Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 13:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SacredStep_BETA_v2.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
SacredStep_BETA_v2.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target SacredStep_BETA_v2.exe
- Size 444KB
- Sample260809-q58dkayflb
- SHA256 526b85947cf0fba1df3e14ce8a3a7b5195174c291bf4402832066d770d786481
- MD5 06616776fb47f741e48fc0b492e1a2d3
- SHA1 9df433a7c21ef802b2ee4d0548ee57075a370475
- SHA512 7499f9ad8435102a743f45871ca3daff30eb33d48e142f92dc996ba2549a6b9e2866e4258ec585455f558197178169a7e126009ee5de380c7a94c4bf3e7855ef
- SSDEEP 12288:jJaJMaDvNtKqeVB3Iu5PulGYFBLqvqtNxWNjh45:jJaiQNo3IuYlzrqCtyNdY
- TLSH T1CEA4E16BB6E839F6E4B7527DC0631807A7267C760B549BCB42D013942E637E08D3BB52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2480 run_1ef91af1.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe 2480 run_1ef91af1.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4256 wrote to memory of 2480 4256 SacredStep_BETA_v2.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\SacredStep_BETA_v2.exe"C:\Users\Admin\AppData\Local\Temp\SacredStep_BETA_v2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\SacredStep\run_1ef91af1.exe"C:\Users\Admin\AppData\Local\SacredStep\run_1ef91af1.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2480
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\SacredStep\run_1ef91af1.exe
- Size 307KB
- SHA256 953caa3748bd07123f77a55a4525b49a33068523efe81476db5bbd93d8ce430c
- MD5 d049a79c374efeef6f8848ed148fc0b1
- SHA1 68175964c6386259209e0e71f0e04aac2b3f6c67
- SHA512 4dd7fe15f1fc69bf39e9623c862a8f9c4dd41fe19c9bb68f7ea53db7f7e943bef304ee9ea17cff66f83bb1f5aabe80c9f1972c76579288b530adddc2e42c2f4f
- SSDEEP 6144:o4/AWw/BqFcuJZ0tNRpQsDxIAyS4ld74d4HI3iAZg7GKMQ:F//O8JZTmd4onZcGM
- TLSH T112648D11E7A521FDE967C67CCA53A807EB3278410764DADB43608A972F37AD04E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH