7dab678c842a56ebeef699d1d7c3e0171f44c9ffc3075f621c3c3202ae2e34a4

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7dab678c842a56ebeef699d1d7c3e0171f44c9ffc3075f621c3c3202ae2e34a4.exe
Size 3.6MB
Sample260808-yleadacr3z
SHA256 7dab678c842a56ebeef699d1d7c3e0171f44c9ffc3075f621c3c3202ae2e34a4
MD5 25940fc940f46330203632d8050b2ede
SHA1 7a5aec46f3d981893a1251ff5104eb59e9e90db1
SHA512 e281cb35325c24b13457f159a19008dcdd12806edca789137fc5e0aacb2bf9a889aff4ab0a2250636a0a4d7d333a28a295b02640ac772e92e8b24d7c0d057399
SSDEEP 49152:7sbr1yKZ++uGmIAStLTvW5fDl2BikOABJ8vGsXRtrtwkorSZ9z2nTz3NDfATJi6W:mIIAStLTvyR2BiXsAKDfAl4m
TLSH
T1F9067DCBFD33C257C298A1B553CC97ECF95C44284A9868B11398FAF17422F7862995CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	8ZB3CKRqSe1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\8ZB3CKRqSe1 = "C:\\Users\\Admin\\AppData\\Roaming\\NBREN5N\\U31rgGScJ_t9CbsVgm\\8ZB3CKRqSe1.exe"	8ZB3CKRqSe1.exe

Executes dropped EXE 1 IoCs

pid	Process
2512	8ZB3CKRqSe1.exe

Loads dropped DLL 2 IoCs

pid	Process
2512	8ZB3CKRqSe1.exe
2512	8ZB3CKRqSe1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8ZB3CKRqSe1.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2512	8ZB3CKRqSe1.exe
2512	8ZB3CKRqSe1.exe
2512	8ZB3CKRqSe1.exe
2512	8ZB3CKRqSe1.exe
2512	8ZB3CKRqSe1.exe
2512	8ZB3CKRqSe1.exe
2512	8ZB3CKRqSe1.exe
2512	8ZB3CKRqSe1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2512	8ZB3CKRqSe1.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2512	8ZB3CKRqSe1.exe
2512	8ZB3CKRqSe1.exe
2512	8ZB3CKRqSe1.exe
2512	8ZB3CKRqSe1.exe
2512	8ZB3CKRqSe1.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 4932	752	7dab678c842a56ebeef699d1d7c3e0171f44c9ffc3075f621c3c3202ae2e34a4.exe	89
PID 4932 wrote to memory of 2512	4932	7dab678c842a56ebeef699d1d7c3e0171f44c9ffc3075f621c3c3202ae2e34a4.exe	90

C:\Users\Admin\AppData\Local\Temp\7dab678c842a56ebeef699d1d7c3e0171f44c9ffc3075f621c3c3202ae2e34a4.exe
"C:\Users\Admin\AppData\Local\Temp\7dab678c842a56ebeef699d1d7c3e0171f44c9ffc3075f621c3c3202ae2e34a4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:752
- C:\Users\Admin\AppData\Local\Temp\7dab678c842a56ebeef699d1d7c3e0171f44c9ffc3075f621c3c3202ae2e34a4.exe
  C:\Users\Admin\AppData\Local\Temp\7dab678c842a56ebeef699d1d7c3e0171f44c9ffc3075f621c3c3202ae2e34a4.exe 44073D075B07520774076207750774075B07460763076A076E0769075B0746077707770743076607730766075B075507680766076A076E07690760075B0749074507550742074907320749075B07520734073607750760074007540764074D07580773073E07440765077407510760076A075B073F075D074507340744074C0755077607540762073607--a\k\a`
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Users\Admin\AppData\Roaming\NBREN5N\U31rgGScJ_t9CbsVgm\8ZB3CKRqSe1.exe
    "C:\Users\Admin\AppData\Roaming\NBREN5N\U31rgGScJ_t9CbsVgm\8ZB3CKRqSe1.exe"
    3⤵
    - Adds policy Run key to start application
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8ZB3CKRqSe1.exe

Path C:\Users\Admin\AppData\Roaming\NBREN5N\U31rgGScJ_t9CbsVgm\8ZB3CKRqSe1.exe
Size 1.3MB
SHA256 488eeeb8ced8c92e25b80ecc82f5ec16b1370211c181c3d109d89e8661ed33bc
MD5 1a6d39d3098cd521de8ce998a34f4856
SHA1 e32160cba7720aa3b627038065ace4af39f5280a
SHA512 53a408c68eddf3b25d1aa35f18095de185fa914bab2748401b7778eea656be054d8358d75dfd16c10264268f80e756fb770af9bbd8c1a9209dc2aadc0a4485fe
SSDEEP 24576:h8MlzWQqwVVeJtpRo46gxwuLkUhXL7rEpn1w7c+0mcAxuTZ30G4FcJfARo1tHTaq:CIyQ7VgJ5+n1nKorZqX4
TLSH
T16C559D51FB93C1F2C8270470525DA3BE8A3867161B2C99E7F7E06E1DE8B23D1993614E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8ZB3CKRqSe1.txt

Path C:\Users\Admin\AppData\Roaming\NBREN5N\U31rgGScJ_t9CbsVgm\8ZB3CKRqSe1.txt
Size 155B
SHA256 a3cfdfb3ecbf3b3e51f35233fd1a27c8a9118f4c2acd1e12ada3fa0759dba004
MD5 05d5a80aeae84232a9be37663e000dc0
SHA1 c3950990fc5997aa6aa71ca25f1f1bff0dd7338a
SHA512 4b149ed699e63614f192173a2f264d840c386600a4ea1adf89a24e2195db76fc221fb89becbd5c2ff4edb2f4b08caa3b9bd88097967e5384b04ee3123cbf687d
TLSH
T12AC0CCA8A8ABE280C08A0880C30E2C8303283C8020F822F82008230883A020A38222A2
MD5 SHA1 SHA512 TLSH

Submit Download

BugTrap.dll

Path C:\Users\Admin\AppData\Roaming\NBREN5N\U31rgGScJ_t9CbsVgm\BugTrap.dll
Size 1.7MB
SHA256 d526dbdeccbfe3681b0a5ee061d7c5442a7f95fa65f849d232453cf0f93795a7
MD5 c41dddbd73cb88e9ed41f4bd2e857d96
SHA1 a43a60678195260f99c2e3b911f334e33face737
SHA512 113fe059cdac08d239a25f4a8b42678048e1c48b63d344946a15623bc00262c3e4b31f549a33c34358dd7c5d2a33f89780db191204c7cfa189e04a3c2378ab62
SSDEEP 24576:Rky2vSD1CPwDvt3uF+9xyLCSFyC/VWXFBroy+y:Rkdu1CPwDvt3uF+94CSUCsXFBoQ
TLSH
T12B85F9B02C499B52F91724B5582C8D5336343B2F8B3A69CB3B48B53314655FBF93389A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mss32.dll

Path C:\Users\Admin\AppData\Roaming\NBREN5N\U31rgGScJ_t9CbsVgm\mss32.dll
Size 338KB
SHA256 d0db426ebac97dc410b5130c9c74d19bc04151236df85b012823d6cb3d7fb87c
MD5 2552e9cffd352ff5b939d88af6fc6b61
SHA1 ceaab7f1e0fc1cf2a8257caa7036dca2ee79da92
SHA512 4f8f142a345abc2a34d1095c2c795bce71fc36e065fb49c44e0b7839444d9b06ad828ace60917d97b719c3f7ddc246b0ea3458e2494f0fda97c09b06573f7c39
SSDEEP 6144:evUQg7b56gxa2OZ8ahmfm1Anx+438QmxMWoN4aHrmtcP:ev/g7brxan0munRRShHaHrmtc
TLSH
T1C6744B60A58042B1C9DA3D73B92E6B3FFEBC8B58411D089BA689CC611D33595B30F75B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2512-15-0x0000000010000000-0x0000000010068000-memory.dmp

Download

memory/2512-17-0x0000000005600000-0x00000000056E7000-memory.dmp

Download

memory/2512-19-0x0000000005600000-0x00000000056E7000-memory.dmp

Download

memory/2512-20-0x0000000006F70000-0x000000000718C000-memory.dmp

Download

memory/2512-24-0x0000000007910000-0x0000000007A85000-memory.dmp

Download

memory/2512-26-0x0000000007BB0000-0x0000000007C9B000-memory.dmp

Download

memory/2512-28-0x0000000006F70000-0x000000000718C000-memory.dmp

Download

memory/2512-29-0x0000000007A90000-0x0000000007AE2000-memory.dmp

Download