Analysis
- max time kernel
900s - max time network
901s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 11:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Sheldon.exe
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral2
Sample
Sheldon.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
General
- Target Sheldon.exe
- Size 11.5MB
- Sample260710-nfkvvsbs8x
- SHA256 6ed60f576153130468820909518d4dbb61d2f008b2a8540746efce6b601a6358
- MD5 5782d2dce1da8210b643fd950a605a2c
- SHA1 ab7143f442e0958936f6fa52c8d34c403265f34e
- SHA512 e44f02571bdff0e9760f55c598d5089fafd8ba64376ede84617357fc0b8d00d9c3d91d65d63174ac0705610b16620aacecb7e0ac60bf970130e20e3a57d1be31
- SSDEEP 196608:cD6eqLlHPcj6eMJL0T7pXNS0OIo7thwuTWUQ/hQL9x1IQzTIJk6zWebt1+zyY:tBPBLQNXodn7th4/W5xIJiebyt
- TLSH T17EC623D795DD76B9D0412A728583538787C0A0B6CDA656C833FC1C0DEEA7D8142CABBE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 4780 Sheldon.exe 4780 Sheldon.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe 4780 Sheldon.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4780 wrote to memory of 2644 4780 Sheldon.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sheldon.exe"C:\Users\Admin\AppData\Local\Temp\Sheldon.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c pause2⤵PID:2644
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4156
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:3436