2f8689b38449a7a1e3e0e01532b0e9bf934d91997995f550808a975838e11e97

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 03:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2f8689b38449a7a1e3e0e01532b0e9bf934d91997995f550808a975838e11e97.exe
Size 5.1MB
Sample260730-dvlqlaycmd
SHA256 2f8689b38449a7a1e3e0e01532b0e9bf934d91997995f550808a975838e11e97
MD5 4216905fe5a9478fa34324b1170b6d8d
SHA1 92a1868c0b0aec80bc6ff799f17f0e046a390e3c
SHA512 91745e04a5b69efe4f884dd5315b0da4ea3f7f54092e6a9867149cfef9d49b67d4d5b19f98b1998926ffd8b24daecb65dc52b2b81879ba39e1da099633aa8801
SSDEEP 98304:seKdjEJtOOFOnEdxEEuOeSEdROsBh5MJ9gfrdv:0djEkOFCe4dRcJ9Y5v
TLSH
T15636BF12FA8040B2E5A3413881BAAB7B9D7DBD30172485C763E41DBA4D316D27B3E75B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\TLz_1E6eC5bf.sys	2f8689b38449a7a1e3e0e01532b0e9bf934d91997995f550808a975838e11e97.exe
File created	C:\Windows\System32\drivers\34OIclfKmvUW.sys	2f8689b38449a7a1e3e0e01532b0e9bf934d91997995f550808a975838e11e97.exe

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\34OIclfKmvUW\ImagePath = "system32\\DRIVERS\\34OIclfKmvUW.sys"	2f8689b38449a7a1e3e0e01532b0e9bf934d91997995f550808a975838e11e97.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TLz_1E6eC5bf\ImagePath = "system32\\DRIVERS\\TLz_1E6eC5bf.sys"	2f8689b38449a7a1e3e0e01532b0e9bf934d91997995f550808a975838e11e97.exe

Executes dropped EXE 2 IoCs

pid	Process
2376	8B8D.tmp
3552	8C49.tmp

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f8689b38449a7a1e3e0e01532b0e9bf934d91997995f550808a975838e11e97.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
3184	2f8689b38449a7a1e3e0e01532b0e9bf934d91997995f550808a975838e11e97.exe
3184	2f8689b38449a7a1e3e0e01532b0e9bf934d91997995f550808a975838e11e97.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3184	2f8689b38449a7a1e3e0e01532b0e9bf934d91997995f550808a975838e11e97.exe
Token: SeShutdownPrivilege	3184	2f8689b38449a7a1e3e0e01532b0e9bf934d91997995f550808a975838e11e97.exe
Token: SeDebugPrivilege	3184	2f8689b38449a7a1e3e0e01532b0e9bf934d91997995f550808a975838e11e97.exe
Token: SeDebugPrivilege	2376	8B8D.tmp
Token: SeDebugPrivilege	3184	2f8689b38449a7a1e3e0e01532b0e9bf934d91997995f550808a975838e11e97.exe
Token: SeLoadDriverPrivilege	3184	2f8689b38449a7a1e3e0e01532b0e9bf934d91997995f550808a975838e11e97.exe
Token: SeDebugPrivilege	3552	8C49.tmp

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 2376	3184	2f8689b38449a7a1e3e0e01532b0e9bf934d91997995f550808a975838e11e97.exe	89
PID 3184 wrote to memory of 3552	3184	2f8689b38449a7a1e3e0e01532b0e9bf934d91997995f550808a975838e11e97.exe	90

C:\Users\Admin\AppData\Local\Temp\2f8689b38449a7a1e3e0e01532b0e9bf934d91997995f550808a975838e11e97.exe
"C:\Users\Admin\AppData\Local\Temp\2f8689b38449a7a1e3e0e01532b0e9bf934d91997995f550808a975838e11e97.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Users\Admin\AppData\Local\Temp\8B8D.tmp
  "C:\Users\Admin\AppData\Local\Temp\8B8D.tmp" 668
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2376
- C:\Users\Admin\AppData\Local\Temp\8C49.tmp
  "C:\Users\Admin\AppData\Local\Temp\8C49.tmp" 692
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8B8D.tmp

Path C:\Users\Admin\AppData\Local\Temp\8B8D.tmp
Size 463KB
SHA256 02bc7ab1797b3e2be4d01b61dfbbcc0755fdf25246cdf621233b008aef073fe5
MD5 51ce16abe8e830b23cc309f82bacde8f
SHA1 9c6604a5222f0ee5beacc2f85e1fb017676d313e
SHA512 af7df3f1e35efb23191d708c3f5964e3ff79c0be4058c6f9048dd3bf2ad112dbfbcb5f2d0d8059386f9fe592505a8647f0e44a82d1a32f367a728c02d2e4903f
SSDEEP 12288:8eq98eSx5cA1zXpDm649VCClXyctmS5V2ND8uFxkh:Q9Fka8Xpe9VCClXyctmS5V2NIuFxkh
TLSH
T1E6A48CD5779009F9D177C23CC9920A16E6B27826076097CF03B496BA1F237E29E3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3184-0-0x0000000000380000-0x00000000008B0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads