35d5cdf23553b14ad8051f68b1af8199805f06479391888f609af4ed54ed5a63

Resubmissions

01/08/2026, 01:17

260801-bnrbdsbd728

01/08/2026, 01:10

260801-bjcmfavbkc9

01/08/2026, 01:07

260801-bgqfhsvapb8

01/08/2026, 01:06

260801-bgaeasvand3

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 01:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ByteBreaker V2_54596887.exe
Size 702KB
Sample260801-bnrbdsbd72
SHA256 35d5cdf23553b14ad8051f68b1af8199805f06479391888f609af4ed54ed5a63
MD5 cd85c75fa053954c4ae4ee338d3bcb63
SHA1 fb2fb89c667d901ef01600dae3f027c7dbfe16be
SHA512 f0d7e4732df889e6513f67e266c68bf7490c513bb78736b4fac4d90ed49040415a500ae8f0f9b696e100a92c871d5cf80fdb628bec0f42e3a531e1a636873f6d
SSDEEP 12288:utflJ50c6GeHR6Kjx288tG6rmC0tzeIiZ4fFo:ut9J6MB8gGaUtze74f+
TLSH
T123E48C16B6A801FCE1B7D179C9524912F7B1B847437297CF03A05A66AF2BAE05F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

ransomware

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	ByteBreaker V2_54596887.exe

Opens file in notepad (likely ransom note) 13 IoCs

ransomware

pid	Process
1980	NOTEPAD.EXE
1788	NOTEPAD.EXE
1080	NOTEPAD.EXE
2756	NOTEPAD.EXE
4244	NOTEPAD.EXE
1168	NOTEPAD.EXE
5116	NOTEPAD.EXE
4420	NOTEPAD.EXE
3392	NOTEPAD.EXE
5916	NOTEPAD.EXE
1356	NOTEPAD.EXE
5640	NOTEPAD.EXE
1108	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 1168	924	ByteBreaker V2_54596887.exe	90
PID 924 wrote to memory of 1108	924	ByteBreaker V2_54596887.exe	92
PID 924 wrote to memory of 5116	924	ByteBreaker V2_54596887.exe	93
PID 924 wrote to memory of 1980	924	ByteBreaker V2_54596887.exe	94
PID 924 wrote to memory of 1788	924	ByteBreaker V2_54596887.exe	95
PID 924 wrote to memory of 4420	924	ByteBreaker V2_54596887.exe	96
PID 924 wrote to memory of 3392	924	ByteBreaker V2_54596887.exe	97
PID 924 wrote to memory of 5916	924	ByteBreaker V2_54596887.exe	98
PID 924 wrote to memory of 1080	924	ByteBreaker V2_54596887.exe	99
PID 924 wrote to memory of 2756	924	ByteBreaker V2_54596887.exe	100
PID 924 wrote to memory of 1356	924	ByteBreaker V2_54596887.exe	101
PID 924 wrote to memory of 4244	924	ByteBreaker V2_54596887.exe	103
PID 924 wrote to memory of 5640	924	ByteBreaker V2_54596887.exe	104

C:\Users\Admin\AppData\Local\Temp\ByteBreaker V2_54596887.exe
"C:\Users\Admin\AppData\Local\Temp\ByteBreaker V2_54596887.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:924
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1168
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1108
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5116
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1980
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1788
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4420
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3392
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5916
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1080
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2756
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1356
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4244
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

file.txt

Path C:\Users\Admin\AppData\Local\file.txt
Size 58B
SHA256 28670869cc422165d89973d7eb9e2686d745e8721900a20f034c304bf6083b0a
MD5 397bd7bf171a3a07122118b6dca4376c
SHA1 ad7c6145b483e97c16e61150bf5721fe0ef36c0a
SHA512 5a62c4c3a47d6faa1ac0c90111d03f6aa79a7edf434753c63d6ba13d8c623f66b26c16e5cf3a9cc53974fbd495ce4e2fbf9b78aaa1512365ad6a9c16707fc2db
TLSH
T18BA002169484105D4856C64839A5168119A4214341ADE255DC218651002774610E724A
MD5 SHA1 SHA512 TLSH

Submit Download