Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 10:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
da20d51b796c769809b57b535692d37eb1c8b09bfa169aec78707675c8896664.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
da20d51b796c769809b57b535692d37eb1c8b09bfa169aec78707675c8896664.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target da20d51b796c769809b57b535692d37eb1c8b09bfa169aec78707675c8896664.exe
- Size 266KB
- Sample260810-l875rawfkc
- SHA256 da20d51b796c769809b57b535692d37eb1c8b09bfa169aec78707675c8896664
- MD5 981ba0f29bc0633b349f91f5d5effa1a
- SHA1 3f5474dc32035937887e9847e921ea90d0600c87
- SHA512 140ea180b8a484dd32cbf89aacf6a4db489e0a6150156d0fbd32894b813f774f470bb33b7be4923b1d247d75ec422d6c7ad8d89252962a32f8deeee69daed076
- SSDEEP 3072:PGj3kDLwsDqUjm0QusJutthQXOVg0aMO471MfJkcJhaM1b+PH2y+tSe8PezFSUAf:PGIDVU0xUYhK6CxEaoXDsRguamUNZX
- TLSH T118440A1BB39368F8C667803882F79B72B532B4150334BF6F4794E7312E61D654E2DAA4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\TrojanSimDemo = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\da20d51b796c769809b57b535692d37eb1c8b09bfa169aec78707675c8896664.exe\" --quiet" da20d51b796c769809b57b535692d37eb1c8b09bfa169aec78707675c8896664.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\system32\TrojanSim_probe.dat da20d51b796c769809b57b535692d37eb1c8b09bfa169aec78707675c8896664.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS da20d51b796c769809b57b535692d37eb1c8b09bfa169aec78707675c8896664.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer da20d51b796c769809b57b535692d37eb1c8b09bfa169aec78707675c8896664.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4216 da20d51b796c769809b57b535692d37eb1c8b09bfa169aec78707675c8896664.exe 4216 da20d51b796c769809b57b535692d37eb1c8b09bfa169aec78707675c8896664.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\da20d51b796c769809b57b535692d37eb1c8b09bfa169aec78707675c8896664.exe"C:\Users\Admin\AppData\Local\Temp\da20d51b796c769809b57b535692d37eb1c8b09bfa169aec78707675c8896664.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4216
-
C:\Users\Admin\AppData\Local\Temp\da20d51b796c769809b57b535692d37eb1c8b09bfa169aec78707675c8896664.exe"C:\Users\Admin\AppData\Local\Temp\da20d51b796c769809b57b535692d37eb1c8b09bfa169aec78707675c8896664.exe" --quiet1⤵PID:6028