6b96861ec0c5008ad140faf3e95ccf3a0f6b6b3a07820a0d50af329e2547996e

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 09:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6b96861ec0c5008ad140faf3e95ccf3a0f6b6b3a07820a0d50af329e2547996e.exe
Size 549KB
Sample260717-k4vs7ags2n
SHA256 6b96861ec0c5008ad140faf3e95ccf3a0f6b6b3a07820a0d50af329e2547996e
MD5 7696e3e95d840df5d761b823d7869916
SHA1 b8ddfa16c60644426e7cd2fee841e6237457cc2f
SHA512 2199bb0414e988e7457b0fc4acdd4db5b7d76de39f91dd4a048518663f834a9a244ec7317887b3f5abf43ad28eb299328b4a9c95e00c110fd2b0431606bc6082
SSDEEP 12288:JtgFBTuBDtSy5XMvAyckPxftLcCC5WnJoGJtOrAwQ:JUtuBDkyd0AyckPfLpVWGJtOrAwQ
TLSH
T16FC41205EFC798EDE476467059F785539821BEFD1A30A31F9228BA2BBC71A91C937340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
5104	6b96861ec0c5008ad140faf3e95ccf3a0f6b6b3a07820a0d50af329e2547996e.exe
5104	6b96861ec0c5008ad140faf3e95ccf3a0f6b6b3a07820a0d50af329e2547996e.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5104	6b96861ec0c5008ad140faf3e95ccf3a0f6b6b3a07820a0d50af329e2547996e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5104	6b96861ec0c5008ad140faf3e95ccf3a0f6b6b3a07820a0d50af329e2547996e.exe
5104	6b96861ec0c5008ad140faf3e95ccf3a0f6b6b3a07820a0d50af329e2547996e.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5104	6b96861ec0c5008ad140faf3e95ccf3a0f6b6b3a07820a0d50af329e2547996e.exe
5104	6b96861ec0c5008ad140faf3e95ccf3a0f6b6b3a07820a0d50af329e2547996e.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
5104	6b96861ec0c5008ad140faf3e95ccf3a0f6b6b3a07820a0d50af329e2547996e.exe
5104	6b96861ec0c5008ad140faf3e95ccf3a0f6b6b3a07820a0d50af329e2547996e.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 5000	5104	6b96861ec0c5008ad140faf3e95ccf3a0f6b6b3a07820a0d50af329e2547996e.exe	87
PID 5104 wrote to memory of 5000	5104	6b96861ec0c5008ad140faf3e95ccf3a0f6b6b3a07820a0d50af329e2547996e.exe	87

C:\Users\Admin\AppData\Local\Temp\6b96861ec0c5008ad140faf3e95ccf3a0f6b6b3a07820a0d50af329e2547996e.exe
"C:\Users\Admin\AppData\Local\Temp\6b96861ec0c5008ad140faf3e95ccf3a0f6b6b3a07820a0d50af329e2547996e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Users\Admin\AppData\Local\Temp\6b96861ec0c5008ad140faf3e95ccf3a0f6b6b3a07820a0d50af329e2547996e.exe
  "C:\Users\Admin\AppData\Local\Temp\6b96861ec0c5008ad140faf3e95ccf3a0f6b6b3a07820a0d50af329e2547996e.exe"
  2⤵
  PID:5000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Callisto.ini

Path C:\Users\Admin\AppData\Local\Temp\Callisto.ini
Size 80B
SHA256 f97fb99da98481ed7d19187b864a8506822df849bcee74679fa9cae4f118e5f1
MD5 72cb8a57bed2da9767f5ec8342fd6390
SHA1 ee46f24f33dbb5e938319ef93122e306de4540e4
SHA512 800a26c8303da57011dff2a20e446be9058393db29e1aa99e73db64b851939c5d5d8eb32d7c432ae571b6e14d7112a56cf09fea59881022349e17e15214088c3
TLSH
T197A0222202E020008000C3FE08808A33320F800B808F0203BA3C0A208F0A83ACA0E882
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb3A13.tmp\System.dll
Size 25KB
SHA256 c7dd8cc8323e295b8821b0e320de208a7e20c068a8be8d03857520451ce9ded7
MD5 4abf19a47044ec746aa8c600f0bc149f
SHA1 69da1e4f654b044d7b3c845c12a07c988bf26eb8
SHA512 65727cbe3f03e0dceba06d206054e60adba321d29159b4bfb690c30b2ccd1a0a05a08c2aa50ac270fcd28557f4b482f492c36b0d7b7b980b477cd8971559610e
SSDEEP 384:jZ2pfUx9eVLwDKO9XYD/isN7lCEjgwMU/ktKi+R45Duwomq8pqdDvH81Q:jr96YIrx7lC7vU/kaG9uLmCdb
TLSH
T1DEB24C07F38398BFC51BC17186EF5772AA32BE211B616F6F1220F5756E24EA0871DA14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5000-45-0x0000000000080000-0x0000000000132000-memory.dmp

Download

memory/5000-46-0x00007FFE3E729000-0x00007FFE3E72B000-memory.dmp

Download

memory/5104-43-0x00007FFE348A0000-0x00007FFE348AF000-memory.dmp

Download

memory/5104-42-0x00007FFE348A9000-0x00007FFE348AA000-memory.dmp

Download

memory/5104-16-0x00007FFE348A9000-0x00007FFE348AA000-memory.dmp

Download

memory/5104-44-0x0000000003F80000-0x00000000069CE000-memory.dmp

Download

memory/5104-47-0x0000000140000000-0x000000014010F000-memory.dmp

Download