cb1d73323d3d80004ada185844b0d461abd9ded736d5dc690607f935b4f2b58a

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Version_Bewerbung_2.0_202566_Bewerbungsnummer_0234521870_Datum_0000000200.exe
Size 7.0MB
Sample260727-trcaraxtdv
SHA256 cb1d73323d3d80004ada185844b0d461abd9ded736d5dc690607f935b4f2b58a
MD5 91841e006225ac500de7630740a21d91
SHA1 68875ce8177794df6bf125b2bb8b8ecc3b84517b
SHA512 d66e70b9d4d1997ac687589d0723c78e6ffe96aa35343b71f4e57750b7aad33d5555fd5d6b743125852e13cc9b9c338a8fb6b4844768054321404a8491546f0e
SSDEEP 98304:AlCytUlpXv400I/oQHXelFFcYC+NJ/yz0Z13H443UkgiDcWfbpgbLWE6e:Fwgv5oCWjcY9NByzo3H3URiwSib+e
TLSH
T15C7601AA63A552E8D02BD03D8615F627EBB274261710D7DB15B08D5D3F53EE20E3E322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Chromium_Updater_Updater_Version_1918 = "\"C:\\Users\\Admin\\Downloads\\Version_Bewerbung_2.0_202566_Bewerbungsnummer_0234521870_Datum_0000000200.exe\""	Version_Bewerbung_2.0_202566_Bewerbungsnummer_0234521870_Datum_0000000200.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Chromium_Updater_Updater_Version_1918 = "\"C:\\Users\\Admin\\Downloads\\Version_Bewerbung_2.0_202566_Bewerbungsnummer_0234521870_Datum_0000000200.exe\""	Version_Bewerbung_2.0_202566_Bewerbungsnummer_0234521870_Datum_0000000200.exe

Executes dropped EXE 1 IoCs

pid	Process
4840	Version_Bewerbung_2.0_202566_Bewerbungsnummer_0234521870_Datum_0000000200.exe

Loads dropped DLL 1 IoCs

pid	Process
4840	Version_Bewerbung_2.0_202566_Bewerbungsnummer_0234521870_Datum_0000000200.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 3004	1540	Version_Bewerbung_2.0_202566_Bewerbungsnummer_0234521870_Datum_0000000200.exe	85
PID 1540 wrote to memory of 3004	1540	Version_Bewerbung_2.0_202566_Bewerbungsnummer_0234521870_Datum_0000000200.exe	85
PID 4840 wrote to memory of 2488	4840	Version_Bewerbung_2.0_202566_Bewerbungsnummer_0234521870_Datum_0000000200.exe	88
PID 4840 wrote to memory of 2488	4840	Version_Bewerbung_2.0_202566_Bewerbungsnummer_0234521870_Datum_0000000200.exe	88

C:\Users\Admin\AppData\Local\Temp\Version_Bewerbung_2.0_202566_Bewerbungsnummer_0234521870_Datum_0000000200.exe
"C:\Users\Admin\AppData\Local\Temp\Version_Bewerbung_2.0_202566_Bewerbungsnummer_0234521870_Datum_0000000200.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3004

C:\Users\Admin\Downloads\Version_Bewerbung_2.0_202566_Bewerbungsnummer_0234521870_Datum_0000000200.exe
"C:\Users\Admin\Downloads\Version_Bewerbung_2.0_202566_Bewerbungsnummer_0234521870_Datum_0000000200.exe"
1⤵
- Adds Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Settings.txt

Path C:\Users\Admin\Downloads\Settings.txt
Size 3.8MB
SHA256 b9fac5fd68f333b9459fa4b0111da8fba64a20022df8ea8595eae6a2fc4b9d9d
MD5 77239138505c3e63be2d5d55224b02a3
SHA1 532f165c14f716317da0c70df5253b35ede22b68
SHA512 d4a112206409429376ec037455946a431a1ea4440ddf8905b09b9ed1ba0e863b2e55916eb960dea0e000f97cd95817d22651cf91a02310f822308b2a9e7e23d7
SSDEEP 24576:72B+E0Tg6XBYDdzwqP2IY1TL04a9xXoc6aqlEKONs5b9COR9GDSusIKBiVkGmpte:C+1Z2fG8
TLSH
T13D066255E69E6758734AE3E8260128B7FFB4C76D879C98B0B522237BCC430118DD8EB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Version_Bewerbung_2.0_202566_Bewerbungsnummer_0234521870_Datum_0000000200.exe

Path C:\Users\Admin\Downloads\Version_Bewerbung_2.0_202566_Bewerbungsnummer_0234521870_Datum_0000000200.exe
Size 7.0MB
SHA256 cb1d73323d3d80004ada185844b0d461abd9ded736d5dc690607f935b4f2b58a
MD5 91841e006225ac500de7630740a21d91
SHA1 68875ce8177794df6bf125b2bb8b8ecc3b84517b
SHA512 d66e70b9d4d1997ac687589d0723c78e6ffe96aa35343b71f4e57750b7aad33d5555fd5d6b743125852e13cc9b9c338a8fb6b4844768054321404a8491546f0e
SSDEEP 98304:AlCytUlpXv400I/oQHXelFFcYC+NJ/yz0Z13H443UkgiDcWfbpgbLWE6e:Fwgv5oCWjcY9NByzo3H3URiwSib+e
TLSH
T15C7601AA63A552E8D02BD03D8615F627EBB274261710D7DB15B08D5D3F53EE20E3E322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbgcore.DLL

Path C:\Users\Admin\Downloads\dbgcore.DLL
Size 1.5MB
SHA256 adbcaae34947d76e04d15b29547f07f000b2c776d2e5cf979d8e1564fabd9822
MD5 42db674c8120a5ca4502746a33f59263
SHA1 eed9548e9b6efbe8c904b572ae92a32b95ba94f6
SHA512 e8435c623f5538e080bfad1d2422f8d5ae3a828ce1f919f27e71cdd0591ed8f430244943177989ee3d9b1e3da93abf3de1da4d976c8a0a4ca84747f419c6dad4
SSDEEP 6144:P4XUuJWobj1p6eHtFXwbS0PaXK3To4croD0bU0:rukAXMPvTg40l
TLSH
T1DE656D82FBC5BC57DEA50631899F83693338FAD017A36B2319B47E345E039D0AE85647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1540-4-0x00007FFD03BE0000-0x00007FFD04BE0000-memory.dmp

Download

memory/4840-10-0x00007FFD03BE0000-0x00007FFD04BE0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads