Analysis
- max time kernel
150s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 14:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SacredStep_BETA.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
SacredStep_BETA.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target SacredStep_BETA.exe
- Size 393KB
- Sample260807-repdfaztbv
- SHA256 d286314ddc725e145e70206eff6c47bcb5f4ccb8021d8e09bafdb784cefa8185
- MD5 01a53b11abb91dccb779593e05bfc3d6
- SHA1 bc8a3db6405b7e32e6997060d171cdb0764b20a1
- SHA512 94f5ff7128a41ff0063ec221bf6f69a6e451c80a40cf95a582fe4c10704a673b70edf024aebbdacfbc80584ccadabe02ea7d6e54dcb244c7e913a57cc9209105
- SSDEEP 12288:ZJaJMaDvv3EunYGkeOyl4J64RgVFJyKuL+:ZJaiW3JnTJOyl4FqH/
- TLSH T13884E14272E831FCF5B36ABAC7810A04AB76FD3617254BEF4764E2275E536C19C3A604
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3320 run_1958f884.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe 3320 run_1958f884.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5888 wrote to memory of 3320 5888 SacredStep_BETA.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\SacredStep_BETA.exe"C:\Users\Admin\AppData\Local\Temp\SacredStep_BETA.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Users\Admin\AppData\Local\SacredStep\run_1958f884.exe"C:\Users\Admin\AppData\Local\SacredStep\run_1958f884.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3320
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\SacredStep\run_1958f884.exe
- Size 256KB
- SHA256 716dab463bebd8cc4df6a5736305dd55b534c1713440ad449c22090541e7ecce
- MD5 8a19a1d70b720631fa7bd7d542dc5c89
- SHA1 72e09ddea184dd67aec7d5f83230994f31dbf806
- SHA512 47770355bcf04fda984fca0a0e5363e60de358c7e25989189c6f65ca4056c43414870cdebd6b4883dc34363f50ef521c6a9824a9b19a87c9a045c50e3c5c492c
- SSDEEP 6144:iSvXthHX3gIn7R+o1ON2w7bKEBbagwu7v7J0I3BRX5:R/n3Ht6KEBugBv72KB
- TLSH T144447C14FBA50CF9E967C57DCA429905EB737C410361EADB03908AA65F33AD49E3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH