Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/08/2026, 17:23
General
- Target d4bb9d06e50d0009f7380cea2a2c44bafe0b2419b5d1ed69f852135c72e0f20f.exe
- Size 687KB
- Sample260810-vx68rayybv
- SHA256 d4bb9d06e50d0009f7380cea2a2c44bafe0b2419b5d1ed69f852135c72e0f20f
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4bb9d06e50d0009f7380cea2a2c44bafe0b2419b5d1ed69f852135c72e0f20f.exe"C:\Users\Admin\AppData\Local\Temp\d4bb9d06e50d0009f7380cea2a2c44bafe0b2419b5d1ed69f852135c72e0f20f.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle 1 "$Sanemindedness=GC -raw 'C:\Users\Admin\AppData\Roaming\bookmakeriet\windowpane\Sumer.Rdt';$Lavsts1=$Sanemindedness.SubString(4235,3);.$Lavsts1($Sanemindedness)"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Kamikken.Reg
Sumer.Rdt
memory/3364-43-0x00000000071D0000-0x0000000007273000-memory.dmp
memory/3364-46-0x00000000072D0000-0x00000000072DA000-memory.dmp
memory/3364-23-0x0000000073700000-0x0000000073EBC000-memory.dmp
memory/3364-24-0x0000000005620000-0x0000000005642000-memory.dmp
memory/3364-26-0x0000000005730000-0x0000000005796000-memory.dmp
memory/3364-25-0x00000000056C0000-0x0000000005726000-memory.dmp
memory/3364-29-0x0000000005970000-0x0000000005CCB000-memory.dmp
memory/3364-30-0x0000000005940000-0x000000000595E000-memory.dmp
memory/3364-31-0x0000000005D10000-0x0000000005D5C000-memory.dmp
memory/3364-32-0x0000000006C60000-0x0000000006CF6000-memory.dmp
memory/3364-33-0x00000000061B0000-0x00000000061CA000-memory.dmp
memory/3364-34-0x0000000006230000-0x0000000006252000-memory.dmp
memory/3364-35-0x0000000007520000-0x0000000007ADA000-memory.dmp
memory/3364-21-0x0000000073700000-0x0000000073EBC000-memory.dmp
memory/3364-37-0x0000000008160000-0x00000000087DC000-memory.dmp
memory/3364-38-0x00000000070C0000-0x00000000070F6000-memory.dmp
memory/3364-42-0x0000000007100000-0x0000000007120000-memory.dmp
memory/3364-39-0x00000000700A0000-0x00000000700EC000-memory.dmp
memory/3364-19-0x0000000073712000-0x0000000073713000-memory.dmp
memory/3364-44-0x0000000073700000-0x0000000073EBC000-memory.dmp
memory/3364-22-0x0000000004EA0000-0x00000000054EA000-memory.dmp
memory/3364-47-0x0000000073700000-0x0000000073EBC000-memory.dmp
memory/3364-45-0x0000000073700000-0x0000000073EBC000-memory.dmp
memory/3364-48-0x0000000007450000-0x0000000007461000-memory.dmp
memory/3364-49-0x0000000007470000-0x0000000007480000-memory.dmp
memory/3364-50-0x0000000007480000-0x0000000007495000-memory.dmp
memory/3364-51-0x00000000074D0000-0x00000000074EC000-memory.dmp
memory/3364-52-0x00000000074C0000-0x00000000074C8000-memory.dmp
memory/3364-53-0x0000000073712000-0x0000000073713000-memory.dmp
memory/3364-54-0x0000000073700000-0x0000000073EBC000-memory.dmp
memory/3364-56-0x0000000007AE0000-0x0000000007B04000-memory.dmp
memory/3364-55-0x00000000074D0000-0x00000000074FA000-memory.dmp
memory/3364-57-0x0000000073700000-0x0000000073EBC000-memory.dmp
memory/3364-58-0x0000000073700000-0x0000000073EBC000-memory.dmp
memory/3364-59-0x0000000073700000-0x0000000073EBC000-memory.dmp
memory/3364-20-0x0000000004810000-0x0000000004846000-memory.dmp
memory/3364-61-0x0000000073700000-0x0000000073EBC000-memory.dmp
memory/3364-62-0x00000000087E0000-0x000000000A907000-memory.dmp
memory/3364-63-0x0000000073700000-0x0000000073EBC000-memory.dmp
memory/3364-65-0x0000000073700000-0x0000000073EBC000-memory.dmp
memory/4932-75-0x0000000000900000-0x0000000001BE6000-memory.dmp