e8bc3ab1e100428680277a29302a32bf576b14fffa40658e75b6243ef2c51651

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e8bc3ab1e100428680277a29302a32bf576b14fffa40658e75b6243ef2c51651.exe
Size 1.9MB
Sample260712-vbellsfw2w
SHA256 e8bc3ab1e100428680277a29302a32bf576b14fffa40658e75b6243ef2c51651
MD5 702deedf1c16270c147a3a7b22576b81
SHA1 45eb9ca3b63602bb32116bfd6eb82ad13fff36d7
SHA512 254a81470b5ac8bea12f9a0474ed62f159a0242823a389296ac7158ae4933c171bcf9e048e1d5c01a5333d3a12a66d2083604719db6dad221bbfc54d8b665643
SSDEEP 49152:acen4whfXITNzLthLV8VT0alS4o/+Cmd/0cX:aTzfcNzLtWlN1d0cX
TLSH
T1409533525776083CF12AB9BDD906BC60B20CFD2C6CC7219724AFFC9A78722217B55993
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\jUjoaYDhOTWf.sys	e8bc3ab1e100428680277a29302a32bf576b14fffa40658e75b6243ef2c51651.exe
File created	C:\Windows\System32\drivers\h69u68BkG.sys	e8bc3ab1e100428680277a29302a32bf576b14fffa40658e75b6243ef2c51651.exe

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\jUjoaYDhOTWf\ImagePath = "system32\\DRIVERS\\jUjoaYDhOTWf.sys"	e8bc3ab1e100428680277a29302a32bf576b14fffa40658e75b6243ef2c51651.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\h69u68BkG\ImagePath = "system32\\DRIVERS\\h69u68BkG.sys"	e8bc3ab1e100428680277a29302a32bf576b14fffa40658e75b6243ef2c51651.exe

Executes dropped EXE 2 IoCs

pid	Process
4960	4A5D.tmp
3256	4B87.tmp

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4296-0-0x0000000000380000-0x00000000008D1000-memory.dmp	upx
behavioral2/memory/4296-14-0x0000000000380000-0x00000000008D1000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e8bc3ab1e100428680277a29302a32bf576b14fffa40658e75b6243ef2c51651.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
4296	e8bc3ab1e100428680277a29302a32bf576b14fffa40658e75b6243ef2c51651.exe
4296	e8bc3ab1e100428680277a29302a32bf576b14fffa40658e75b6243ef2c51651.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4296	e8bc3ab1e100428680277a29302a32bf576b14fffa40658e75b6243ef2c51651.exe
Token: SeShutdownPrivilege	4296	e8bc3ab1e100428680277a29302a32bf576b14fffa40658e75b6243ef2c51651.exe
Token: SeDebugPrivilege	4296	e8bc3ab1e100428680277a29302a32bf576b14fffa40658e75b6243ef2c51651.exe
Token: SeDebugPrivilege	4960	4A5D.tmp
Token: SeDebugPrivilege	4296	e8bc3ab1e100428680277a29302a32bf576b14fffa40658e75b6243ef2c51651.exe
Token: SeLoadDriverPrivilege	4296	e8bc3ab1e100428680277a29302a32bf576b14fffa40658e75b6243ef2c51651.exe
Token: SeDebugPrivilege	3256	4B87.tmp

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 4960	4296	e8bc3ab1e100428680277a29302a32bf576b14fffa40658e75b6243ef2c51651.exe	87
PID 4296 wrote to memory of 3256	4296	e8bc3ab1e100428680277a29302a32bf576b14fffa40658e75b6243ef2c51651.exe	88

C:\Users\Admin\AppData\Local\Temp\e8bc3ab1e100428680277a29302a32bf576b14fffa40658e75b6243ef2c51651.exe
"C:\Users\Admin\AppData\Local\Temp\e8bc3ab1e100428680277a29302a32bf576b14fffa40658e75b6243ef2c51651.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Users\Admin\AppData\Local\Temp\4A5D.tmp
  "C:\Users\Admin\AppData\Local\Temp\4A5D.tmp" 668
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4960
- C:\Users\Admin\AppData\Local\Temp\4B87.tmp
  "C:\Users\Admin\AppData\Local\Temp\4B87.tmp" 684
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4A5D.tmp

Path C:\Users\Admin\AppData\Local\Temp\4A5D.tmp
Size 463KB
SHA256 1eb2b80fa69ed001306cb4a59f6ee0e738fc74778fc712a3a97ff76daacbfa2e
MD5 fd9e030fae41d0a47957c39f731128c5
SHA1 e66129ec5c39f046f94a18bc877297d3b4abcf8d
SHA512 0b8fd82ac59b4a32895f106168b810d6d42ef9ebd7f821d619bb309f081f167808b39acf1bed78cf078c48395fd187510af3a6fc9e434e735fd521150e0cda16
SSDEEP 12288:deq98eSx5cA1zXpDm649VCClXyctmS5V2NDxuFxkI:R9Fka8Xpe9VCClXyctmS5V2NtuFxkI
TLSH
T119A48CD5779009F9D177C23CC9920A16E6B27826076097CF03B496BA1F237E29E3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4296-0-0x0000000000380000-0x00000000008D1000-memory.dmp

Download

memory/4296-1-0x00000000008CF000-0x00000000008D0000-memory.dmp

Download

memory/4296-14-0x0000000000380000-0x00000000008D1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads