bbad922cd7ad33f2592c001d0956491d873ed2270766e0f0f81c8adc076c8307

Analysis

max time kernel
298s
max time network
300s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 2.3MB
Sample260819-amka1stdlg
SHA256 bbad922cd7ad33f2592c001d0956491d873ed2270766e0f0f81c8adc076c8307
MD5 c24fe5ae59d1369775d162697d52e370
SHA1 dd2387171456dcf0a516d546b9afcddead39868b
SHA512 bafb65f8fd6ae7335b5e189abb419de1cbc427f4a6c20cb6e4c70f876051ce02ed119ba7e3da6afbe47de38c93a43017ea9df6847c95c8ccff909fa252db0f6c
SSDEEP 49152:bUHBjeYsjkZ6oOW/iXDML3GjoO/Qfidly7ZcK8I:bGByxW/iXIOQfiuZcK
TLSH
T142B5234342D8A028E1766736CDB2608712707D9B6BB8A5CF3B94BA0A3E73DD1D539707
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2384	AutoIt3.exe
5800	AutoIt3.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2384 set thread context of 5800	2384	AutoIt3.exe	91

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6096	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2384	AutoIt3.exe
2384	AutoIt3.exe
2384	AutoIt3.exe
2384	AutoIt3.exe
2384	AutoIt3.exe
2384	AutoIt3.exe
2384	AutoIt3.exe
2384	AutoIt3.exe
2384	AutoIt3.exe
2384	AutoIt3.exe
2384	AutoIt3.exe
2384	AutoIt3.exe
2384	AutoIt3.exe
2384	AutoIt3.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2384	AutoIt3.exe
2384	AutoIt3.exe
2384	AutoIt3.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2384	AutoIt3.exe
2384	AutoIt3.exe
2384	AutoIt3.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 6080 wrote to memory of 6096	6080	Setup.exe	87
PID 6080 wrote to memory of 2384	6080	Setup.exe	90
PID 2384 wrote to memory of 5800	2384	AutoIt3.exe	91
PID 2384 wrote to memory of 5800	2384	AutoIt3.exe	91
PID 2384 wrote to memory of 5800	2384	AutoIt3.exe	91

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6080
- C:\Windows\SYSTEM32\ipconfig.exe
  ipconfig.exe /73465298ehfjshdf87934
  2⤵
  - Gathers network information
  PID:6096
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Sheep.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    PID:5800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
Size 1.0MB
SHA256 92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45
MD5 8fa52f316c393496f272357191db6deb
SHA1 b1ff3d48a3946ca7786a84e4a832617cd66fa3b9
SHA512 c81da97d6980d6a5aa612070477950a1386239bb919e762f7870bccd459a03da48f8f169910b91f3827c6cfef50471569c9e0c9ff2ceb897904d81840c087d51
SSDEEP 24576:5TC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBB:5+6AqSPyC+NltpScpzbtvpJoMQSq/jre
TLSH
T1FC357D0A23A4419EFEA7F176D617C60BD7B1784A0376962F02A46B726F337711A1E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sheep.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sheep.a3x
Size 1.7MB
SHA256 f73b6f911e19cf74dd9f72ffffceee56e2ff0d00914cc9cdd13eb49eda5992cb
MD5 c0479e3a601781506bb725b2eca88b71
SHA1 102dd5699309a4501bc21d0eab5629599ccdad1d
SHA512 25b92be4b7e191144d7d84870b17ac383c8a41ca37540505180f19086cda38870e05b971db4da51c46eff28519de2396a7b45709d73c9389c7d3c5bee23e8f59
SSDEEP 24576:k5Pm/jfK4+JFD81lXnSVoc7rl69bVi0pmyGyKJDhgIGGWh7jPJV9OOHsoUWqdtF:k8u4+3DanuNroxH2JDh1GGqbOOMFPdtF
TLSH
T1FF85338681CCB02C3B263067CD62718B117409FFA6F9B8D3BE68BF1576BA899C51F541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2384-7-0x00007FF9253C0000-0x00007FF925623000-memory.dmp

Download

memory/2384-8-0x000001D75DC30000-0x000001D75DC31000-memory.dmp

Download

memory/5800-10-0x000001E91E510000-0x000001E91E62D000-memory.dmp

Download

memory/5800-11-0x000001E91E510000-0x000001E91E62D000-memory.dmp

Download