Analysis

  • max time kernel
    150s
  • max time network
    114s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    31/07/2026, 17:48

General

  • Target
    soul{beata}.exe
  • Size 2.2MB
  • Sample260731-wdrvdsdk5w
  • SHA256 b06acdbda625aa6baf6494688841a8b3851dba7eaf1a49673d2dfda791fd316d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\soul{beata}.exe
    "C:\Users\Admin\AppData\Local\Temp\soul{beata}.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:5268

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        user_flags.json

        • Path C:\Users\Admin\AppData\Roaming\DARK SU\user_flags.json
        • Size 5B
        • SHA256 1b7a6afb58ce9d1ab0dd41e566d637dbc98647399002c198af5943c6f362a794
        • MD5 SHA1 SHA512

        user_settings.json

        • Path C:\Users\Admin\AppData\Roaming\DARK SU\user_settings.json
        • Size 42B
        • SHA256 b4474a899ae64ef01f5b52f16cb288ecac06d8eae0b191b1da63f986d19c4f5a
        • MD5 SHA1 SHA512

        user_settings.json

        • Path C:\Users\Admin\AppData\Roaming\DARK SU\user_settings.json
        • Size 43B
        • SHA256 842c50d3e99234fcf7699422d8ffd7ecaa2ecc640f1ba8a3413d1713d07e1ff1
        • MD5 SHA1 SHA512