Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 06:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Payment_Notification_20260804724.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Payment_Notification_20260804724.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target Payment_Notification_20260804724.exe
- Size 3.4MB
- Sample260804-gv5egseb56
- SHA256 609c95b0b3d7ced9d69347b97fd860cc9ba4a05ac8137729582949b9cc50b0b7
- MD5 ecd782e2dd348280361f32eb861e0e64
- SHA1 3f24e2a43c6f24955d9098a42935fab027d49c5a
- SHA512 99d29fdc29074fb430de8389759f3285fe9282dc1c6286911e5b60e0b3fb347040b8da723944379bb69eb7f126074d5ec3871d835c6e3bdd60d6c84c08e196c0
- SSDEEP 49152:Q8rHsrvfPl2oiPJtlDpsbqyOzwCBemWY0HvmGCp6DXBTl:Q8ArHN8HwPY0HvmGZXBTl
- TLSH T190F58D07BCA408E9C0AE9371C9B655963B75BC480B3267EB2B50B6783FB2BD05D79704
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Windows security bypass 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions Payment_Notification_20260804724.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths Payment_Notification_20260804724.exe - Downloads MZ/PE file 1 IoCs
flow pid Process 18 3980 Payment_Notification_20260804724.exe - Executes dropped EXE 2 IoCs
pid Process 4444 STProcessMonitorDriver.sys 3700 BdApiUtil64.sys - Windows security modification 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths Payment_Notification_20260804724.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions Payment_Notification_20260804724.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions Payment_Notification_20260804724.exe - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 raw.githubusercontent.com 18 raw.githubusercontent.com - Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe 3980 Payment_Notification_20260804724.exe - Suspicious behavior: LoadsDriver 10 IoCs
pid Process 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment_Notification_20260804724.exe"C:\Users\Admin\AppData\Local\Temp\Payment_Notification_20260804724.exe"1⤵
- Windows security bypass
- Downloads MZ/PE file
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
PID:3980
-
C:\Users\Admin\AppData\Local\Microsoft\Update\STProcessMonitorDriver.sysC:\Users\Admin\AppData\Local\Microsoft\Update\STProcessMonitorDriver.sys1⤵
- Executes dropped EXE
PID:4444
-
C:\Users\Admin\AppData\Local\Microsoft\Update\BdApiUtil64.sysC:\Users\Admin\AppData\Local\Microsoft\Update\BdApiUtil64.sys1⤵
- Executes dropped EXE
PID:3700
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Update\BdApiUtil64.sys
- Size 114KB
- SHA256 47ec51b5f0ede1e70bd66f3f0152f9eb536d534565dbb7fcc3a05f542dbe4428
- MD5 ced47b89212f3260ebeb41682a4b95ec
- SHA1 148c0cde4f2ef807aea77d7368f00f4c519f47ef
- SHA512 d6c640464258bca2e937f04543be2944b622dbd3d229ac6719ab6c1fac0881e8dc0f77b42f0315aeba985f14c6e073af423110bda527558cd460bcaab9d71560
- SSDEEP 768:0MdM/AcPDiFhlPqbgKq0qC9bheG8FHrtjBUQEEt11l11e6O6yKo/Jqq0nGxobqkD:0LShhKYSdgpjNEEaB0BEj+9QvUb4obB
- TLSH T171B3D598D3315286D85B8272C9526791BF70F3707361E39F829251BE1D47FEB1EBA208
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Update\STProcessMonitorDriver.sys
- Size 34KB
- SHA256 70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b
- MD5 485a04675df7cf40a8865706e003eb25
- SHA1 711ef221526997039e804a18db9647c91680bbe2
- SHA512 f4bfd8c2056ccc08012cc35a4480eea5f91f43d69872dd65e935d6224ee56eca0a017cca1d088245440a3ceeb129fc90fbef4c1a30550de08b6102a7cf526350
- SSDEEP 768:fag4/W+9Nz53T+rBORCDItmhcK6OpmlQu9lcsD/9z0y:CgGzVGORWItmhcK6OpQN9lcEz0y
- TLSH T1A1F24CC072EC48C5E8AA9974E555D647AAF0F6420310D9FF46D0C1585F277C2EE3D2BA
- MD5 SHA1 SHA512 SSDEEP TLSH