General
- Target DefiantTemp.exe
- Size 651KB
- Sample260815-kml5qatsbs
- SHA256 f581023878df5abbece07275e0556e5124928e943f926486ba35d01f274979b7
- MD5 e8b9cc94521e010f21163c8d8bc5df45
- SHA1 4c7f6382447bdff4b67edfcbfd2204fbe5d3dfa0
- SHA512 4442634690ef915b9349cd38c1b18aae61b9c8a3a1cc43208c9fe4427d6ac4149618231c767afe54ec026afc9db51812304a47cf44de9e8c20fd8f0f728cbcfc
- SSDEEP 12288:lDR3/Ixu6bwbCCUEItZEk0IvYBDNojmgGbMOz9wwMtfdsSLRzcLDh5GU:lDR3/Ixu6bwbCCUECaav+DNoyRbXDyRi
- TLSH T1B9E44921A69C00F8E177D67989624912F7F27C460331AFCF13909DAA1F276E85E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
DefiantTemp.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
DefiantTemp.exe
Resource
win11ltsc2024-20260709-en
0 signatures
150 seconds
Malware Config
Targets
-
- Target DefiantTemp.exe
- Size 651KB
- SHA256 f581023878df5abbece07275e0556e5124928e943f926486ba35d01f274979b7
- MD5 e8b9cc94521e010f21163c8d8bc5df45
- SHA1 4c7f6382447bdff4b67edfcbfd2204fbe5d3dfa0
- SHA512 4442634690ef915b9349cd38c1b18aae61b9c8a3a1cc43208c9fe4427d6ac4149618231c767afe54ec026afc9db51812304a47cf44de9e8c20fd8f0f728cbcfc
- SSDEEP 12288:lDR3/Ixu6bwbCCUEItZEk0IvYBDNojmgGbMOz9wwMtfdsSLRzcLDh5GU:lDR3/Ixu6bwbCCUECaav+DNoyRbXDyRi
- TLSH T1B9E44921A69C00F8E177D67989624912F7F27C460331AFCF13909DAA1F276E85E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1