23678645317b5ac75884da5032bcb28f9dc9afe15e5fefe547f94a3c02bbeaae

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
23678645317b5ac75884da5032bcb28f9dc9afe15e5fefe547f94a3c02bbeaae.exe
Size 2.7MB
Sample260820-dascms1wey
SHA256 23678645317b5ac75884da5032bcb28f9dc9afe15e5fefe547f94a3c02bbeaae
MD5 839512da02cee88b64cb04b100448b80
SHA1 e00c43cecf6b967c053fef0ef170619df84ee7c5
SHA512 2f2458bd52eae279cfad8ad95577d604c5ae7c59adc6cf898c1bd59f184beee564eb5bb9ac445f9ef58fa3858bb40e55c646f77d1aca96888021667611fd83f9
SSDEEP 24576:lSMvhanNzeGYpfj4+VkYJRJdS5KaleLk4ik4o7GJo0Jvlm+Ec0xMkl81sU3Ao1YU:oMvhatezJm8fd7Q4pH43JvvY3nEnSFjK
TLSH
T1E0D5E64369EB0DE9CED677BC61C35335A734BD318E291F2BAA08C23169536C4AD1EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

command_and_control lateral_movement

Malware Config

Signatures

Outbound SSH connection to private host 3 TTPs 1 IoCs

SSH is used for remote access. Internal traffic may indicate local host discovery or lateral movement.

command_and_control lateral_movement

Protocol Tunneling

T1572

Network Service Discovery

T1046

SSH

T1021.004

description	flow	ioc	pid	Process
SSH destination	1	10.13.22.80:22	3352	23678645317b5ac75884da5032bcb28f9dc9afe15e5fefe547f94a3c02bbeaae.exe

C:\Users\Admin\AppData\Local\Temp\23678645317b5ac75884da5032bcb28f9dc9afe15e5fefe547f94a3c02bbeaae.exe
"C:\Users\Admin\AppData\Local\Temp\23678645317b5ac75884da5032bcb28f9dc9afe15e5fefe547f94a3c02bbeaae.exe"
1⤵
- Outbound SSH connection to private host
PID:3352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Remote Services

T1021

SSH

T1021.004

Collection

Command and Control

Protocol Tunneling

T1572

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3352-2-0x00007FF799A80000-0x00007FF799BA4000-memory.dmp

Download