Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/08/2026, 04:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
inst_smt013.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
inst_smt013.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
General
- Target inst_smt013.exe
- Size 55.2MB
- Sample260805-e9dh7sde74
- SHA256 1de06a93d69aa1fcdc2f0f32cf0ec3a776d9316e32a7e379d90e09e19d808c38
- MD5 12c68f9ee5d56266b3791e2a8bca5e24
- SHA1 7924d02e10a79bf7609a4dadbc2bebc4f4a430da
- SHA512 b17076949049319de965115535e4f5e7f1cf2a79aa2ac68ae7bfe9f7f6feece9cb559056fc11cb2a4a06ea114aa783897d961b09c162929dc8e05aa130856ad2
- SSDEEP 196608:4nnmbV2qWwRNTc+u1aZfO8pP+QDhb6Z/LzEnSQ5Ps6j:SSRe9QDD
- TLSH T1FBC78406F702899AD4799338488B4F91B372ECF14AB6972323B8733D2EFA35C5E91545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4084 jpu3X9.exe - Loads dropped DLL 1 IoCs
pid Process 4084 jpu3X9.exe - Suspicious behavior: EnumeratesProcesses 38 IoCs
pid Process 2288 inst_smt013.exe 2288 inst_smt013.exe 2288 inst_smt013.exe 2288 inst_smt013.exe 2288 inst_smt013.exe 2288 inst_smt013.exe 2288 inst_smt013.exe 2288 inst_smt013.exe 2288 inst_smt013.exe 2288 inst_smt013.exe 2288 inst_smt013.exe 2288 inst_smt013.exe 2288 inst_smt013.exe 2288 inst_smt013.exe 2288 inst_smt013.exe 2288 inst_smt013.exe 2288 inst_smt013.exe 2288 inst_smt013.exe 2288 inst_smt013.exe 2288 inst_smt013.exe 2288 inst_smt013.exe 2288 inst_smt013.exe 2288 inst_smt013.exe 2288 inst_smt013.exe 2288 inst_smt013.exe 2288 inst_smt013.exe 2288 inst_smt013.exe 2288 inst_smt013.exe 2288 inst_smt013.exe 2288 inst_smt013.exe 2288 inst_smt013.exe 2288 inst_smt013.exe 4084 jpu3X9.exe 4084 jpu3X9.exe 4084 jpu3X9.exe 4084 jpu3X9.exe 4084 jpu3X9.exe 4084 jpu3X9.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 672 Process not Found
Processes
-
C:\Users\Admin\AppData\Local\Temp\inst_smt013.exe"C:\Users\Admin\AppData\Local\Temp\inst_smt013.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2288
-
C:\Users\Public\JYO34I\jpu3X9.exeC:\Users\Public\JYO34I\jpu3X9.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4084
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\JYO34I\UxEnhance64.dll
- Size 3.1MB
- SHA256 e320fffdfea885c0f439d673a389022d4a79976b238f2588ae638c7d2ba2507d
- MD5 2c641ee14468f05e01f21bf9f298838e
- SHA1 3346e062e2d7a6a0c7e210109c113f101547d5b7
- SHA512 3554a08865209ed5fb969b500cdc39e05b9a887241b1591298e4a686ee59c36407cc6958c0272f0483ca4ab47a78b33d21d06b05d8ffc50b5cd346e7097ff5cd
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+f:P9m29xx3Tiqt06ox6+z2rNNrKof
- TLSH T138E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\JYO34I\adoresd.dat
- Size 4.7MB
- SHA256 574eadf27987fd00c941c4692f747ff56232e0963f6cbf1c3816d477511fa56d
- MD5 315ff29208ae2e77730e32131c507576
- SHA1 6bb6d51dd3e87247796e3714a587563c1b2da542
- SHA512 e7ff174dcd7b507f672dd4276b173d601c008490f30efc3eaef82a870c8a681a308df8d1614e4d68191260e15e4b862ece441cacd3c954ce5784a8432581c57b
- SSDEEP 98304:Dmu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:Ku1SwOflfZPF6Ma0bsoa5+qd
- TLSH T1AA3633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\JYO34I\jpu3X9.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\JYO34I\msadox.tb
- Size 8KB
- SHA256 5f2bc8dd2ef5446b977bb9620f8cfbe8fba61a3613aff1971d471e604b55bdfa
- MD5 60dbea6fceba52dd9cdcc3aea0cfbd90
- SHA1 5fef092fcfd5c4920ed5b1e743552e4e7e54ffcf
- SHA512 ad1911c253fd5fd1a11e7f0733d8d58b1d256b716c702913a91269f89f8eca3d49ea9ea090aa3f5e874e8bcb3366e4edf5b8e79dd545968af0d0cb5495fcd7c9
- SSDEEP 192:wqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:wsZqZOXQ3uqvR2Kfzp
- TLSH T17A029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH