Analysis
- max time kernel
148s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 22:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1a8d00805287a55e52ca4f8dc7faf25781564825a99149a7af5be3b3a29a6e7b.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
1a8d00805287a55e52ca4f8dc7faf25781564825a99149a7af5be3b3a29a6e7b.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 1a8d00805287a55e52ca4f8dc7faf25781564825a99149a7af5be3b3a29a6e7b.exe
- Size 3.2MB
- Sample260825-2mtcgazdnb
- SHA256 1a8d00805287a55e52ca4f8dc7faf25781564825a99149a7af5be3b3a29a6e7b
- MD5 ba985e2d83321818fbf4b0aee96bcc61
- SHA1 eed7d066c437a13c21fddd0b56d23c4feb392342
- SHA512 03fa078d1417ed7051393ac13648311e6a79c7fe9ec36f293f983aea42c3c7f8c7b0f63c321c19f3f6b4b8c6bdb7de781cad33b295853afdeef55f01b7c6ca4c
- SSDEEP 49152:Iubp9PgWmrK5uDeMjL7I18/pEb+fv4Kgk9DBIWVdcA12s5CRRwani14F568:0FbppSKai14P68
- TLSH T1F7F54A026F5A88E9C0CDC834C34B8A934E2274DB0A36B9AF45D515293F7EAF55F2D358
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5464 1a8d00805287a55e52ca4f8dc7faf25781564825a99149a7af5be3b3a29a6e7b.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HomeMonitorDaemon = "\"C:\\ProgramData\\HomeMonitorDaemon\\1a8d00805287a55e52ca4f8dc7faf25781564825a99149a7af5be3b3a29a6e7b.exe\" --background-daemon" 1a8d00805287a55e52ca4f8dc7faf25781564825a99149a7af5be3b3a29a6e7b.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5288 wrote to memory of 5464 5288 1a8d00805287a55e52ca4f8dc7faf25781564825a99149a7af5be3b3a29a6e7b.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a8d00805287a55e52ca4f8dc7faf25781564825a99149a7af5be3b3a29a6e7b.exe"C:\Users\Admin\AppData\Local\Temp\1a8d00805287a55e52ca4f8dc7faf25781564825a99149a7af5be3b3a29a6e7b.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\ProgramData\HomeMonitorDaemon\1a8d00805287a55e52ca4f8dc7faf25781564825a99149a7af5be3b3a29a6e7b.exe"C:\ProgramData\HomeMonitorDaemon\1a8d00805287a55e52ca4f8dc7faf25781564825a99149a7af5be3b3a29a6e7b.exe" --background-daemon2⤵
- Executes dropped EXE
PID:5464
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\HomeMonitorDaemon\1a8d00805287a55e52ca4f8dc7faf25781564825a99149a7af5be3b3a29a6e7b.exe
- Size 3.2MB
- SHA256 1a8d00805287a55e52ca4f8dc7faf25781564825a99149a7af5be3b3a29a6e7b
- MD5 ba985e2d83321818fbf4b0aee96bcc61
- SHA1 eed7d066c437a13c21fddd0b56d23c4feb392342
- SHA512 03fa078d1417ed7051393ac13648311e6a79c7fe9ec36f293f983aea42c3c7f8c7b0f63c321c19f3f6b4b8c6bdb7de781cad33b295853afdeef55f01b7c6ca4c
- SSDEEP 49152:Iubp9PgWmrK5uDeMjL7I18/pEb+fv4Kgk9DBIWVdcA12s5CRRwani14F568:0FbppSKai14P68
- TLSH T1F7F54A026F5A88E9C0CDC834C34B8A934E2274DB0A36B9AF45D515293F7EAF55F2D358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\HomeMonitorDaemon\app.log
- Size 1KB
- SHA256 2f8be05435618c095f2ea4cd06ae98b9bcf5b88126ce1ba094e76937c95baa0d
- MD5 2dd69b1c3d1b8d836226cbfb014244e8
- SHA1 e013315347f3955fd8ad9c246ac94289cca1760d
- SHA512 a2c4a43befecf18ad3548ff826d8e26c1c7c17f254cb9e3f2e9bce0051fc7957120f3363110703caeb5f3ad7aedb24777bd5aaac79ca88950b418b5e223ed408
- TLSH T11921CB8141FB469F66AFB9149A601F156D04B2FFE970B1339282C5E7C0A380A0CCEB58
- MD5 SHA1 SHA512 TLSH