Analysis
- user interaction
yes - max time kernel
118s - max time network
120s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/08/2026, 03:57
Behavioral task
behavioral1
Sample
client(9).exe
Resource
win11-20260513-en
3 signatures
900 seconds
General
- Target client(9).exe
- Size 8.6MB
- Sample260823-ejba6axthz
- SHA256 b69a452206ee24e86c1f3968c059769096ef4daf7a5ad2127ad552de6b36c4cf
- MD5 3f4b082ae1a918bdc29f928a53eb3ac4
- SHA1 f6dcbc9368e46e2e165bf316e79954e80c73ec65
- SHA512 71f645c0d4088bb5c09a349e3b3938bf524a02b3001808cf3d0b1e393c12c8823252d6d7f88bcd342e228e0c11dc2e971eb68c61071b1e5e4a8c21c0b87d340b
- SSDEEP 98304:wLvfWszoaANNuduE8oLEvBcuZSYkyMKvS:k7zoaANJE8PvBcxyMKv
- TLSH T131965A47E89045A8C4BDD6348A728223BA717C884F3563E73B50F7686F76BD06AB9740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 2 Go-http-client/1.1 - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 1292 client(9).exe Token: SeDebugPrivilege 1292 client(9).exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1292 wrote to memory of 3556 1292 client(9).exe 81