b34e63a19450f6b9cf78c4bd3be1bf5cb38b1d3d02a63ffb10fbcaa3a1a9e724

Analysis

max time kernel
164s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 14:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b34e63a19450f6b9cf78c4bd3be1bf5cb38b1d3d02a63ffb10fbcaa3a1a9e724.exe
Size 543KB
Sample260810-r5te3sbm6z
SHA256 b34e63a19450f6b9cf78c4bd3be1bf5cb38b1d3d02a63ffb10fbcaa3a1a9e724
MD5 eefaf56cee585252e5ba15622d118146
SHA1 b4a2ddde5fc7dd8ae5b1bd5a74dbc177dec2b437
SHA512 72f2c82ec4dcf4d92e953397cce7775bad25d3f66bf345b15a6aafda4f4e207af557bdb271850e71e2ad8393603a5e8984b1a068afd3d2580ad7eaae61cb2e26
SSDEEP 12288:170ZdexqurywS6jH5rAo3d3E/YaNC8Nb2Dnqnq5W:17QexbrZxjH5rA+d0/Gy2DnLW
TLSH
T114C4F147AB9217AEF8267CFCCDEBC92363617F565564524B0600DE2E78E7490C42BE32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4128	b34e63a19450f6b9cf78c4bd3be1bf5cb38b1d3d02a63ffb10fbcaa3a1a9e724.exe
4128	b34e63a19450f6b9cf78c4bd3be1bf5cb38b1d3d02a63ffb10fbcaa3a1a9e724.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4128	b34e63a19450f6b9cf78c4bd3be1bf5cb38b1d3d02a63ffb10fbcaa3a1a9e724.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\paakldtes.txt	b34e63a19450f6b9cf78c4bd3be1bf5cb38b1d3d02a63ffb10fbcaa3a1a9e724.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4128	b34e63a19450f6b9cf78c4bd3be1bf5cb38b1d3d02a63ffb10fbcaa3a1a9e724.exe
4128	b34e63a19450f6b9cf78c4bd3be1bf5cb38b1d3d02a63ffb10fbcaa3a1a9e724.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4128	b34e63a19450f6b9cf78c4bd3be1bf5cb38b1d3d02a63ffb10fbcaa3a1a9e724.exe
4128	b34e63a19450f6b9cf78c4bd3be1bf5cb38b1d3d02a63ffb10fbcaa3a1a9e724.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4128	b34e63a19450f6b9cf78c4bd3be1bf5cb38b1d3d02a63ffb10fbcaa3a1a9e724.exe
4128	b34e63a19450f6b9cf78c4bd3be1bf5cb38b1d3d02a63ffb10fbcaa3a1a9e724.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 4256	4128	b34e63a19450f6b9cf78c4bd3be1bf5cb38b1d3d02a63ffb10fbcaa3a1a9e724.exe	89
PID 4128 wrote to memory of 4256	4128	b34e63a19450f6b9cf78c4bd3be1bf5cb38b1d3d02a63ffb10fbcaa3a1a9e724.exe	89

C:\Users\Admin\AppData\Local\Temp\b34e63a19450f6b9cf78c4bd3be1bf5cb38b1d3d02a63ffb10fbcaa3a1a9e724.exe
"C:\Users\Admin\AppData\Local\Temp\b34e63a19450f6b9cf78c4bd3be1bf5cb38b1d3d02a63ffb10fbcaa3a1a9e724.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Users\Admin\AppData\Local\Temp\b34e63a19450f6b9cf78c4bd3be1bf5cb38b1d3d02a63ffb10fbcaa3a1a9e724.exe
  "C:\Users\Admin\AppData\Local\Temp\b34e63a19450f6b9cf78c4bd3be1bf5cb38b1d3d02a63ffb10fbcaa3a1a9e724.exe"
  2⤵
  PID:4256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ball.ini

Path C:\Users\Admin\AppData\Local\Temp\Ball.ini
Size 78B
SHA256 0f3f0d3e271167c35cdc6cc4aeac09fe98b2ad19e8f58c19e0054c7efe8256cc
MD5 967b540d4a601e345a5df14cced0e4f0
SHA1 96d1650b00849803438deb4e1cd159d3c0ad26fc
SHA512 070960d547e45a8f41d234444c2634caa434c32e91b6ea03c3af76e748401200b2521549921a64272cad611d3284221185bd20b84a10290e8084a8ba36bfe67d
TLSH
T1C3A02202AAE00000C000C3BE08828AB3B20B800BA0CF0002323C0B20C30E832820E883
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb39C4.tmp\System.dll
Size 25KB
SHA256 c7dd8cc8323e295b8821b0e320de208a7e20c068a8be8d03857520451ce9ded7
MD5 4abf19a47044ec746aa8c600f0bc149f
SHA1 69da1e4f654b044d7b3c845c12a07c988bf26eb8
SHA512 65727cbe3f03e0dceba06d206054e60adba321d29159b4bfb690c30b2ccd1a0a05a08c2aa50ac270fcd28557f4b482f492c36b0d7b7b980b477cd8971559610e
SSDEEP 384:jZ2pfUx9eVLwDKO9XYD/isN7lCEjgwMU/ktKi+R45Duwomq8pqdDvH81Q:jr96YIrx7lC7vU/kaG9uLmCdb
TLSH
T1DEB24C07F38398BFC51BC17186EF5772AA32BE211B616F6F1220F5756E24EA0871DA14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4128-43-0x00007FF85BB10000-0x00007FF85BB1F000-memory.dmp

Download

memory/4128-42-0x00007FF85BB19000-0x00007FF85BB1A000-memory.dmp

Download

memory/4128-41-0x0000000003780000-0x000000000550D000-memory.dmp

Download

memory/4128-45-0x0000000140000000-0x000000014010B000-memory.dmp

Download

memory/4256-44-0x0000000000080000-0x0000000000152000-memory.dmp

Download

memory/4256-47-0x00007FF867969000-0x00007FF86796B000-memory.dmp

Download