Analysis
- user interaction
yes - max time kernel
150s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 01:54
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Tom pearl ddoser/Tompearlddoser.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
Tom pearl ddoser/Tompearlddoser.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target Tom pearl ddoser/Tompearlddoser.exe
- Size 108KB
- Sample260809-cbn6yaybmd
- SHA256 2803b74d5466845e4dc9063bd516f3679aa2a3f70a30d9e93976c212e87f6e87
- MD5 8ce68a756995deb55746dee1525edec3
- SHA1 10b1d1fc1dc4f11bef3fea1163cf68a88c29d3cf
- SHA512 f46adf3b92a43b82d0b6ea2652b42a284e25be45909e6c0529440625e7d2867460790778e80864702d56a301e2cb1202006977d8248330a33a4e2212dbbf46d5
- SSDEEP 3072:rPdGIbRRYJTG8xqR8AaP3ZNKkz8rJYB1osiFAQgD5PxzU:znvuLxqR8Aahz91osEAQMlU
- TLSH T169B35B9AA39800D8CCA18174D5225217EBF1BC58176293DF0721F3590FBBAE67F3A749
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 8 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 4808 powershell.exe 3 4808 powershell.exe 10 4808 powershell.exe 10 4808 powershell.exe 15 4808 powershell.exe 16 4808 powershell.exe 17 4808 powershell.exe 2 4808 powershell.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 4808 powershell.exe - ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
resource yara_rule behavioral2/memory/4808-18-0x0000019743C20000-0x0000019743C3C000-memory.dmp ConfuserEx - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4808 powershell.exe 4808 powershell.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1172 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4808 powershell.exe Token: SeDebugPrivilege 1172 taskmgr.exe Token: SeSystemProfilePrivilege 1172 taskmgr.exe Token: SeCreateGlobalPrivilege 1172 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1172 taskmgr.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4072 wrote to memory of 4808 4072 Tompearlddoser.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tom pearl ddoser\Tompearlddoser.exe"C:\Users\Admin\AppData\Local\Temp\Tom pearl ddoser\Tompearlddoser.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\9cb3b115.ps1"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4808
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1172
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4780
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\9cb3b115.ps1
- Size 97KB
- SHA256 ed80b6cf73733d53869bf4e1f368c4cfe1170f1330f91eb1e32050c396358b32
- MD5 7c1be965fb08e1163e37db91ecd709ef
- SHA1 d155be33f0593ad6695133ae707528f39cb185c0
- SHA512 02a16136f435718b418b749481d1045fa99f0d66c3505821c0fafda6c08881e1b39486ffa58bb5bef30e64de650ec3786fcb06ff1082246d749c359cc4b588c6
- SSDEEP 1536:ltd+L2vk63S3UELazOQ75FroneNWxwkShzDCre6mTmm5zUDWk5UodPd69MUoY7uy:lfWE7S3e5FroneNWxzSdL6M+5uoY7p
- TLSH T14CA312238057ADC99D543748231D6E8F8BC9406E1C7CCDE4A67941CB8C992F389ED95F
- MD5 SHA1 SHA512 SSDEEP TLSH