f1ba61d06dfd27b1596d7ca19bc55a98e2646851144db8f09adf03bb2b5a91db

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 05:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f1ba61d06dfd27b1596d7ca19bc55a98e2646851144db8f09adf03bb2b5a91db.exe
Size 3.4MB
Sample260718-fn2vcact3v
SHA256 f1ba61d06dfd27b1596d7ca19bc55a98e2646851144db8f09adf03bb2b5a91db
MD5 66d53121de90a309e79084874db51a44
SHA1 d6017ef9206b5da64054a9f32924a13edf30c23d
SHA512 7169393e8dc73f19190d04e36daecf1fbd12f9b13daa1c89029e8e563e1f38725a9922373ca2b3d9e9cf5d11d11d5d92aaa1ffae898e7df08f203d4081c549ad
SSDEEP 98304:PRUZ/Pf1p+ErIb9sbq3/ZT4ogpjDlymjWwGID+8XjjprkPl:PRUZVpZIpvd4ogJsSi
TLSH
T134F5F1872AEB0CF9DD831B7C05DB82726B34FEA442768F3B4125C6335D139D66D16A28
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4248	PKF298.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 4248	1856	f1ba61d06dfd27b1596d7ca19bc55a98e2646851144db8f09adf03bb2b5a91db.exe	89

C:\Users\Admin\AppData\Local\Temp\f1ba61d06dfd27b1596d7ca19bc55a98e2646851144db8f09adf03bb2b5a91db.exe
"C:\Users\Admin\AppData\Local\Temp\f1ba61d06dfd27b1596d7ca19bc55a98e2646851144db8f09adf03bb2b5a91db.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Users\Admin\AppData\Local\Temp\PKF298.exe
  "C:\Users\Admin\AppData\Local\Temp\PKF298.exe"
  2⤵
  - Executes dropped EXE
  PID:4248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PKF298.exe

Path C:\Users\Admin\AppData\Local\Temp\PKF298.exe
Size 2.9MB
SHA256 7218f0fe9676e949d0da7c691839c8cbea785654866073f706d9a67f0c123ac7
MD5 11529fc284a9b1d4bb7671f839a6d1a8
SHA1 0acd6e38a7e74dd63496dc6369e024251cb39c91
SHA512 635dc3a3204a9bbd1dfcbf66f7fb78a5c62dea723afec4e9098a26b957ce0d19e9f031ae32b2f0d945bd61042142ece2ce9cb163df3d5f097067f13bc4d9c401
SSDEEP 49152:T9BTWvqQPUXKbLjT66tWivBflaY/Y3KZQhABP7o0H8OlcZbUxc8ic/79F65h9aMc:/adDaY/g8QhABP7o0H8OlcZbUxc8ic/b
TLSH
T162E5D64369DB0DE9DDD677B861C36335A734BD71CA2A1F3AA608C23129536C4AD2EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1856-8-0x00007FF709AE0000-0x00007FF709E0F000-memory.dmp

Download

memory/4248-10-0x00007FF79B710000-0x00007FF79B850000-memory.dmp

Download

memory/4248-14-0x00007FF79B710000-0x00007FF79B850000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads