87171091a06af794fba7d090b780c13161c23ff966cd3a0db348249101dbd411

Analysis

max time kernel
150s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 11:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
87171091a06af794fba7d090b780c13161c23ff966cd3a0db348249101dbd411.exe
Size 5.7MB
Sample260808-m5ppnsvhpg
SHA256 87171091a06af794fba7d090b780c13161c23ff966cd3a0db348249101dbd411
MD5 84d84bc128a2b5390b3dcdafd4c0ac1b
SHA1 8acf1274878c6964954e80b0611d6c551a1efb07
SHA512 fd81d3ea5bb2827568bf0453489059eb70bb38f25fe322a9bfdcffc1853f814c1c098aced11f3181f9715c6c1a72bb9e6e8a159da5fa5ec6a8a2ec19d435c519
SSDEEP 49152:YF06l4ufGDQlsmgnWPVaY6bS4mzcBamujeVdOAEAAz0jjbXCD/jKJ0o:YFhJfmnuz6lmIBaKUAhAz0jjbXCD/jK
TLSH
T1F4566D26EA948982CD5D06FC56D3516007BECC87DA42E71B2AACFC673EA93314DC14DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5544	ping.exe

System Network Connections Discovery 1 TTPs 8 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
5088	netstat.exe
5164	netstat.exe
5476	netstat.exe
2364	netstat.exe
1008	netstat.exe
2832	netstat.exe
1464	netstat.exe
5864	netstat.exe

Gathers network information 2 TTPs 8 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1464	netstat.exe
5864	netstat.exe
5088	netstat.exe
5164	netstat.exe
5476	netstat.exe
2364	netstat.exe
1008	netstat.exe
2832	netstat.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5544	ping.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2300	87171091a06af794fba7d090b780c13161c23ff966cd3a0db348249101dbd411.exe
Token: SeDebugPrivilege	5088	netstat.exe
Token: SeDebugPrivilege	5164	netstat.exe
Token: SeDebugPrivilege	5476	netstat.exe
Token: SeDebugPrivilege	2364	netstat.exe
Token: SeDebugPrivilege	1008	netstat.exe
Token: SeDebugPrivilege	2832	netstat.exe
Token: SeDebugPrivilege	1464	netstat.exe
Token: SeDebugPrivilege	5864	netstat.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 5544	2300	87171091a06af794fba7d090b780c13161c23ff966cd3a0db348249101dbd411.exe	90
PID 2300 wrote to memory of 5088	2300	87171091a06af794fba7d090b780c13161c23ff966cd3a0db348249101dbd411.exe	92
PID 2300 wrote to memory of 5164	2300	87171091a06af794fba7d090b780c13161c23ff966cd3a0db348249101dbd411.exe	94
PID 2300 wrote to memory of 5476	2300	87171091a06af794fba7d090b780c13161c23ff966cd3a0db348249101dbd411.exe	96
PID 2300 wrote to memory of 2364	2300	87171091a06af794fba7d090b780c13161c23ff966cd3a0db348249101dbd411.exe	98
PID 2300 wrote to memory of 1008	2300	87171091a06af794fba7d090b780c13161c23ff966cd3a0db348249101dbd411.exe	100
PID 2300 wrote to memory of 2832	2300	87171091a06af794fba7d090b780c13161c23ff966cd3a0db348249101dbd411.exe	102
PID 2300 wrote to memory of 1464	2300	87171091a06af794fba7d090b780c13161c23ff966cd3a0db348249101dbd411.exe	104
PID 2300 wrote to memory of 5864	2300	87171091a06af794fba7d090b780c13161c23ff966cd3a0db348249101dbd411.exe	106

C:\Users\Admin\AppData\Local\Temp\87171091a06af794fba7d090b780c13161c23ff966cd3a0db348249101dbd411.exe
"C:\Users\Admin\AppData\Local\Temp\87171091a06af794fba7d090b780c13161c23ff966cd3a0db348249101dbd411.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SYSTEM32\ping.exe
  "ping" baidu.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5544
- C:\Windows\SYSTEM32\netstat.exe
  "netstat" -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:5088
- C:\Windows\SYSTEM32\netstat.exe
  "netstat" -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:5164
- C:\Windows\SYSTEM32\netstat.exe
  "netstat" -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:5476
- C:\Windows\SYSTEM32\netstat.exe
  "netstat" -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:2364
- C:\Windows\SYSTEM32\netstat.exe
  "netstat" -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:1008
- C:\Windows\SYSTEM32\netstat.exe
  "netstat" -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:2832
- C:\Windows\SYSTEM32\netstat.exe
  "netstat" -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:1464
- C:\Windows\SYSTEM32\netstat.exe
  "netstat" -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:5864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2300-0-0x00007FF86229F000-0x00007FF8622A0000-memory.dmp

Download

memory/2300-2-0x0000024AA8420000-0x0000024AA89D8000-memory.dmp

Download

memory/2300-1-0x00007FF862110000-0x00007FF862AB4000-memory.dmp

Download

memory/2300-3-0x00007FF862110000-0x00007FF862AB4000-memory.dmp

Download

memory/2300-4-0x00007FF862110000-0x00007FF862AB4000-memory.dmp

Download

memory/2300-5-0x00007FF862110000-0x00007FF862AB4000-memory.dmp

Download

memory/2300-6-0x00007FF862110000-0x00007FF862AB4000-memory.dmp

Download

memory/2300-7-0x00007FF862110000-0x00007FF862AB4000-memory.dmp

Download

memory/2300-10-0x0000024AC31E0000-0x0000024AC33A2000-memory.dmp

Download

memory/2300-12-0x00007FF862110000-0x00007FF862AB4000-memory.dmp

Download

memory/2300-13-0x00007FF862110000-0x00007FF862AB4000-memory.dmp

Download

memory/2300-14-0x00007FF862110000-0x00007FF862AB4000-memory.dmp

Download

memory/2300-15-0x00007FF862110000-0x00007FF862AB4000-memory.dmp

Download

memory/2300-16-0x0000024AC8110000-0x0000024AC8638000-memory.dmp

Download

memory/2300-17-0x00007FF862110000-0x00007FF862AB4000-memory.dmp

Download

memory/2300-19-0x0000024AC7E80000-0x0000024AC7E88000-memory.dmp

Download

memory/2300-20-0x00007FF862110000-0x00007FF862AB4000-memory.dmp

Download

memory/2300-21-0x0000024AC7F20000-0x0000024AC7F5E000-memory.dmp

Download

memory/2300-22-0x00007FF862110000-0x00007FF862AB4000-memory.dmp

Download

memory/2300-23-0x0000024AC7ED0000-0x0000024AC7EDE000-memory.dmp

Download

memory/2300-24-0x00007FF862110000-0x00007FF862AB4000-memory.dmp

Download

memory/2300-26-0x00007FF862110000-0x00007FF862AB4000-memory.dmp

Download

memory/2300-27-0x00007FF862110000-0x00007FF862AB4000-memory.dmp

Download

memory/2300-28-0x00007FF862110000-0x00007FF862AB4000-memory.dmp

Download

memory/2300-31-0x00007FF862110000-0x00007FF862AB4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads