c21d46b067cb5f86af94d6cee1e0754fa9f15eb73c041a3ae35b4364eb0921b7

Analysis

user interaction
yes
max time kernel
58s
max time network
32s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 15:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DriftBootstrapper.exe
Size 322KB
Sample260709-smgt1adw21
SHA256 c21d46b067cb5f86af94d6cee1e0754fa9f15eb73c041a3ae35b4364eb0921b7
MD5 33a87409c02b784366bf978f5bb3de7f
SHA1 93286cbd9c129b1fc42f1beb8380721c7602f23c
SHA512 dea1493a1d06f9be4be0b5de8404bc3a719a50970e50717c97fa567251c5f70db49b07f345de58ea35d1bfa66297c0f7f0f873cbaa61d41c130b1d62f6fe4db4
SSDEEP 6144:UvgvkNFNaxmNEJJ20n3Mbii8JmferrBYHn:UvggNaxmB0n35irn
TLSH
T14E647D12A3A8417AD2BB4778C8610941EB73781B5BA1E7CF03951CBD5EA37829F35723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4816	Drift.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4816	Drift.exe
4816	Drift.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4816	Drift.exe
4816	Drift.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4524	DriftBootstrapper.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 4816	4524	DriftBootstrapper.exe	89

C:\Users\Admin\AppData\Local\Temp\DriftBootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\DriftBootstrapper.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Users\Admin\AppData\Local\Drift\Drift.exe
  "C:\Users\Admin\AppData\Local\Drift\Drift.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:4816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Drift.exe

Path C:\Users\Admin\AppData\Local\Drift\Drift.exe
Size 22.2MB
SHA256 aea40c1a3ee8b68b55a5576c8588ecc3e99795048695f3685cd7cac27a772bad
MD5 942659b923896ec335303e576c98ea58
SHA1 f0c41c1ce8d94507fa75fcffbd2e7cc793ff65d0
SHA512 152fd2c5a20e31e1bc477152a425c32b06623cae24a665949c3095c9cd18097000a6776eb03ca8bcdb8ee4c6be4ee2866ced8adb2ed05accd77f480e0f580ade
SSDEEP 393216:3kN7P/nxeIi0nK0DZ5Canesly0AgZxN2qtGi8bVySza/TYF6ThssO3lt:S7Pu0KG5teslDAG2qtDAlzkYF6lsPv
TLSH
T1813723C689D853F8C7938635929713CBA3C120ABDEAB4D1D36CB6C023522C575787E7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4816-42-0x00007FFAA7830000-0x00007FFAA7832000-memory.dmp

Download

memory/4816-43-0x00007FFAA7840000-0x00007FFAA7842000-memory.dmp

Download

memory/4816-44-0x00007FF6C70D0000-0x00007FF6C9609000-memory.dmp

Download