65458220b5352e48ac9a612de0b856935787b8ecf42f99fbb59559506f9ec152

Analysis

user interaction
yes
max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 01:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
installer.exe
Size 124KB
Sample260821-bnst8aek4x
SHA256 65458220b5352e48ac9a612de0b856935787b8ecf42f99fbb59559506f9ec152
MD5 3a0d826c10a8eb08283fbade0d29499d
SHA1 6b86c9e37077a45ca193caefd62e1f9a92fdf90a
SHA512 1ee54a002e8cfdddccdd4b03f41c9492f28c8f8c3b9cba46c20867f0ebe3426e96dcf1634746381484b863261df39e15fe2482645cd10c229f42aa6748c64ccc
SSDEEP 3072:c/25jvDSgsqsb5Uh28vAbTV1WW69B9VjMdxPedN9ug0z9TBfFSApo3:/tzsb5Uh28+V1WW69B9VjMdxPedN9ugR
TLSH
T12FC3279B72E01189EBB581F6D5920786EB7074721711A3DB1B7863B71B2B8C58F3D3A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4760	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5864	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4760	powershell.exe
4760	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4760	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5368 wrote to memory of 5864	5368	installer.exe	90
PID 5864 wrote to memory of 2320	5864	cmd.exe	91
PID 2320 wrote to memory of 4152	2320	net.exe	92
PID 5864 wrote to memory of 236	5864	cmd.exe	93
PID 5864 wrote to memory of 4760	5864	cmd.exe	94
PID 5864 wrote to memory of 2468	5864	cmd.exe	95
PID 5864 wrote to memory of 1540	5864	cmd.exe	96
PID 5864 wrote to memory of 3388	5864	cmd.exe	97
PID 5864 wrote to memory of 4388	5864	cmd.exe	98

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	5	curl/8.8.0

C:\Users\Admin\AppData\Local\Temp\installer.exe
"C:\Users\Admin\AppData\Local\Temp\installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5368
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\742C.tmp\742D.tmp\742E.bat C:\Users\Admin\AppData\Local\Temp\installer.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5864
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2320
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4152
- - C:\Windows\system32\curl.exe
    curl -L --progress-bar -o "C:\Users\Admin\AppData\Local\Temp\AutoSetup\vcredist.zip" "https://github.com/abbodi1406/vcredist/releases/latest/download/VisualCppRedist_AIO_x86_x64.zip"
    3⤵
    PID:236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Expand-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\AutoSetup\vcredist.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\AutoSetup\vcredist' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4760
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f
    3⤵
    PID:2468
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v "BingSearchEnabled" /t REG_DWORD /d 0 /f
    3⤵
    PID:1540
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "DisableWebSearch" /t REG_DWORD /d 1 /f
    3⤵
    PID:3388
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "ConnectedSearchUseWeb" /t REG_DWORD /d 0 /f
    3⤵
    PID:4388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

742E.bat

Path C:\Users\Admin\AppData\Local\Temp\742C.tmp\742D.tmp\742E.bat
Size 1KB
SHA256 22a39ed4b0f9413fd01c4aac098402443d89e2688131cf0505e1ba9dd465a889
MD5 a9c38818ddab3b33594efc0a1a2ede88
SHA1 823e869d0db49c05a46b4d794659885328eb2bf3
SHA512 9a6b95dbae5272a2a270d6fc00dabf85f29241478937ac4105eb010e2a23f34bdd99be12f36483961c51984958dfce2b67bd2f8272fdc5340816414e9d66b522
TLSH
T1E1414526785A803F6DA1FB305DDE2101BF60018B61126FC975D74074A82AFC0EEBD3C6
MD5 SHA1 SHA512 TLSH

Submit Download

vcredist.zip

Path C:\Users\Admin\AppData\Local\Temp\AutoSetup\vcredist.zip
Size 9B
SHA256 0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5
MD5 9d1ead73e678fa2f51a70a933b0bf017
SHA1 d205cbd6783332a212c5ae92d73c77178c2d2f28
SHA512 935b3d516e996f6d25948ba8a54c1b7f70f7f0e3f517e36481fdf0196c2c5cfc2841f86e891f3df9517746b7fb605db47cdded1b8ff78d9482ddaa621db43a34
MD5 SHA1 SHA512

Submit Download

memory/4760-17-0x00000233AFAB0000-0x00000233AFB62000-memory.dmp

Download

memory/4760-19-0x00007FFCECD90000-0x00007FFCED734000-memory.dmp

Download

memory/4760-8-0x00007FFCECD90000-0x00007FFCED734000-memory.dmp

Download

memory/4760-9-0x00007FFCECD90000-0x00007FFCED734000-memory.dmp

Download

memory/4760-10-0x00007FFCECD90000-0x00007FFCED734000-memory.dmp

Download

memory/4760-11-0x00007FFCECD90000-0x00007FFCED734000-memory.dmp

Download

memory/4760-13-0x00007FFCECD90000-0x00007FFCED734000-memory.dmp

Download

memory/4760-12-0x00007FFCECD90000-0x00007FFCED734000-memory.dmp

Download

memory/4760-6-0x00000233AF8D0000-0x00000233AF8F2000-memory.dmp

Download

memory/4760-16-0x00000233AFA90000-0x00000233AFAAE000-memory.dmp

Download

memory/4760-18-0x00007FFCECD90000-0x00007FFCED734000-memory.dmp

Download

memory/4760-7-0x00007FFCECD90000-0x00007FFCED734000-memory.dmp

Download

memory/4760-20-0x00007FFCECD90000-0x00007FFCED734000-memory.dmp

Download

memory/4760-21-0x00000233AFB70000-0x00000233AFB7A000-memory.dmp

Download

memory/4760-23-0x00000233AFB70000-0x00000233AFB82000-memory.dmp

Download

memory/4760-26-0x00007FFCECD90000-0x00007FFCED734000-memory.dmp

Download

memory/4760-27-0x00007FFCECD90000-0x00007FFCED734000-memory.dmp

Download

memory/4760-3-0x00007FFCECF1F000-0x00007FFCECF20000-memory.dmp

Download

memory/4760-24-0x00000233AFA90000-0x00000233AFA9A000-memory.dmp

Download

memory/4760-29-0x00007FFCECD90000-0x00007FFCED734000-memory.dmp

Download

memory/4760-22-0x00007FFCECD90000-0x00007FFCED734000-memory.dmp

Download