Analysis
- max time kernel
150s - max time network
137s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/08/2026, 01:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3fb4958a2615b4652d6b55b22d623ca8409e1d452ca6134ce00a4caa118b74e9.bin.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
3fb4958a2615b4652d6b55b22d623ca8409e1d452ca6134ce00a4caa118b74e9.bin.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target 3fb4958a2615b4652d6b55b22d623ca8409e1d452ca6134ce00a4caa118b74e9.bin.exe
- Size 4.2MB
- Sample260812-bfl2pswdjf
- SHA256 3fb4958a2615b4652d6b55b22d623ca8409e1d452ca6134ce00a4caa118b74e9
- MD5 9ea19964d71482f9455ef5d346f37d3f
- SHA1 ee659798992758bcb8e17e01be072311fa3a9d35
- SHA512 5e1318066c8d230166928078027c82a90669efc3df103dd16215d190c6c0959995f29e534c5267b2e6cf153124003635fdd64971bbb7617d7b601454261641a7
- SSDEEP 49152:am8YPwpyVSwGZ7hFl5yDZxQRlaqM89AgRu/mhfKxSnf5dW:aAaDBhFuDTqM89XfKv
- TLSH T189165A037EA448F5C0A9E73588BB5252B674BC4D8B3173EB2D506AB82F763D06D39B41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 868 3fb4958a2615b4652d6b55b22d623ca8409e1d452ca6134ce00a4caa118b74e9.bin.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 868 3fb4958a2615b4652d6b55b22d623ca8409e1d452ca6134ce00a4caa118b74e9.bin.exe 868 3fb4958a2615b4652d6b55b22d623ca8409e1d452ca6134ce00a4caa118b74e9.bin.exe 868 3fb4958a2615b4652d6b55b22d623ca8409e1d452ca6134ce00a4caa118b74e9.bin.exe 868 3fb4958a2615b4652d6b55b22d623ca8409e1d452ca6134ce00a4caa118b74e9.bin.exe 868 3fb4958a2615b4652d6b55b22d623ca8409e1d452ca6134ce00a4caa118b74e9.bin.exe 868 3fb4958a2615b4652d6b55b22d623ca8409e1d452ca6134ce00a4caa118b74e9.bin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fb4958a2615b4652d6b55b22d623ca8409e1d452ca6134ce00a4caa118b74e9.bin.exe"C:\Users\Admin\AppData\Local\Temp\3fb4958a2615b4652d6b55b22d623ca8409e1d452ca6134ce00a4caa118b74e9.bin.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:868
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3360