Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 15:17
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe
- Size 281KB
- Sample260810-sn97yaha67
- SHA256 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469
- MD5 9a774170ca41a6edff9629ca7bb2a96f
- SHA1 2795a858dcb93cbf269554f448710ac6977ecf89
- SHA512 900f769ddaf32bc2eba03bfabb7145a101f7d802b37caf34c43099c92f0cf913d7b7a655fb351cc0e63feac4b92d647418055ba7df7e10426356a4a1fbbfd3b3
- SSDEEP 6144:Cbfopdha+pV8OJt1FuyKdnnKSqrQeG4hphjlRFFYMhmHW:CbIc+p+O71FuyKdKSqrNjR3v
- TLSH T1B954E12472B6E047E5523A31CFA5E5F86859AEA0FD29E44733123F4FB8B5F81CD45092
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks QEMU agent file 2 TTPs 1 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
description ioc Process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe - Loads dropped DLL 2 IoCs
pid Process 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe Token: SeDebugPrivilege 4540 bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe"C:\Users\Admin\AppData\Local\Temp\bbb1778cb174f526ad3d9530d548f321efc4346f2f1686155dfb3a29b7454469.exe"1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4540
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsoE575.tmp\System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH