Analysis
- max time kernel
149s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 00:29
Behavioral task
behavioral1
Sample
mDHA7t23e1gsad.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
mDHA7t23e1gsad.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target mDHA7t23e1gsad.exe
- Size 17.6MB
- Sample260722-as7y9sweph
- SHA256 8ca879bb627cc8ccfd699d4c839fb59230de7e8c20d07fe0821302b4fac27fc2
- MD5 76e543a3051f28803f46bb51aa019b76
- SHA1 5ae796c69d94fe46ce9e48e400f7718d417adabb
- SHA512 0486036d269f559963a303c3b4b258732aac09478c52e6c5c6c80baade212114908d6cd8affdd806b6b3fba721526c2583046a0b07f9dc87432075bc1cbebc18
- SSDEEP 393216:1D4xcE70DPYq4dcjY92zKv1pm6fhSMQrBV7j:18/ADPYq6Oc1pm6fMMsV7
- TLSH T1A0072386D8C823F9C7979B209256174EE291366B5F859C0D23D92C023BE3D6717C7E2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3164-1-0x00007FF7F09D0000-0x00007FF7F2F6A000-memory.dmp themida behavioral2/memory/3164-4-0x00007FF7F09D0000-0x00007FF7F2F6A000-memory.dmp themida behavioral2/memory/3164-8-0x00007FF7F09D0000-0x00007FF7F2F6A000-memory.dmp themida behavioral2/memory/3164-10-0x00007FF7F09D0000-0x00007FF7F2F6A000-memory.dmp themida behavioral2/memory/3164-11-0x00007FF7F09D0000-0x00007FF7F2F6A000-memory.dmp themida - Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe 3164 mDHA7t23e1gsad.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSystemEnvironmentPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe Token: SeDebugPrivilege 3164 mDHA7t23e1gsad.exe