Analysis
- max time kernel
148s - max time network
88s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/07/2026, 04:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bc27efb01da7f34c3bfcae1e7db1b4d24a37e8d67c7565d41142696430369ff7.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
bc27efb01da7f34c3bfcae1e7db1b4d24a37e8d67c7565d41142696430369ff7.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target bc27efb01da7f34c3bfcae1e7db1b4d24a37e8d67c7565d41142696430369ff7.exe
- Size 1.3MB
- Sample260712-e5vlxscy8n
- SHA256 bc27efb01da7f34c3bfcae1e7db1b4d24a37e8d67c7565d41142696430369ff7
- MD5 c150b4c8b0020581a242fd1c8e5d6ed1
- SHA1 2e0523a2fb428b013d24d2e99ace638f51c821ce
- SHA512 7a34217edb989c03a71e1ea7889827f466719251216a330146abe1fca1e588b1161bf70923cd92f68658d4fab75546840d4743bddaeb79c8e4388c8604f3111e
- SSDEEP 24576:L2UCkpSEu2tMeTLqX/ZhBE+2ikN9HmdJxEcxePMMhIh:skpfwEqXxM3lN9BHkMhI
- TLSH T13255BF16E2E640E8D876CB788A656722F97178025F34A9DF13D0432A3F73EA05E3DB15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\moe_map\moe_map.log bc27efb01da7f34c3bfcae1e7db1b4d24a37e8d67c7565d41142696430369ff7.exe File opened for modification C:\Windows\moe_map\global.dat bc27efb01da7f34c3bfcae1e7db1b4d24a37e8d67c7565d41142696430369ff7.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2020 bc27efb01da7f34c3bfcae1e7db1b4d24a37e8d67c7565d41142696430369ff7.exe 2020 bc27efb01da7f34c3bfcae1e7db1b4d24a37e8d67c7565d41142696430369ff7.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2020 bc27efb01da7f34c3bfcae1e7db1b4d24a37e8d67c7565d41142696430369ff7.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2020 bc27efb01da7f34c3bfcae1e7db1b4d24a37e8d67c7565d41142696430369ff7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc27efb01da7f34c3bfcae1e7db1b4d24a37e8d67c7565d41142696430369ff7.exe"C:\Users\Admin\AppData\Local\Temp\bc27efb01da7f34c3bfcae1e7db1b4d24a37e8d67c7565d41142696430369ff7.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2020