Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 02:32
Behavioral task
behavioral1
Sample
5b93ccd72e68b7eb94773df767e4b35dd74f732db364a3adb4c09ec56dfd650c.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
5b93ccd72e68b7eb94773df767e4b35dd74f732db364a3adb4c09ec56dfd650c.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 5b93ccd72e68b7eb94773df767e4b35dd74f732db364a3adb4c09ec56dfd650c.exe
- Size 1.4MB
- Sample260808-c1jmrabc22
- SHA256 5b93ccd72e68b7eb94773df767e4b35dd74f732db364a3adb4c09ec56dfd650c
- MD5 6b374b066ace0aca979fdee1b948a768
- SHA1 8ca75ef0bbc802653400a6ce58efb9a36ffb4f72
- SHA512 a4d0cada22ce10535b93192dbb3d65d20e21aca17a017ca1b2026744a35ad97071c5e5428dd13d39ebff4e74c2b258a94548a06b97f9351124609be7483c4a8b
- SSDEEP 24576:p0jb0+MGJ8a5gP7+2x/HrV0u3U9FxMDsDdayBIzDpqB9fDQVoMKjEMuC9cvv5:p/GtCPCmHriKsE/pq0oMMEMuT
- TLSH T10B6533296ADDF923C43E187968920AD75B237F056BA716FB0270D19C8F7A50C1D8B363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2128-0-0x0000000140000000-0x000000014049E000-memory.dmp upx behavioral2/memory/2128-1-0x0000000140000000-0x000000014049E000-memory.dmp upx - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2128 5b93ccd72e68b7eb94773df767e4b35dd74f732db364a3adb4c09ec56dfd650c.exe 2128 5b93ccd72e68b7eb94773df767e4b35dd74f732db364a3adb4c09ec56dfd650c.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeBackupPrivilege 2128 5b93ccd72e68b7eb94773df767e4b35dd74f732db364a3adb4c09ec56dfd650c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b93ccd72e68b7eb94773df767e4b35dd74f732db364a3adb4c09ec56dfd650c.exe"C:\Users\Admin\AppData\Local\Temp\5b93ccd72e68b7eb94773df767e4b35dd74f732db364a3adb4c09ec56dfd650c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2128