Analysis

  • max time kernel
    149s
  • max time network
    184s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    16/08/2026, 00:11

General

  • Target
    ida-pro_93_x64win.exe
  • Size 619.0MB
  • Sample260816-agxddsad55
  • SHA256 077b0f67edd0143b2c2c16c5a802f1036208afd8c035ccf71164a6813bb4533a
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Loads dropped DLL 14 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ida-pro_93_x64win.exe
    "C:\Users\Admin\AppData\Local\Temp\ida-pro_93_x64win.exe"
    1⤵
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:4212

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        BR8A1A.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\BRL00001074\BR8A1A.tmp
        • Size 128KB
        • SHA256 86bed5024f4dfb6c0b28f88a2d635653b3c8e7c8c13bb5c0276190efa00943d0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        BR8A79.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\BRL00001074\BR8A79.tmp
        • Size 356KB
        • SHA256 3524ec77985e390acf9d07d81b1b44305165d711bbca770f7458ea0a78751f82
        • MD5 SHA1 SHA512 SSDEEP TLSH

        BR8AE8.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\BRL00001074\BR8AE8.tmp
        • Size 59KB
        • SHA256 be88244da9faaa6636a9d2f4c4249c08066a0b48359690b9b27a2b9ed47e093d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        BR8B08.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\BRL00001074\BR8B08.tmp
        • Size 198KB
        • SHA256 ce4d21e414a7e8868bc5720c0da92000cdecb9744030598d7a36b5575b700133
        • MD5 SHA1 SHA512 SSDEEP TLSH

        BR8B28.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\BRL00001074\BR8B28.tmp
        • Size 813KB
        • SHA256 6d917bee03ffee7fd95c089684a9fd4b38b054d28b9c726f2daf370ed9ef7909
        • MD5 SHA1 SHA512 SSDEEP TLSH

        BR8B58.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\BRL00001074\BR8B58.tmp
        • Size 235KB
        • SHA256 aaa3d7e589e9be1911eee5974afa68c64af1bbd5e039ff6a82a15c2b54c0f9f0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        BR8B69.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\BRL00001074\BR8B69.tmp
        • Size 24KB
        • SHA256 2b93420dc2b1b8a74bf3d75fe99232303a3f692ceb1fdf2df27d40b7e8e6fa53
        • MD5 SHA1 SHA512 SSDEEP TLSH

        BR8C35.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\BRL00001074\BR8C35.tmp
        • Size 19KB
        • SHA256 034756f772399552cd33605a189ee0e45d7947860e0d83ec12aa6da1a5a42054
        • MD5 SHA1 SHA512 SSDEEP TLSH

        BR8D5F.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\BRL00001074\BR8D5F.tmp
        • Size 96KB
        • SHA256 9426e96a97f41645fab524385a852687792f99b505554b6b9809ed99451b2399
        • MD5 SHA1 SHA512 SSDEEP TLSH

        BR8D6F.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\BRL00001074\BR8D6F.tmp
        • Size 179KB
        • SHA256 ef4616f642d3a809b124fdc2eb75bbac155689c844c03c45cf848923b2cb4bd9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        BR8DAF.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\BRL00001074\BR8DAF.tmp
        • Size 26KB
        • SHA256 44e5f5f11a3c25be0880819cb42647fb7840d6b3260ef32c91a8ae44d308e58f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        BR8DBF.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\BRL00001074\BR8DBF.tmp
        • Size 40KB
        • SHA256 c9deef1cc37b85c2c166fbcbee6f018a2d65128abb170174e80c129f3171b065
        • MD5 SHA1 SHA512 SSDEEP TLSH

        BR8DD0.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\BRL00001074\BR8DD0.tmp
        • Size 209KB
        • SHA256 3257c2d167916a57e61022fff9a9bd9ea0a7c9f1ce8f00eea4c84039f4519200
        • MD5 SHA1 SHA512 SSDEEP TLSH

        BR8DF0.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\BRL00001074\BR8DF0.tmp
        • Size 90KB
        • SHA256 150ac0b7099a90f654c070275ede790cd9ad10dedcb537d9730e97d13d56bc1c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/4212-77-0x000000006CA00000-0x000000006CA0E000-memory.dmp

        memory/4212-94-0x0000000000070000-0x000000000034D000-memory.dmp

        memory/4212-79-0x0000000070A80000-0x0000000070AB2000-memory.dmp

        memory/4212-78-0x0000000066C00000-0x0000000066C1B000-memory.dmp

        memory/4212-81-0x0000000070A50000-0x0000000070A63000-memory.dmp

        memory/4212-76-0x0000000070140000-0x000000007014F000-memory.dmp

        memory/4212-75-0x000000006C580000-0x000000006C599000-memory.dmp

        memory/4212-74-0x0000000070AC0000-0x0000000070B97000-memory.dmp

        memory/4212-73-0x00000000710C0000-0x00000000710F4000-memory.dmp

        memory/4212-72-0x0000000066680000-0x0000000066695000-memory.dmp

        memory/4212-71-0x0000000070BA0000-0x0000000070BC6000-memory.dmp

        memory/4212-70-0x0000000000070000-0x000000000034D000-memory.dmp

        memory/4212-82-0x0000000000070000-0x000000000034D000-memory.dmp

        memory/4212-80-0x0000000070A70000-0x0000000070A80000-memory.dmp

        memory/4212-106-0x0000000000070000-0x000000000034D000-memory.dmp

        memory/4212-118-0x0000000000070000-0x000000000034D000-memory.dmp

        memory/4212-130-0x0000000000070000-0x000000000034D000-memory.dmp

        memory/4212-142-0x0000000000070000-0x000000000034D000-memory.dmp

        memory/4212-154-0x0000000000070000-0x000000000034D000-memory.dmp

        memory/4212-166-0x0000000000070000-0x000000000034D000-memory.dmp

        memory/4212-178-0x0000000000070000-0x000000000034D000-memory.dmp

        memory/4212-190-0x0000000000070000-0x000000000034D000-memory.dmp

        memory/4212-202-0x0000000000070000-0x000000000034D000-memory.dmp

        memory/4212-214-0x0000000000070000-0x000000000034D000-memory.dmp

        memory/4212-226-0x0000000000070000-0x000000000034D000-memory.dmp