Analysis
- max time kernel
150s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/07/2026, 17:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
soul{beata}.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
soul{beata}.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
General
- Target soul{beata}.exe
- Size 2.2MB
- Sample260731-wdrvdsdk5w
- SHA256 b06acdbda625aa6baf6494688841a8b3851dba7eaf1a49673d2dfda791fd316d
- MD5 d8f9d7f8d8b627cb4b303d656a96243e
- SHA1 51d642a61df8970406b853ae160802e495ecb038
- SHA512 2d0db5bdfdb68cf12e58cf82997a3bd0c0c29ff0a2df2d531da7d0a053faddf45658a591c5d9fa5f839473a518af89f2ce615ef21aedf8461c0f40a4a4bc67c9
- SSDEEP 49152:JToMKvPQvOi8AmQNsrlLaFPhmEsM2rqa3Q9GaMvr:pmQXPhda3Q9GaMvr
- TLSH T107B59D56F38686ABDFABE1B6DA100112EB3078C8072C69EF1155099EEF4BAD4573F311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 5 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe 5268 soul{beata}.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5268 soul{beata}.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5268 soul{beata}.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 5268 soul{beata}.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\DARK SU\user_flags.json
- Size 5B
- SHA256 1b7a6afb58ce9d1ab0dd41e566d637dbc98647399002c198af5943c6f362a794
- MD5 4c5719a7e96761b804cfd99165106c4b
- SHA1 32a975c7d85e193488366850fac8cd563e45ecf7
- SHA512 f28d1cccdc4e723e2db034332837e39e04a183c3fdfd618036b909cc38fcb76b58464c8d7600929b34c33bef3e42ee89b53871d03c34933c2265ea2d290b27a4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\DARK SU\user_settings.json
- Size 42B
- SHA256 b4474a899ae64ef01f5b52f16cb288ecac06d8eae0b191b1da63f986d19c4f5a
- MD5 79fecea53a6d8389c7009fc2f25ca9c0
- SHA1 bf4d5e02706662e0c098c149b9db2d9f3a68a493
- SHA512 c6f755fe0702597f91b203d1ba2783477e4636474dabf3fbd87b31efb9b29bd726ffef9b7bf81213d7aa6aedf669d55f4038eb4fb96bfafb086defb40c58be1a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\DARK SU\user_settings.json
- Size 43B
- SHA256 842c50d3e99234fcf7699422d8ffd7ecaa2ecc640f1ba8a3413d1713d07e1ff1
- MD5 2483ed4713c65c0e78f72319cf28d984
- SHA1 3269ea85025195288d589714b3b016d1ca750c04
- SHA512 6b996db80b5faf158a7ee680af59f5f568b4a2e245cc2b6c7fbf69f0dcaaa7ee45eb18826dede1f62f80bcdd33de6c57b4801d6badf5af6d5f1932dc0d6841c9
- MD5 SHA1 SHA512