEP 1536:9LT11uyRFNsa9N/urOKwjAEHxPNgE71x48suYjsW4dTRR6f7HxE7Qxa:xTzuyRFNN9N/wwjtHxvWuYsTRUf+5
TLSH
T1B5A37C9767E078F9E8638B34ACE14915E736F96706B0CB8E1394415A4F233C19E78B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

active_desktop_render_x64.dll

Path C:\Users\Public\lazau8nr1q\active_desktop_render_x64.dll
Size 107KB
SHA256 f47153edb7b286dc1181d69e70d3ae297a089a8dfa161ca18c5a7f0a013f6049
MD5 d42082669334bd626d18af58b4effb2f
SHA1 18d0e2db8413197a27894a7e6b70818b3b597c0b
SHA512 0f849c02cda36034f27883c2358fbaaea74dcb8a82ccb4dcb09cb3920d323cbac3626ab4365b8d4fcff48dd8621069b27ab1209ff872fa04856dd07ed8fab056
SSDEEP 1536:Un3LHQpyeQaHWuENnePBu5MF2TH+S5A/KDodMmoW2dwRdsWCd/9dl/j0sFvWnL:UbwYcmGaMFueqA/KzmoW4UI/h0s
TLSH
T110B35B5763A504BBE57786B8C4630A46E3B2B81507609FFF07A0865A1F237D18D3EFA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hzgnf.log

Path C:\Users\Public\lazau8nr1q\hzgnf.log
Size 17KB
SHA256 a9ca8923ed784676182cad30c3fbb69b6d750f88f6fb12b2b9b8856433196b91
MD5 232fbf6964143fe0bac6308ca8889742
SHA1 2288ab2500996fce6ac4d91f7d3ca54e64dc592a
SHA512 0f9b26ee1f8e9781c28aa06c700f0a8e002b137588f4825be230453f5778f1430fd1ddcfdf4624d36343067347f2a4a14f9a608190896fffde364ab4429bc784
SSDEEP 384:KM90yO9HOAkVuSpSJFjdNAztZF9kfXM/thE+0+UWgwPPrQr32OeYk/KB:KMgxF6SrJWZZFafOtX0/w3rQr32OeYMK
TLSH
T1B982D1C4F7E12EC1737134D81BEADC9868E644971220FE55B24243E1A303B765EE147A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4724-36-0x0000020136ED0000-0x0000020136F8A000-memory.dmp

Download

memory/4724-48-0x0000020136ED0000-0x0000020136F8A000-memory.dmp

Download

memory/6096-45-0x000001E2D59A0000-0x000001E2D5A5A000-memory.dmp

Download

memory/6096-17-0x000001E2D59A0000-0x000001E2D5A5A000-memory.dmp

Download

memory/6096-9-0x000001E2D5970000-0x000001E2D5975000-memory.dmp

Download

memory/6096-26-0x000001E2D59A0000-0x000001E2D5A5A000-memory.dmp

Download

memory/6096-10-0x000001E2D5970000-0x000001E2D5975000-memory.dmp

Download

memory/6096-32-0x000001E2D59A0000-0x000001E2D5A5A000-memory.dmp

Download

memory/6096-46-0x000001E2D59A0000-0x000001E2D5A5A000-memory.dmp

Download

memory/6096-47-0x000001E2D59A0000-0x000001E2D5A5A000-memory.dmp

Download