Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 13:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe
- Size 3.4MB
- Sample260810-qa7hsat1dt
- SHA256 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd
- MD5 5f8e03a9528a78646f696e80243f1114
- SHA1 3c32a852a2e94db02ab1d2e6ec064ca38197df97
- SHA512 1be7a2fd7d761d7f48c35aab6d9706cee95ee86da865035bd2aa5089ae84391132d9669a64212494426e8e76cea7c1f0f9a3661b46f9bffa36d1e69cdeda7c52
- SSDEEP 49152:9rLMmJaa/0hRMVa9nsUWNd6dLAqOJxS5cNhFDzBo0jqIvptUhg:9vioinjKd6dLAvxS5cDFD1zjqIvptUhg
- TLSH T18BF55C43BECA0DE6DACB67F875C363322374BC4146D9AB2B3648C530BA436D06D59B46
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 1444 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe = "\"C:\\Users\\Admin\\AppData\\Local\\dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe\"" dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe - Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1612 cmd.exe 2148 cmd.exe 3624 cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2144 wrote to memory of 4876 2144 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 89 PID 4876 wrote to memory of 3624 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 90 PID 4876 wrote to memory of 1612 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 92 PID 4876 wrote to memory of 2148 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 94 PID 4876 wrote to memory of 1444 4876 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe"C:\Users\Admin\AppData\Local\Temp\dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe"C:\Users\Admin\AppData\Local\dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe" --from-copy2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c n3⤵
- Executes a command shell one-liner
PID:3624
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c n3⤵
- Executes a command shell one-liner
PID:1612
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c n3⤵
- Executes a command shell one-liner
PID:2148
-
-
C:\Users\Admin\AppData\Local\dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe"C:\Users\Admin\AppData\Local\dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe"3⤵
- Executes dropped EXE
PID:1444
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd.exe
- Size 3.4MB
- SHA256 dbafb803b386de04bdca1bbd3e8f82b018d38ff0de9060c8374e3b29b58a7dbd
- MD5 5f8e03a9528a78646f696e80243f1114
- SHA1 3c32a852a2e94db02ab1d2e6ec064ca38197df97
- SHA512 1be7a2fd7d761d7f48c35aab6d9706cee95ee86da865035bd2aa5089ae84391132d9669a64212494426e8e76cea7c1f0f9a3661b46f9bffa36d1e69cdeda7c52
- SSDEEP 49152:9rLMmJaa/0hRMVa9nsUWNd6dLAqOJxS5cNhFDzBo0jqIvptUhg:9vioinjKd6dLAvxS5cDFD1zjqIvptUhg
- TLSH T18BF55C43BECA0DE6DACB67F875C363322374BC4146D9AB2B3648C530BA436D06D59B46
- MD5 SHA1 SHA512 SSDEEP TLSH