Analysis
- max time kernel
150s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 22:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c105d5d02f272d465f8c71dc2006c0fbfffab943f47b067072fc158a50a0e451.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
c105d5d02f272d465f8c71dc2006c0fbfffab943f47b067072fc158a50a0e451.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target c105d5d02f272d465f8c71dc2006c0fbfffab943f47b067072fc158a50a0e451.exe
- Size 828KB
- Sample260809-11mleawfmf
- SHA256 c105d5d02f272d465f8c71dc2006c0fbfffab943f47b067072fc158a50a0e451
- MD5 818d35216668b3de116345d0823be43d
- SHA1 9c334e3e6ed1e7c6e8e464902f737cb7c5567865
- SHA512 ac004fe0a08abf41538e86ee8633d1e8ae2faf7aac5957150fcb5022155ab3de2865175fe9e8308c6412aab76af8c1cc9f7c596655fd39cb4ef9d7c914007c3d
- SSDEEP 12288:rXc80rGME48k1jRICeaRtMLJXcBPoPaIXkKbflK4cmbv8:rXF0rxEcRICea3MGIXkKB5bv
- TLSH T10C057B56F7A614F9E873C1388A636616FAB27C150730DBEB03905A6A6F237D09D3E701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2628 main.exe - Loads dropped DLL 1 IoCs
pid Process 2628 main.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2680 c105d5d02f272d465f8c71dc2006c0fbfffab943f47b067072fc158a50a0e451.exe 2680 c105d5d02f272d465f8c71dc2006c0fbfffab943f47b067072fc158a50a0e451.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2680 wrote to memory of 2628 2680 c105d5d02f272d465f8c71dc2006c0fbfffab943f47b067072fc158a50a0e451.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\c105d5d02f272d465f8c71dc2006c0fbfffab943f47b067072fc158a50a0e451.exe"C:\Users\Admin\AppData\Local\Temp\c105d5d02f272d465f8c71dc2006c0fbfffab943f47b067072fc158a50a0e451.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\main.exe"C:\Users\Admin\AppData\Local\Temp\main.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\license.dll
- Size 242KB
- SHA256 7cf361d95713759a42be07ab92fad0d5dd725e0e43a6f7ca39215458f650150c
- MD5 624231997f56110864b3bc5ce629472e
- SHA1 426ef1e46d6714ffa0da81037f697f836124f76f
- SHA512 63280339719e000ba8edff3f4abf7be4a5c92bfe6e54fabfcfdd25bc498640802dc3c7ca6cb1795993de096a1791a4e5b7fe792eca4d80e9b136fa89baea9ef3
- SSDEEP 6144:dmtB27eYZTR9zTatzLJSarFDnXctkHb+XpAo1:dICeaRtMLJXcB
- TLSH T132346B49B7A508F9E8B7C13DC9535606EBF2B8120370DBDB03904A6A6F277E05A3E751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\main.exe
- Size 415KB
- SHA256 7cb33fd63b938317098d93d6b89955dda4510180dd34ea86f7eeb8ee4a07f8c1
- MD5 c26b5dac02757d3d8cb228177af7764f
- SHA1 85e691be84991ef21b99bd5f3dc8e7cf767aab04
- SHA512 6f2c2cea32e80eebaa33b7806920c773a1140e98771efacb3a5d158296de15da4e3bda83c17369a223740ec1210f1a52696bd0ff1ecab8f742f6097aeead1a9c
- SSDEEP 6144:OoEM2gpj4IXUP66cbfJh4wK4cmbT/IgdSi8XdBLf:OoPaIXkKbflK4cmbv8
- TLSH T132947C16FBB610E9D873C0388663B227FA713C094B745EE75754595A6F237E09E3AB00
- MD5 SHA1 SHA512 SSDEEP TLSH