b83976f2fb570268e3b28e33dfcef679dfd641ebd576ff2956cd6eb7ce3fe666

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b83976f2fb570268e3b28e33dfcef679dfd641ebd576ff2956cd6eb7ce3fe666.exe
Size 5.0MB
Sample260809-mtklkswekc
SHA256 b83976f2fb570268e3b28e33dfcef679dfd641ebd576ff2956cd6eb7ce3fe666
MD5 b8e7048780d4959fac186bf5d953c28c
SHA1 edacb01f94cc5f0f578f20c8ceda1066034c3c68
SHA512 f41e68372f300d31a079d51fc2b71ebf0cdd11f113c61fe0803341e5abcb669a348876cb69db5c767b1ce5c836e190102988ccf21e15e7f1dc01dfdde0d68d1d
SSDEEP 98304:u/jHxQ3fuAsY61nxSClmfno6KTaiwRhQdhTGom4Vw/zxHHm0jIghQLG3:QLxQ3JsYSBlmvo6WaQdUoEzxHH3B
TLSH
T1E93633E7A9C61435D493C3B4538770BCB1347B969A50FD87B2CDA989CEA3E21543E382
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution persistence

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4212 created 3940	4212	LockAppHost14a02b.exe	81

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
4212	LockAppHost14a02b.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4212 set thread context of 6636	4212	LockAppHost14a02b.exe	96

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5792	sc.exe
5072	sc.exe
4136	sc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
248	b83976f2fb570268e3b28e33dfcef679dfd641ebd576ff2956cd6eb7ce3fe666.exe
248	b83976f2fb570268e3b28e33dfcef679dfd641ebd576ff2956cd6eb7ce3fe666.exe
4212	LockAppHost14a02b.exe
4212	LockAppHost14a02b.exe
4212	LockAppHost14a02b.exe
4212	LockAppHost14a02b.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
248	b83976f2fb570268e3b28e33dfcef679dfd641ebd576ff2956cd6eb7ce3fe666.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4212	LockAppHost14a02b.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 248 wrote to memory of 4136	248	b83976f2fb570268e3b28e33dfcef679dfd641ebd576ff2956cd6eb7ce3fe666.exe	89
PID 248 wrote to memory of 5792	248	b83976f2fb570268e3b28e33dfcef679dfd641ebd576ff2956cd6eb7ce3fe666.exe	91
PID 248 wrote to memory of 5072	248	b83976f2fb570268e3b28e33dfcef679dfd641ebd576ff2956cd6eb7ce3fe666.exe	93
PID 4212 wrote to memory of 6636	4212	LockAppHost14a02b.exe	96

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:3940
- C:\Users\Admin\AppData\Local\Temp\b83976f2fb570268e3b28e33dfcef679dfd641ebd576ff2956cd6eb7ce3fe666.exe
  "C:\Users\Admin\AppData\Local\Temp\b83976f2fb570268e3b28e33dfcef679dfd641ebd576ff2956cd6eb7ce3fe666.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:248
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" delete "MicrosoftEdgeUpdateTaskMachine_3aa5"
    3⤵
    - Launches sc.exe
    PID:4136
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" create "MicrosoftEdgeUpdateTaskMachine_3aa5" binpath= "C:\ProgramData\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:5792
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" start "MicrosoftEdgeUpdateTaskMachine_3aa5"
    3⤵
    - Launches sc.exe
    PID:5072
- C:\Windows\System32\nslookup.exe
  "C:\Windows\System32\nslookup.exe"
  2⤵
  PID:6636

C:\ProgramData\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exe
C:\ProgramData\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

LockAppHost14a02b.exe

Path C:\ProgramData\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exe
Size 5.0MB
SHA256 b83976f2fb570268e3b28e33dfcef679dfd641ebd576ff2956cd6eb7ce3fe666
MD5 b8e7048780d4959fac186bf5d953c28c
SHA1 edacb01f94cc5f0f578f20c8ceda1066034c3c68
SHA512 f41e68372f300d31a079d51fc2b71ebf0cdd11f113c61fe0803341e5abcb669a348876cb69db5c767b1ce5c836e190102988ccf21e15e7f1dc01dfdde0d68d1d
SSDEEP 98304:u/jHxQ3fuAsY61nxSClmfno6KTaiwRhQdhTGom4Vw/zxHHm0jIghQLG3:QLxQ3JsYSBlmvo6WaQdUoEzxHH3B
TLSH
T1E93633E7A9C61435D493C3B4538770BCB1347B969A50FD87B2CDA989CEA3E21543E382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-9-0x0000000140239000-0x00000001403E9000-memory.dmp

Download

memory/248-6-0x00000000005A0000-0x00000000005A1000-memory.dmp

Download

memory/248-7-0x0000000140000000-0x00000001408E7000-memory.dmp

Download

memory/248-5-0x0000000140000000-0x00000001408E7000-memory.dmp

Download

memory/248-1-0x00007FF877790000-0x00007FF877792000-memory.dmp

Download

memory/248-0-0x0000000140239000-0x00000001403E9000-memory.dmp

Download

memory/248-10-0x0000000140000000-0x00000001408E7000-memory.dmp

Download

memory/248-2-0x0000000140000000-0x00000001408E7000-memory.dmp

Download

memory/4212-12-0x0000000140000000-0x00000001408E7000-memory.dmp

Download

memory/4212-22-0x0000000140000000-0x00000001408E7000-memory.dmp

Download

memory/4212-24-0x0000000140000000-0x00000001408E7000-memory.dmp

Download

memory/6636-18-0x0000000140000000-0x0000000140231000-memory.dmp

Download