09f7280a80e64f1d1289708c48de349906cc9797bae5877420421bbba0078547

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 17:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
09f7280a80e64f1d1289708c48de349906cc9797bae5877420421bbba0078547.exe
Size 5.0MB
Sample260807-v6dmssttet
SHA256 09f7280a80e64f1d1289708c48de349906cc9797bae5877420421bbba0078547
MD5 c7df239e8fef578e1ff11978e584b907
SHA1 6a954dc2fedf9a3a53b7e96fe02ac15f968c04da
SHA512 62a31756a3ec500f31b021ceeb6ae0fe7f420a0db80e954376f90102e79662741343a2f12f0f19e40877e4c5940e618a7d6e4a772949493e79dc975f621b87ec
SSDEEP 98304:h3myteV+wf2R/8HGVKbcHzFW4w5xQ4d6OsBhVMJ9gfK:h/eVP9HEK/9d6MJ9Y
TLSH
T14236CF12FA804072E5A3413882BAAB7B997EBD30173485C763E41DB94E316D17B3E75B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\_SwRMbNFNqd.sys	09f7280a80e64f1d1289708c48de349906cc9797bae5877420421bbba0078547.exe
File created	C:\Windows\System32\drivers\SlwMg6XBKIJ7.sys	09f7280a80e64f1d1289708c48de349906cc9797bae5877420421bbba0078547.exe

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\_SwRMbNFNqd\ImagePath = "system32\\DRIVERS\\_SwRMbNFNqd.sys"	09f7280a80e64f1d1289708c48de349906cc9797bae5877420421bbba0078547.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SlwMg6XBKIJ7\ImagePath = "system32\\DRIVERS\\SlwMg6XBKIJ7.sys"	09f7280a80e64f1d1289708c48de349906cc9797bae5877420421bbba0078547.exe

Executes dropped EXE 2 IoCs

pid	Process
360	3ADC.tmp
2712	3B6A.tmp

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	09f7280a80e64f1d1289708c48de349906cc9797bae5877420421bbba0078547.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
2592	09f7280a80e64f1d1289708c48de349906cc9797bae5877420421bbba0078547.exe
2592	09f7280a80e64f1d1289708c48de349906cc9797bae5877420421bbba0078547.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2592	09f7280a80e64f1d1289708c48de349906cc9797bae5877420421bbba0078547.exe
Token: SeShutdownPrivilege	2592	09f7280a80e64f1d1289708c48de349906cc9797bae5877420421bbba0078547.exe
Token: SeDebugPrivilege	2592	09f7280a80e64f1d1289708c48de349906cc9797bae5877420421bbba0078547.exe
Token: SeDebugPrivilege	360	3ADC.tmp
Token: SeDebugPrivilege	2592	09f7280a80e64f1d1289708c48de349906cc9797bae5877420421bbba0078547.exe
Token: SeLoadDriverPrivilege	2592	09f7280a80e64f1d1289708c48de349906cc9797bae5877420421bbba0078547.exe
Token: SeDebugPrivilege	2712	3B6A.tmp

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 360	2592	09f7280a80e64f1d1289708c48de349906cc9797bae5877420421bbba0078547.exe	89
PID 2592 wrote to memory of 2712	2592	09f7280a80e64f1d1289708c48de349906cc9797bae5877420421bbba0078547.exe	90

C:\Users\Admin\AppData\Local\Temp\09f7280a80e64f1d1289708c48de349906cc9797bae5877420421bbba0078547.exe
"C:\Users\Admin\AppData\Local\Temp\09f7280a80e64f1d1289708c48de349906cc9797bae5877420421bbba0078547.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Users\Admin\AppData\Local\Temp\3ADC.tmp
  "C:\Users\Admin\AppData\Local\Temp\3ADC.tmp" 668
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:360
- C:\Users\Admin\AppData\Local\Temp\3B6A.tmp
  "C:\Users\Admin\AppData\Local\Temp\3B6A.tmp" 688
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3ADC.tmp

Path C:\Users\Admin\AppData\Local\Temp\3ADC.tmp
Size 463KB
SHA256 ebb05a145d2947de499726145b64e40e178fae180ae9c3627a63c22cf911081c
MD5 37061bfc4c80798dc0c1b0a7c8617365
SHA1 566fdab57c256a3e0e07cf0de7df8f1f95272bb2
SHA512 463daebac420e241066048b964ebaf0d78d699d9d674507294c259c2275fdb2cea4aa114c74f5409b8a86c37410b7a5daf580a7c28d53d27a87b95b1d3792207
SSDEEP 12288:Ceq98eSx5cA1zXpDm649VCClXyctmS5V2NDUuFxkO:q9Fka8Xpe9VCClXyctmS5V2NIuFxkO
TLSH
T155A48CD5779009F9D177C23CC9920A16E6B27826076097CF03B496BA1F237E29E3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2592-0-0x00000000005F0000-0x0000000000B20000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads