Analysis
- max time kernel
40s - max time network
39s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 02:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
40 seconds
Behavioral task
behavioral2
Sample
1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
40 seconds
General
- Target 1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe
- Size 6.5MB
- Sample260722-dffk2axfnc
- SHA256 1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a
- MD5 f42db6ffdf93e601e7fd8de6087a9bc2
- SHA1 f4dddf0fee73465efbfaf305482c9b4c1480a529
- SHA512 4fc1feff335ce4fe46273b50367341159c09b335e72bc09b48cf99daad3242cae09e7e5c88ccefea662c274be9c70929d30674cc599726c6eb5a1757cdec6a8e
- SSDEEP 49152:eiQMUqtiuVHM8VogQ8MXiQQLhD+qBC+8hVvALe+MaPujoTpIASRrs7ZGPwL3l+Ng:eirPI4qDAWoTn7xpLtiUKnE
- TLSH T15B664A17FCA524E5C1ADD1308AB69653BB727C891B3123D32B90F6282F76BD0AD79350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemd-resolved.exe 1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemd-resolved.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe" 1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe - Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 checkip.amazonaws.com 4 ifconfig.me 5 icanhazip.com 6 api.ipify.org 7 ipinfo.io - GoLang User-Agent 4 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 9 Go-http-client/1.1 HTTP User-Agent header 10 Go-http-client/1.1 HTTP User-Agent header 11 Go-http-client/1.1 HTTP User-Agent header 12 Go-http-client/1.1 - Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 4588 wmic.exe 4588 wmic.exe 4588 wmic.exe 4588 wmic.exe 5016 wmic.exe 5016 wmic.exe 5016 wmic.exe 5016 wmic.exe 5060 wmic.exe 5060 wmic.exe 5060 wmic.exe 5060 wmic.exe 3348 wmic.exe 3348 wmic.exe 3348 wmic.exe 3348 wmic.exe 3740 wmic.exe 3740 wmic.exe 3740 wmic.exe 3740 wmic.exe 4988 wmic.exe 4988 wmic.exe 4988 wmic.exe 4988 wmic.exe 2472 wmic.exe 2472 wmic.exe 2472 wmic.exe 2472 wmic.exe 208 wmic.exe 208 wmic.exe 208 wmic.exe 208 wmic.exe 472 wmic.exe 472 wmic.exe 472 wmic.exe 472 wmic.exe 3228 wmic.exe 3228 wmic.exe 3228 wmic.exe 3228 wmic.exe 6076 wmic.exe 6076 wmic.exe 6076 wmic.exe 6076 wmic.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4588 wmic.exe Token: SeSecurityPrivilege 4588 wmic.exe Token: SeTakeOwnershipPrivilege 4588 wmic.exe Token: SeLoadDriverPrivilege 4588 wmic.exe Token: SeSystemProfilePrivilege 4588 wmic.exe Token: SeSystemtimePrivilege 4588 wmic.exe Token: SeProfSingleProcessPrivilege 4588 wmic.exe Token: SeIncBasePriorityPrivilege 4588 wmic.exe Token: SeCreatePagefilePrivilege 4588 wmic.exe Token: SeBackupPrivilege 4588 wmic.exe Token: SeRestorePrivilege 4588 wmic.exe Token: SeShutdownPrivilege 4588 wmic.exe Token: SeDebugPrivilege 4588 wmic.exe Token: SeSystemEnvironmentPrivilege 4588 wmic.exe Token: SeRemoteShutdownPrivilege 4588 wmic.exe Token: SeUndockPrivilege 4588 wmic.exe Token: SeManageVolumePrivilege 4588 wmic.exe Token: 33 4588 wmic.exe Token: 34 4588 wmic.exe Token: 35 4588 wmic.exe Token: 36 4588 wmic.exe Token: SeIncreaseQuotaPrivilege 4588 wmic.exe Token: SeSecurityPrivilege 4588 wmic.exe Token: SeTakeOwnershipPrivilege 4588 wmic.exe Token: SeLoadDriverPrivilege 4588 wmic.exe Token: SeSystemProfilePrivilege 4588 wmic.exe Token: SeSystemtimePrivilege 4588 wmic.exe Token: SeProfSingleProcessPrivilege 4588 wmic.exe Token: SeIncBasePriorityPrivilege 4588 wmic.exe Token: SeCreatePagefilePrivilege 4588 wmic.exe Token: SeBackupPrivilege 4588 wmic.exe Token: SeRestorePrivilege 4588 wmic.exe Token: SeShutdownPrivilege 4588 wmic.exe Token: SeDebugPrivilege 4588 wmic.exe Token: SeSystemEnvironmentPrivilege 4588 wmic.exe Token: SeRemoteShutdownPrivilege 4588 wmic.exe Token: SeUndockPrivilege 4588 wmic.exe Token: SeManageVolumePrivilege 4588 wmic.exe Token: 33 4588 wmic.exe Token: 34 4588 wmic.exe Token: 35 4588 wmic.exe Token: 36 4588 wmic.exe Token: SeIncreaseQuotaPrivilege 5016 wmic.exe Token: SeSecurityPrivilege 5016 wmic.exe Token: SeTakeOwnershipPrivilege 5016 wmic.exe Token: SeLoadDriverPrivilege 5016 wmic.exe Token: SeSystemProfilePrivilege 5016 wmic.exe Token: SeSystemtimePrivilege 5016 wmic.exe Token: SeProfSingleProcessPrivilege 5016 wmic.exe Token: SeIncBasePriorityPrivilege 5016 wmic.exe Token: SeCreatePagefilePrivilege 5016 wmic.exe Token: SeBackupPrivilege 5016 wmic.exe Token: SeRestorePrivilege 5016 wmic.exe Token: SeShutdownPrivilege 5016 wmic.exe Token: SeDebugPrivilege 5016 wmic.exe Token: SeSystemEnvironmentPrivilege 5016 wmic.exe Token: SeRemoteShutdownPrivilege 5016 wmic.exe Token: SeUndockPrivilege 5016 wmic.exe Token: SeManageVolumePrivilege 5016 wmic.exe Token: 33 5016 wmic.exe Token: 34 5016 wmic.exe Token: 35 5016 wmic.exe Token: 36 5016 wmic.exe Token: SeIncreaseQuotaPrivilege 5016 wmic.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3576 wrote to memory of 3788 3576 1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe 90 PID 3576 wrote to memory of 4588 3576 1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe 91 PID 3576 wrote to memory of 5016 3576 1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe 93 PID 3576 wrote to memory of 5060 3576 1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe 94 PID 3576 wrote to memory of 3348 3576 1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe 95 PID 3576 wrote to memory of 3740 3576 1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe 96 PID 3576 wrote to memory of 4988 3576 1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe 97 PID 3576 wrote to memory of 2472 3576 1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe 98 PID 3576 wrote to memory of 208 3576 1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe 99 PID 3576 wrote to memory of 472 3576 1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe 100 PID 3576 wrote to memory of 3228 3576 1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe 101 PID 3576 wrote to memory of 6076 3576 1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe"C:\Users\Admin\AppData\Local\Temp\1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe"1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid2⤵PID:3788
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get name2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4588
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get AddressWidth2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5016
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Manufacturer2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5060
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get LoadPercentage2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3348
-
-
C:\Windows\System32\Wbem\wmic.exewmic OS get TotalVisibleMemorySize2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3740
-
-
C:\Windows\System32\Wbem\wmic.exewmic OS get FreePhysicalMemory2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4988
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Locale2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2472
-
-
C:\Windows\System32\Wbem\wmic.exewmic timezone get Caption2⤵
- Suspicious behavior: EnumeratesProcesses
PID:208
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious behavior: EnumeratesProcesses
PID:472
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get BuildNumber2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3228
-
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get PCSystemType2⤵
- Suspicious behavior: EnumeratesProcesses
PID:6076
-