03b4ac7edc79af0cf3c2c1e6373e46781a0d9f9dfa4d3d40c69a960ae018c47b

Analysis

max time kernel
178s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IObitUninstaler.exe
Size 553KB
Sample260731-amf9cszepf
SHA256 03b4ac7edc79af0cf3c2c1e6373e46781a0d9f9dfa4d3d40c69a960ae018c47b
MD5 8700019ad536d462f915fb6765e871e0
SHA1 0f373a2da0bdfd1c9ca6bf24e766d34931b5dda8
SHA512 09a5f1dec03f5c1831b77a33d6f1e761c6f8e808b0d3afc7f10c3f6020d22999b0079b68163994702912acf24b1fd9380278255c29aa452f91e8257385f05883
SSDEEP 12288:K/sf+vtw5SSczFl6mJwo/e0LopMqwxHwrmD:KEGvlS2dJm0EpMq
TLSH
T152C402CBAE4106F7C62DF53005B7B33E172BA97D2BE78E1E921F6E1A2B3164C9915140
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4880	IObitUninstaler.exe
4880	IObitUninstaler.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4880	IObitUninstaler.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\merkurstav\brewed.lnk	IObitUninstaler.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\tiendes.exe	IObitUninstaler.exe
File opened for modification	C:\Windows\resources\pterylosis.htm	IObitUninstaler.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4880	IObitUninstaler.exe
4880	IObitUninstaler.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4880	IObitUninstaler.exe
4880	IObitUninstaler.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4880	IObitUninstaler.exe
4880	IObitUninstaler.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 4196	4880	IObitUninstaler.exe	90
PID 4880 wrote to memory of 4196	4880	IObitUninstaler.exe	90

C:\Users\Admin\AppData\Local\Temp\IObitUninstaler.exe
"C:\Users\Admin\AppData\Local\Temp\IObitUninstaler.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Users\Admin\AppData\Local\Temp\IObitUninstaler.exe
  "C:\Users\Admin\AppData\Local\Temp\IObitUninstaler.exe"
  2⤵
  PID:4196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Callisto.ini

Path C:\Users\Admin\AppData\Local\Temp\Callisto.ini
Size 52B
SHA256 ad14b40cce2755ea9320e17027d1c09c10123f39175f080d80f96fe2407afe6d
MD5 9278a32232ec07216b524de54be6a623
SHA1 029fa69425bba5cd58f92ff73bd13b3660157e1f
SHA512 f2d51c4a34acc08d553880bf28cca6ce1f2a75cecc64f5fd1a2060d56eb15f8610294c7c322035106ac567d663cadf7f42a31e32d06b02d2f130e3a210768170
TLSH
T16A900450753C35110037311F01541433F30FD574C4510741FD7C17441F54534550C345
MD5 SHA1 SHA512 TLSH

Submit Download

Callisto.ini

Path C:\Users\Admin\AppData\Local\Temp\Callisto.ini
Size 78B
SHA256 47fb90afa9dcccdfc53368e9e170e9ee3ff626f36750a5bbb76d576a374eee9d
MD5 9ac928f8685affe5b4745de864fd3eb2
SHA1 1a1e3fbbc9834cd1b9f16a361fc8193541b67483
SHA512 7b41b66c98a16d3bfd2b085c297cf3ce62f7d2d2802215ed0cbba0bd681efda79e0012609cedaf6b5bbc20d1d235ee1703513a137ff6ac7327bbbd734d99eb9f
TLSH
T1E2A0222202E020008000C3FE08808A33320F800B808F0203BA3C0A208F0A83ACA0E882
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk7621.tmp\System.dll
Size 25KB
SHA256 33b570d86c4aac8c6785944f9b2992dc3eccc99e35c20ab79d81917bbef35622
MD5 7f6837692e4c3ee810fe8302b7e0db99
SHA1 2dff99100da9588dd828fc4436a82d0b1a9f1354
SHA512 923d20a4396a788f2073ee9a1f34c7a74013e4a424a39a1b0bc14c1533c0c496e06e3ab702debfa193c84adf909203db8bb9ad52cad436c4d7a3b5cde6776678
SSDEEP 384:WZ2pfUx9eVLwDKO9XYD/isN7lCEjgwMU/ktKi+R45Duwomq8pqdDvHb1Q:Wr96YIrx7lC7vU/kaG9uLmCdb
TLSH
T120B24C07F38398BFC50BC1B186EF5772AA32BE211B616F6F1220F5756E24E90871DA14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4196-42-0x0000000000080000-0x000000000010F000-memory.dmp

Download

memory/4196-45-0x00007FF867969000-0x00007FF86796B000-memory.dmp

Download

memory/4880-13-0x00007FF85BB19000-0x00007FF85BB1A000-memory.dmp

Download

memory/4880-18-0x00007FF85BB19000-0x00007FF85BB1A000-memory.dmp

Download

memory/4880-40-0x00007FF85BB10000-0x00007FF85BB1F000-memory.dmp

Download

memory/4880-41-0x0000000003F70000-0x0000000004B39000-memory.dmp

Download

memory/4880-43-0x0000000140000000-0x000000014012F000-memory.dmp

Download