5fb44b1f830a3c21b2e12287d79a79d60f9dfd3ad33c5a94e946078548a10c1d

Resubmissions

21/07/2026, 09:04

260721-k1zmzabw4m10

21/07/2026, 08:54

260721-kvdtbacy7x7

21/07/2026, 08:49

260721-kq2pksbs8l10

Analysis

max time kernel
298s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 08:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Amiantit_RFQ_Documents/BOQ.lnk
Size 1KB
Sample260721-kq2pksbs8l
SHA256 5fb44b1f830a3c21b2e12287d79a79d60f9dfd3ad33c5a94e946078548a10c1d
MD5 af9953deeb925554d524f2f262efe9bf
SHA1 c82850341b6ee6ff80544d791c7439aa50b948d1
SHA512 2ccb891467f0de144c0801df4d4860c3ae558e93002fd80c0f2a2a688925e167d1646b132185ed9bc845fc1a2897bd68c7ad04871fa981dee41f1ad09c096dbd
TLSH
T1E73135015AFF4974F3F2AF71C7745208C526FDE91A06DB8E4460110E0850F088936B33
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4948	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 788	4948	cmd.exe	90

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Amiantit_RFQ_Documents\BOQ.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Users\Admin\AppData\Local\Temp\Amiantit_RFQ_Documents\SPECIFICATIONS\Amiantit_Request_For_Quotation_for_Ongoing_Project_with_El_Sewedy_Co_in_Rabigh_GV.exe
  "C:\Users\Admin\AppData\Local\Temp\Amiantit_RFQ_Documents\SPECIFICATIONS\Amiantit_Request_For_Quotation_for_Ongoing_Project_with_El_Sewedy_Co_in_Rabigh_GV.exe" YWEYHNYQDMVPCNUQ.css
  2⤵
  PID:788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BOQ.lnk

Path C:\Users\Admin\AppData\Local\Temp\Amiantit_RFQ_Documents\BOQ.lnk
Size 1KB
SHA256 795a6629d517c123f2cfbcc4db5ee92a71cd35ee2ab5c0c4fe59d55fb21ba861
MD5 a0e2eb4815ead7b3d6a9164378a895b2
SHA1 365c963b120ea9dc0354ff9ce6caf912d3dfda8e
SHA512 96c4441ef9669193e1b2566558acadcfa8164a7a10bf5c3a19e69dd2ef1b925f4af5f420f31c8f5416b798c80e09d93749b1b741441ce83f632e7be7b28f5486
TLSH
T16541DE019AFB0B25F2F2EF7197B66504E121FDE95B47EADD4062120E0821F05D925B3F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/788-5-0x0000000000400000-0x0000000000482000-memory.dmp

Download