d6f64e89040c34c50a245a787de7cb3e8591b79ad506596272a2cfd60f3c9d07

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d6f64e89040c34c50a245a787de7cb3e8591b79ad506596272a2cfd60f3c9d07.exe
Size 649KB
Sample260810-rmqaps1ald
SHA256 d6f64e89040c34c50a245a787de7cb3e8591b79ad506596272a2cfd60f3c9d07
MD5 1ec3ccb73ef98e16431612a7ad9f8900
SHA1 54d49c75f34cc832f08a553fd4c9663d61ee7531
SHA512 42747b0a30199e49737d5c9532667e3e0e7fd7513f24e61b12636ed3794ec9a4c80d69eb436d1bf972a34838dfe8ed8dba8d921ce70cce87a8adf4828e0de632
SSDEEP 12288:Jtg++Nmxxy6BhAEPrwaWkCQjSX/jr/c13aQRHWxOzJ8T6Ll6Cvy4fKSCci:JMNmnBhtdTjSXLr/cgbxOt46ZBySDi
TLSH
T182E41201EB86D8D8C53285B5E6F2E2F255307DECDA35661B16057F6EBC31BE0CA7A201
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2944	d6f64e89040c34c50a245a787de7cb3e8591b79ad506596272a2cfd60f3c9d07.exe
2944	d6f64e89040c34c50a245a787de7cb3e8591b79ad506596272a2cfd60f3c9d07.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2944	d6f64e89040c34c50a245a787de7cb3e8591b79ad506596272a2cfd60f3c9d07.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2944	d6f64e89040c34c50a245a787de7cb3e8591b79ad506596272a2cfd60f3c9d07.exe
2944	d6f64e89040c34c50a245a787de7cb3e8591b79ad506596272a2cfd60f3c9d07.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2944	d6f64e89040c34c50a245a787de7cb3e8591b79ad506596272a2cfd60f3c9d07.exe
2944	d6f64e89040c34c50a245a787de7cb3e8591b79ad506596272a2cfd60f3c9d07.exe
2944	d6f64e89040c34c50a245a787de7cb3e8591b79ad506596272a2cfd60f3c9d07.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2944	d6f64e89040c34c50a245a787de7cb3e8591b79ad506596272a2cfd60f3c9d07.exe
2944	d6f64e89040c34c50a245a787de7cb3e8591b79ad506596272a2cfd60f3c9d07.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2944	d6f64e89040c34c50a245a787de7cb3e8591b79ad506596272a2cfd60f3c9d07.exe
2944	d6f64e89040c34c50a245a787de7cb3e8591b79ad506596272a2cfd60f3c9d07.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 4816	2944	d6f64e89040c34c50a245a787de7cb3e8591b79ad506596272a2cfd60f3c9d07.exe	89
PID 2944 wrote to memory of 4816	2944	d6f64e89040c34c50a245a787de7cb3e8591b79ad506596272a2cfd60f3c9d07.exe	89

C:\Users\Admin\AppData\Local\Temp\d6f64e89040c34c50a245a787de7cb3e8591b79ad506596272a2cfd60f3c9d07.exe
"C:\Users\Admin\AppData\Local\Temp\d6f64e89040c34c50a245a787de7cb3e8591b79ad506596272a2cfd60f3c9d07.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Users\Admin\AppData\Local\Temp\d6f64e89040c34c50a245a787de7cb3e8591b79ad506596272a2cfd60f3c9d07.exe
  "C:\Users\Admin\AppData\Local\Temp\d6f64e89040c34c50a245a787de7cb3e8591b79ad506596272a2cfd60f3c9d07.exe"
  2⤵
  PID:4816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Callisto.ini

Path C:\Users\Admin\AppData\Local\Temp\Callisto.ini
Size 78B
SHA256 47fb90afa9dcccdfc53368e9e170e9ee3ff626f36750a5bbb76d576a374eee9d
MD5 9ac928f8685affe5b4745de864fd3eb2
SHA1 1a1e3fbbc9834cd1b9f16a361fc8193541b67483
SHA512 7b41b66c98a16d3bfd2b085c297cf3ce62f7d2d2802215ed0cbba0bd681efda79e0012609cedaf6b5bbc20d1d235ee1703513a137ff6ac7327bbbd734d99eb9f
TLSH
T1E2A0222202E020008000C3FE08808A33320F800B808F0203BA3C0A208F0A83ACA0E882
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr53D5.tmp\System.dll
Size 25KB
SHA256 c7dd8cc8323e295b8821b0e320de208a7e20c068a8be8d03857520451ce9ded7
MD5 4abf19a47044ec746aa8c600f0bc149f
SHA1 69da1e4f654b044d7b3c845c12a07c988bf26eb8
SHA512 65727cbe3f03e0dceba06d206054e60adba321d29159b4bfb690c30b2ccd1a0a05a08c2aa50ac270fcd28557f4b482f492c36b0d7b7b980b477cd8971559610e
SSDEEP 384:jZ2pfUx9eVLwDKO9XYD/isN7lCEjgwMU/ktKi+R45Duwomq8pqdDvH81Q:jr96YIrx7lC7vU/kaG9uLmCdb
TLSH
T1DEB24C07F38398BFC51BC17186EF5772AA32BE211B616F6F1220F5756E24EA0871DA14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2944-24-0x00007FFBF5750000-0x00007FFBF575F000-memory.dmp

Download

memory/2944-16-0x00007FFBF5759000-0x00007FFBF575A000-memory.dmp

Download

memory/2944-41-0x0000000003F30000-0x00000000048D9000-memory.dmp

Download

memory/2944-43-0x0000000140000000-0x000000014012A000-memory.dmp

Download

memory/4816-42-0x0000000000080000-0x0000000000165000-memory.dmp

Download

memory/4816-48-0x00007FFBFE349000-0x00007FFBFE34B000-memory.dmp

Download

memory/4816-47-0x0000000140000000-0x0000000141701000-memory.dmp

Download