66964609638e3ecc63a71367e3cd85dee38a61a4e0ee3399d5f5d050b8c9dc1f

Analysis

max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SagePilot-windows-amd64-installer-v0.1.0.exe
Size 23.5MB
Sample260810-pltkmaydjc
SHA256 66964609638e3ecc63a71367e3cd85dee38a61a4e0ee3399d5f5d050b8c9dc1f
MD5 a903b002683373da4fe5e2eeefd3679a
SHA1 ff469dcde541f3994ebb7947ac21186f5b40c2a9
SHA512 8af5db6ff8fb7ce3b0c21c5c01a7cdfa47d944ab3ca4044d81f97f9f66910284ae5ee5802fdbd2defde585cc37b715b838dff150982697bda77cd5a89f1336c2
SSDEEP 393216:VvOpDGmaf529IibQGvNs5Q6UZOTuyqPadseUns0U9OONRgOuFzHyisTK:VvsGs/cGm5Q2w5n/U9OON+FzSpm
TLSH
T1544733CBC1BA4B40EA2E25F999B6B919D91F1074E0B3BF0617712D0192CDBCECAF5191
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
1300	SagePilot-windows-amd64-installer-v0.1.0.exe
1300	SagePilot-windows-amd64-installer-v0.1.0.exe
1300	SagePilot-windows-amd64-installer-v0.1.0.exe
1300	SagePilot-windows-amd64-installer-v0.1.0.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5640	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1692	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SagePilot-windows-amd64-installer-v0.1.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5640	tasklist.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 1692	1300	SagePilot-windows-amd64-installer-v0.1.0.exe	89
PID 1692 wrote to memory of 5640	1692	cmd.exe	91
PID 1692 wrote to memory of 3884	1692	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\SagePilot-windows-amd64-installer-v0.1.0.exe
"C:\Users\Admin\AppData\Local\Temp\SagePilot-windows-amd64-installer-v0.1.0.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\SysWOW64\cmd.exe
  cmd /c tasklist /FI "IMAGENAME eq SagePilot.exe" /NH | findstr /i "SagePilot.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq SagePilot.exe" /NH
    3⤵
    - Discovers running processes
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5640
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i "SagePilot.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsgF97F.tmp\InstallOptions.dll
Size 15KB
SHA256 dd0d1a8c4511261333e90a94d9912000592c46731b615aa7a37cd2b3eb6a8d58
MD5 7854290f8bc473fb9fad1917b0065731
SHA1 27c0e4731e395dfe612d954bf8793c533c53ef8f
SHA512 736030a5e1b744d0f96745f9933a57f5b52361288d33aeeaad12e054c47c4bb705cfc7d5cd4a5e3e667a6c6252e1c2a573b2707241d7b73b60c73daf2de52038
SSDEEP 192:EJGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoT2g11929WtshLAzgSrX8:EJNt+4t7uJalUnGesY7Lt8nC3/Yosa
TLSH
T1E9624D1137D598B3E2E62A797EF373138FA5FB22A4428E0BC7332E0638565805D78311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsgF97F.tmp\System.dll
Size 12KB
SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
MD5 6d08f0d5503bb100b8429fefaad163a6
SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
TLSH
T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsgF97F.tmp\ioSpecial.ini
Size 996B
SHA256 392dba8dcfe1bb4c587b60da6645aa310822067a7b65ae3c19f7dfe732966be0
MD5 70dc72e81fb9922e0c08ccc90e1c67b0
SHA1 0e1b14706c6b5c35de4b4ad7f8bed408a8c5a916
SHA512 7e4c70d724d35d01a98d186a7c21e53165ffb95c1293bd2933ac9a4696dda2ae69d6c05a474b927ab8bc6c23d2bd87e017f9a597fd83742a7a89d58bcb59e72a
TLSH
T18311E0033AF94A18F3AAB618EFF180785339B855545DC91E81D14A0F48EAB808127BEF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsgF97F.tmp\ioSpecial.ini
Size 1KB
SHA256 95a4fedb063362eb5c7d852f6105837bb7f61a3286645176ca56f97210778d1f
MD5 8321b91f318f30e1982a3a5d0feff0b6
SHA1 b5a3253b31c2af1e8456b5a7d212d2266abb51e3
SHA512 cabf63ba1dcd85c553d1931b914a7bb23d531c10ee9f40c97257ad65eb659579683e0a2fdf07f5b120dea1c25f27cd0ec995e5563e6ce95d33a3c7f28e2b0544
TLSH
T1E111E2032DF94A18F3ABB60CEFF0447953397495544DC91E85D10A0F44EAB819127BEF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsgF97F.tmp\ioSpecial.ini
Size 1KB
SHA256 e5edc4e393e203ebefb1afc93252f51044792a430d4bc4b3d85a14f2963693bb
MD5 2f16fd335f51edeb3a588433cbe3be25
SHA1 9743a85622e3b0ccc42d4e9295c13db550f30f11
SHA512 8520dd167bb545848f41fffc0a1155f489e01f6aa36f811c28b84cfc6cbcea705e468196737cdb97ad9acacdaf8012e8fc31693385787a40eae0022716fbb83c
TLSH
T1D61104072DF90A18F36BF618EFF0447843397495545DC91E90D10A0F44EAE819527BEF
MD5 SHA1 SHA512 TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsgF97F.tmp\nsExec.dll
Size 7KB
SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
MD5 c953dd0aab774f1446fcd63fa7c5f613
SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
TLSH
T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads