Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 02:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
inst_smt008.exe
Resource
win10v2004-20260513-en
34 signatures
150 seconds
Behavioral task
behavioral2
Sample
inst_smt008.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target inst_smt008.exe
- Size 55.2MB
- Sample260805-c3wp4acc35
- SHA256 08097a1511cc434670d071fad40b82dc44665f8f4c3115807fe56575f4bfe989
- MD5 a3a6ebaa2e6702b02b8b6da9eff34957
- SHA1 b1038c3bace6a6482920eb87b25ad54344f67130
- SHA512 48e7c4c1ab312cf384fe7d52fb51c2fa5978c85b8d1ebeb8da4f03b95254ff39aca6bcd5e078a243ddec87a56789d9f6d6e0a6a0ab3050e0cfd8ef3192fadfdf
- SSDEEP 196608:InnmbV2qWwRNTc+u1aZfO8pP+QDhb6Z/LzEnSQ5Ps6g:iSRe9QDA
- TLSH T19BC78406F702899AD4799338488B4F91B372ECF14AB6972323B8733D2EFA35C5E91545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4236 cT0VRj.exe - Loads dropped DLL 1 IoCs
pid Process 4236 cT0VRj.exe - Suspicious behavior: EnumeratesProcesses 38 IoCs
pid Process 5544 inst_smt008.exe 5544 inst_smt008.exe 5544 inst_smt008.exe 5544 inst_smt008.exe 5544 inst_smt008.exe 5544 inst_smt008.exe 5544 inst_smt008.exe 5544 inst_smt008.exe 5544 inst_smt008.exe 5544 inst_smt008.exe 5544 inst_smt008.exe 5544 inst_smt008.exe 5544 inst_smt008.exe 5544 inst_smt008.exe 5544 inst_smt008.exe 5544 inst_smt008.exe 5544 inst_smt008.exe 5544 inst_smt008.exe 5544 inst_smt008.exe 5544 inst_smt008.exe 5544 inst_smt008.exe 5544 inst_smt008.exe 5544 inst_smt008.exe 5544 inst_smt008.exe 5544 inst_smt008.exe 5544 inst_smt008.exe 5544 inst_smt008.exe 5544 inst_smt008.exe 5544 inst_smt008.exe 5544 inst_smt008.exe 5544 inst_smt008.exe 5544 inst_smt008.exe 4236 cT0VRj.exe 4236 cT0VRj.exe 4236 cT0VRj.exe 4236 cT0VRj.exe 4236 cT0VRj.exe 4236 cT0VRj.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 828 Process not Found 828 Process not Found
Processes
-
C:\Users\Admin\AppData\Local\Temp\inst_smt008.exe"C:\Users\Admin\AppData\Local\Temp\inst_smt008.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5544
-
C:\Users\Public\ktvP2B\cT0VRj.exe"C:\Users\Public\ktvP2B\cT0VRj.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4236
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\ktvP2B\UxEnhance64.dll
- Size 3.1MB
- SHA256 a28ac8058bc62bd1f3bb6a334968b6b25d81460f35bfad293f6715d4dc1bbff3
- MD5 7050be193f40fffaaa2e9a3e461b580d
- SHA1 e92c04e59256616f358d884c96f5e075bc7962d8
- SHA512 da4d8242358310188a59a4fac3cf5c8b02bf96be2e125c1cc0c42df2d8aa95967c89ff5be526994dfec9693fb4e405b106dfbb3a0e68a66963807cb755a877a7
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+r:P9m29xx3Tiqt06ox6+z2rNNrKor
- TLSH T1ECE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\ktvP2B\adoresd.dat
- Size 4.7MB
- SHA256 2f3f8876372051d7f074ce2c6abb99f0cc74d8361af78fdb282085bc6bd2f398
- MD5 b137a1a40ef455c4216f986d53c3b53d
- SHA1 cc5c342fb4530e1a8b0b3a4f071fc9866a5f14e7
- SHA512 8475b3736d55cfb20d683eb6a211afc176bc8e2564b2e83828e418c6b7712d3946f12b2a5a06bbf8e52350804cb7c7dd8364ea72ce85cea1719cdbe18ac8ad69
- SSDEEP 98304:imu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:Bu1SwOflfZPF6Ma0bsoa5+qd
- TLSH T1B43633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\ktvP2B\cT0VRj.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\ktvP2B\msadox.tb
- Size 8KB
- SHA256 5b527ee2c84c0c070d7003f17cf668b64f30f1fb0178b67d2690d9a29845896e
- MD5 4f9568934aa7748c30daf3bdea94760e
- SHA1 d4bf8991afff34667d51ba3743f7a1fef478f5e5
- SHA512 df0aef58980490c34b5845f5470e2b46cd3ea0bb4d2484683249e9231464d6133083c2256cac85a4937bd41976448102a533550469fcddcae35eb07071f1cb15
- SSDEEP 192:hqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:hsZqZOXQ3uqvR2Kfzp
- TLSH T1A0029E05D7A20CC7D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH