9d0690fac5168a38b4dfc77289e53ffbb1b87219b27390a5d4a11e303c307823

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 17:06

Target
GatewayUncertainty.exe
Size 2.2MB
Sample260730-vmnnnacf48
SHA256 9d0690fac5168a38b4dfc77289e53ffbb1b87219b27390a5d4a11e303c307823
MD5 60c79d4f5eb60869d75d32c576428b01
SHA1 8192b2198ef75b2ce870538d085edf408300cff1
SHA512 c3f7ed5859c9a56be930a610c6f51f92d8455772640fc551ace15b92482cc7602b5fffdb6f4d39d3c4e0ba69c933d33eeb64859aab83fad0fbdef5aaf722e4b5
SSDEEP 49152:7FfIv2fN7VahjsEIe7SM9INwkGYWO9h8N6SLLZBs+w:7FwvgNshjaenNLoWpLLZd
TLSH
T1F0B523413AC884DBF9652F7485B1C59AC6B03C755F691A9FB1AAF75E0A31342033FB0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
4664	AutoIt3.exe
5612	AutoIt3.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4664 set thread context of 5612	4664	AutoIt3.exe	90

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of FindShellTrayWindow 3 IoCs

Suspicious use of SendNotifyMessage 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 4664	4816	GatewayUncertainty.exe	89
PID 4664 wrote to memory of 5612	4664	AutoIt3.exe	90
PID 4664 wrote to memory of 5612	4664	AutoIt3.exe	90
PID 4664 wrote to memory of 5612	4664	AutoIt3.exe	90

C:\Users\Admin\AppData\Local\Temp\GatewayUncertainty.exe
"C:\Users\Admin\AppData\Local\Temp\GatewayUncertainty.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Finite.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    PID:5612

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
Size 1.0MB
SHA256 92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45
MD5 8fa52f316c393496f272357191db6deb
SHA1 b1ff3d48a3946ca7786a84e4a832617cd66fa3b9
SHA512 c81da97d6980d6a5aa612070477950a1386239bb919e762f7870bccd459a03da48f8f169910b91f3827c6cfef50471569c9e0c9ff2ceb897904d81840c087d51
SSDEEP 24576:5TC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBB:5+6AqSPyC+NltpScpzbtvpJoMQSq/jre
TLSH
T1FC357D0A23A4419EFEA7F176D617C60BD7B1784A0376962F02A46B726F337711A1E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Finite.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Finite.a3x
Size 1.4MB
SHA256 1dc3fa863102fc7e188652ae6923fe428f5120515bcc186662b25a90d320fc31
MD5 c14410ebb71a123bfbda986db2a0ca44
SHA1 3145aa30168a2a7399268de0ca1fd47a44b9851a
SHA512 c9878268282fc0879c61b59220622c30790f33167a4c967c956dc269c01a5c724465264b7929fd1091bf0b4cdb1987d22ff1cc799005b262f7941c0f8b068cad
SSDEEP 24576:KfDvx2qlenLpLVaeYwUwgT9FEam9a1dIGKFf+bOQo98QfiIa/L3D0cjbE:KfDZ2ndLVaMLHa1dIH39tfNg3YWQ
TLSH
T1E065331671F6CCBD1E6131ED4AA03A8D27B4A171AF583EB9E31FD64C520FA1A134AF05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4664-7-0x00007FF98D2A0000-0x00007FF98D503000-memory.dmp

Download

memory/4664-8-0x00000239019D0000-0x00000239019D1000-memory.dmp

Download

memory/5612-10-0x0000021CDD9D0000-0x0000021CDDAA7000-memory.dmp

Download

memory/5612-11-0x0000021CDD9D0000-0x0000021CDDAA7000-memory.dmp

Download