a1b6172a12f4fe82a55c77b054520968648d2faa41446d669dc86a2b667268f2

Analysis

user interaction
yes
max time kernel
90s
max time network
86s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Kurulum.exe
Size 1.9MB
Sample260727-2le4fsttd1
SHA256 a1b6172a12f4fe82a55c77b054520968648d2faa41446d669dc86a2b667268f2
MD5 b5e5bf9d423f9936969283439a158380
SHA1 29ec851a873be48f2f6142bb9064d47a43ab95a7
SHA512 375861cacc933d1ca886d82d75a74d2525290e2ab8d3f08ab6041fd8628dc48dc37d1d390f2fd90878640a55702e8a1e3357a38900afe7919ecc952824ab4c97
SSDEEP 49152:o6xcx0RWhne8jOxSNFYCC77WS0e4vkxzLYtW0ejawMgHrQ+j:o6Ide88iOCCVh/awHsI
TLSH
T1B1950259D7E505F9E0B3E1B4CD934812EB777C491771E68F03AC69A61F232A08E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4600	0nlyAzra.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
11	raw.githubusercontent.com
15	raw.githubusercontent.com
1	raw.githubusercontent.com
8	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Colors	Kurulum.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Kurulum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	Kurulum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Kurulum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	Kurulum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	Kurulum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	Kurulum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	Kurulum.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4300	Kurulum.exe
4600	0nlyAzra.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4300	Kurulum.exe
4300	Kurulum.exe
4600	0nlyAzra.exe

C:\Users\Admin\AppData\Local\Temp\Kurulum.exe
"C:\Users\Admin\AppData\Local\Temp\Kurulum.exe"
1⤵
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4300

C:\Users\Admin\Desktop\0nlyAzra.exe
"C:\Users\Admin\Desktop\0nlyAzra.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0nlyAzra.exe

Path C:\Users\Admin\Desktop\0nlyAzra.exe
Size 2.1MB
SHA256 c54f4ce1930ec0977e7e100f432b41153391d64a2c5e4a85b81fb765fa8e1287
MD5 37714caa87b3533734fb2e5b084b10f5
SHA1 d995f1ec020c2f2b4ea83d7be95bf6e6eb8e31f8
SHA512 ad7109e562744bb855681f080a24b612fc7a2f2f7390e989d711dfe8d674d94deabca5e4895fa355b8c60ab21117b0ec7b1ca212dd97cd571bb23b76de08be15
SSDEEP 24576:SKp/mzvEnuH7EFmIJDcAO6iA7XqC7nKxRWxruwftGmW9qYuFQ6hRFzLNWQa1o8:/sMn21yIwiAeCmiBFtGx9xWQA9uS
TLSH
T19DA5E143F362835CE427683887A3D723A23378401B21D28FB7A42A698F975F45D67BD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download