4b788dc59db568205a6180f30bae301d6107896ee3e80c1edca4017c9bee5bed

Analysis

max time kernel
298s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SacramentoZum.exe
Size 2.1MB
Sample260804-w48wlaxdpc
SHA256 4b788dc59db568205a6180f30bae301d6107896ee3e80c1edca4017c9bee5bed
MD5 25d4dc16ff90dad6221c7846336f357f
SHA1 03e70215222767e6fde4a379b7979d31bf5f12ef
SHA512 a8f2312b5bad3e09dd913bc0197c49f26c62e31b9464ded2b440b92746f567fd737424f2da6997b9284abc0b3cd48f658f85d575b42adbeb700c2f4acc60f00b
SSDEEP 49152:2FgFI1VciQbuls6SVZO4/AYMqvainRcchDuBSwujCxW3QsZ6BveK:AZVM03SVZSYMqvaiRcchDsSbjWW3nZCe
TLSH
T15BA52362A3D50576D8FAAB3C86B642AB17317E6D567C5D8B13C4C81E1F33A918A3034F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
6036	AutoIt3.exe
5620	AutoIt3.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 6036 set thread context of 5620	6036	AutoIt3.exe	92

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3516	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
6036	AutoIt3.exe
6036	AutoIt3.exe
6036	AutoIt3.exe
6036	AutoIt3.exe
6036	AutoIt3.exe
6036	AutoIt3.exe
6036	AutoIt3.exe
6036	AutoIt3.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
6036	AutoIt3.exe
6036	AutoIt3.exe
6036	AutoIt3.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
6036	AutoIt3.exe
6036	AutoIt3.exe
6036	AutoIt3.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 3516	4192	SacramentoZum.exe	89
PID 4192 wrote to memory of 6036	4192	SacramentoZum.exe	91
PID 6036 wrote to memory of 5620	6036	AutoIt3.exe	92
PID 6036 wrote to memory of 5620	6036	AutoIt3.exe	92
PID 6036 wrote to memory of 5620	6036	AutoIt3.exe	92

C:\Users\Admin\AppData\Local\Temp\SacramentoZum.exe
"C:\Users\Admin\AppData\Local\Temp\SacramentoZum.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Windows\SYSTEM32\ipconfig.exe
  ipconfig.exe /?syndrome accessed locations guy msgstr bibliography wound
  2⤵
  - Gathers network information
  PID:3516
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Basename.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:6036
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    PID:5620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
Size 1.0MB
SHA256 92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45
MD5 8fa52f316c393496f272357191db6deb
SHA1 b1ff3d48a3946ca7786a84e4a832617cd66fa3b9
SHA512 c81da97d6980d6a5aa612070477950a1386239bb919e762f7870bccd459a03da48f8f169910b91f3827c6cfef50471569c9e0c9ff2ceb897904d81840c087d51
SSDEEP 24576:5TC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBB:5+6AqSPyC+NltpScpzbtvpJoMQSq/jre
TLSH
T1FC357D0A23A4419EFEA7F176D617C60BD7B1784A0376962F02A46B726F337711A1E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Basename.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Basename.a3x
Size 1.5MB
SHA256 235eb6c67d041c6e1d82645ba0826d9868c84b1e09b12936c84327ca4d1f069e
MD5 554c2c8a125781c3ce28fcbe34b00d11
SHA1 1d7915f81342c2afbd7d0be299c5e3ada69011b8
SHA512 e3431048a08e18cbbd9ddcb32a0fcffa54858208a830fc27b862916afdcbc31c6bfec24f283255a963b919c34b436f4e2b2a889a28be245534b75fa5e3543e14
SSDEEP 49152:ymchv917UmSVaOPaAyMqV1JCBlcehji4ct:ym2FTSVaoyMqV1JQlcehW4ct
TLSH
T1327533EAF00A5A7E48FA793E4315127F3602767C14EC8D214A9DC90E0AB7726C9617DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5620-10-0x00000140180C0000-0x0000014018197000-memory.dmp

Download

memory/5620-11-0x00000140180C0000-0x0000014018197000-memory.dmp

Download

memory/6036-7-0x00007FFCE8A80000-0x00007FFCE8CE3000-memory.dmp

Download

memory/6036-8-0x000001E5C56B0000-0x000001E5C56B1000-memory.dmp

Download