Analysis
- max time kernel
150s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 01:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe
- Size 1.4MB
- Sample260820-caabdsz1cw
- SHA256 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854
- MD5 8f58ed2504e909cfb7eba3258185f421
- SHA1 dfbed1727107c8ab0c248eedbf95d27bd09483b8
- SHA512 008e8e677fe7376d672a216fee492a2b972953efead4b0d1b6d05a65742a7503e67ad35462d8f77da4d1e15ca5c7ef67f1632bc063e5ffb17ff97a749a31b7df
- SSDEEP 12288:+iu/pCM1I82c/40SrEpqB4IycNw2ttN8b:+iu/p3I70A9B0cNw2tt
- TLSH T1A3658D12F781C037E4A2147A9AAED779583A7935031691C7B7D81E7A7F203D1BA3630E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe - Checks for any installed AV software in registry 1 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\SetupFolders d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avira\Launcher d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Launcher d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AhnLab\V3IS80 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe 2880 d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe"C:\Users\Admin\AppData\Local\Temp\d8e1c09b7dfd9ef30b9ba4d1eea6331adb0867de42feb0077385772b83f5b854.exe"1⤵
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2880
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\gRmMvGgUsDfYyVdL\360ini.dll
- Size 4.3MB
- SHA256 62f4efdbf94b2f359471413e648512736fd50362e12e73132da538be41c1316c
- MD5 342dd27094b01406dbc605b7c6c6c004
- SHA1 5aec9a4935b116e89f4580e8dc09aa193626f138
- SHA512 4ee585eee61309c08d7dfc8875d664445f1fc9e7f916bc56fd9a47af5398dd241052bc4a29fd166fff5ddff3b937506c9517517fe066f66e8a736c22543e6ff2
- SSDEEP 98304:1b5Mq0oBuiPyeDuoeKHg1k0OQAPqDPbbfH0r++XWhVzr06dzVy:R0oAiPy6eKuk0tAPqQzXWvzrbzVy
- TLSH T19726D0CCBF6E80A2DB892E35817B171F196B52A9432005FFC59BEB5C4B11DF22075B46
- MD5 SHA1 SHA512 SSDEEP TLSH