Analysis
- max time kernel
150s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 12:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe
- Size 1.6MB
- Sample260729-pbw8rstcph
- SHA256 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113
- MD5 e009bde9245f2e7c61074cb74943012f
- SHA1 6096b62216e938c8a295d994517f0c84464f7300
- SHA512 1a1e572ec270f4a28f78a30b96c0d6788089cd29f62d8cf59aec16bb0d0c2d3cc16927179b54686616d4f0932c896100c29b14334831cd6c2ce98b7eb5221c1e
- SSDEEP 24576:VARwf227aRq4+n4S7HXST9UC47UiWmyaKJ3i/cQkjdw/Ja4WjzPxJcEQse:VARw6Rq7H2UC44ltQWUE4WjrIRse
- TLSH T1A6758E23A6A401BDD4B7C1F8CA674943E7B2B8460371ABEF03D056662F276D54E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3524 e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe"C:\Users\Admin\AppData\Local\Temp\e59a0f218e04225adc34562d9c2343fbc7cf180d950ecc667f29c62c2a9db113.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3524