Analysis
- max time kernel
150s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 18:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
35853a912fdb788a5a93c0f1109f66b5580656c96121151ccd4f96a32d633ba2.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
35853a912fdb788a5a93c0f1109f66b5580656c96121151ccd4f96a32d633ba2.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target 35853a912fdb788a5a93c0f1109f66b5580656c96121151ccd4f96a32d633ba2.exe
- Size 1.3MB
- Sample260822-wlkfaasvcy
- SHA256 35853a912fdb788a5a93c0f1109f66b5580656c96121151ccd4f96a32d633ba2
- MD5 2b4a7c6e4cfbbcd6e99f1979c2a941a5
- SHA1 ac9224f76c1acab34813ed99e0b69a57d97ad3e5
- SHA512 7905efbbb0150a2cbca8e4f1dec357497eb4e5a19430ad0036e7fd89dcb0494569236a2b36a1abfa35896928aec3b7cd2bdeb7a2177c266f727df270969947a1
- SSDEEP 24576:PUic1tuOzl51Wa5YG36Sccyv1H57BlhmSZxCJ6oxMgy:Hc1v1WaXtvi1V4mC0oxdy
- TLSH T13355BF1AF2E640E8DC75DB788A755722FA7178025F34A9DF02D0472A3E73EA05A3DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\moe_map\sdata.bin 35853a912fdb788a5a93c0f1109f66b5580656c96121151ccd4f96a32d633ba2.exe File opened for modification C:\Windows\moe_map\moe_map.log 35853a912fdb788a5a93c0f1109f66b5580656c96121151ccd4f96a32d633ba2.exe File opened for modification C:\Windows\moe_map\global.dat 35853a912fdb788a5a93c0f1109f66b5580656c96121151ccd4f96a32d633ba2.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4620 35853a912fdb788a5a93c0f1109f66b5580656c96121151ccd4f96a32d633ba2.exe 4620 35853a912fdb788a5a93c0f1109f66b5580656c96121151ccd4f96a32d633ba2.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4620 35853a912fdb788a5a93c0f1109f66b5580656c96121151ccd4f96a32d633ba2.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4620 35853a912fdb788a5a93c0f1109f66b5580656c96121151ccd4f96a32d633ba2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\35853a912fdb788a5a93c0f1109f66b5580656c96121151ccd4f96a32d633ba2.exe"C:\Users\Admin\AppData\Local\Temp\35853a912fdb788a5a93c0f1109f66b5580656c96121151ccd4f96a32d633ba2.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4620