9637622602cae63eec35251d24a84263bc974976b9a020857b5b85eec5caf8ca

Analysis

user interaction
yes
max time kernel
10s
max time network
12s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 06:58

Target
backseat-loader.exe
Size 14.9MB
Sample260810-hrtn9aef48
SHA256 9637622602cae63eec35251d24a84263bc974976b9a020857b5b85eec5caf8ca
MD5 a8d20060fea9502251869e0ccaf269ef
SHA1 73093e7fee998d16439d0bcd524259fe9024ead8
SHA512 48d0fa0bea9b2e7d81cb9814324431947ecbac8b661f62a450586b6c3ddcf5515c44aaff3de716132243882d7b6ad404ad2dd86b1d8da698a051ca604041efde
SSDEEP 393216:JBbsrnloIBp+UjATGsDHQl4opVnUk8Qu3AADefzrBcteL4sXRp3em:JBe1BP4NQyopVnDu3NefzdUsBQm
TLSH
T139F63369AFC572E8D4CB65785EC7259FB75830E643B059CF2A5C31CA2E63BC80B35206
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4300	backseat-loader.exe
4300	backseat-loader.exe

C:\Users\Admin\AppData\Local\Temp\backseat-loader.exe
"C:\Users\Admin\AppData\Local\Temp\backseat-loader.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4300