6b1d30b4b5859f65dd1e78bb02a1ed91391d77bfa4ace1da2179742306ccffda

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6b1d30b4b5859f65dd1e78bb02a1ed91391d77bfa4ace1da2179742306ccffda.exe
Size 1.1MB
Sample260826-wt6cqa1vbz
SHA256 6b1d30b4b5859f65dd1e78bb02a1ed91391d77bfa4ace1da2179742306ccffda
MD5 2376434a9ca07f26004d2483a5188a0f
SHA1 92ba454138b824875be9f54c1cd65cab8adf05e0
SHA512 375c9e0539d6e6805ea71f93bca6119efa281e899c256c3d68cf79ce1501489d5861a065a8e8fab81daaa0d067f78511a3580fecfcb9ed6917190534d1f4ec67
SSDEEP 24576:8bRbJaK2B91yhM3tqFdz7FPlUJmHdel/ck7:CwK2Bcz7FPlUJmZk
TLSH
T1E2358C1BABE521F5E477C178CD6A4406E7B378650771C7CF12A546AB0F232E09E3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3304	unst1787768032496-copied.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 3304	2624	6b1d30b4b5859f65dd1e78bb02a1ed91391d77bfa4ace1da2179742306ccffda.exe	89

C:\Users\Admin\AppData\Local\Temp\6b1d30b4b5859f65dd1e78bb02a1ed91391d77bfa4ace1da2179742306ccffda.exe
"C:\Users\Admin\AppData\Local\Temp\6b1d30b4b5859f65dd1e78bb02a1ed91391d77bfa4ace1da2179742306ccffda.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Users\Admin\AppData\Local\Temp\unst1787768032496-copied.exe
  "C:\Users\Admin\AppData\Local\Temp\unst1787768032496-copied.exe" --source_path="C:\Users\Admin\AppData\Local\Temp\6b1d30b4b5859f65dd1e78bb02a1ed91391d77bfa4ace1da2179742306ccffda.exe"
  2⤵
  - Executes dropped EXE
  PID:3304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Dola-uninstaller.log

Path C:\Users\Admin\AppData\Local\Temp\Cici\User Data\sdk_storage\log\Dola-uninstaller.log
Size 1KB
SHA256 80e2f0cbfda493c1773377beea5ec106aa413426038a7abd99b61e566ba3dee4
MD5 50a97c7b6e8c1dca43ad7cfdb15223f5
SHA1 193298567a860246a7776446eb092c02b4d91828
SHA512 51cd95e763583823678938e0ce95e9cf95a29a7444fd4054ca11a3a051cd40f8d5b7b2933af8e9a72d7f11adbb65fa15bb649f9a8d956bdc2602c94d083bc3a9
TLSH
T11731CBC34DA450597C0E811A699A3D85E8D3B1BA4DCC2A1E339B05BC9CC771EB29EF19
MD5 SHA1 SHA512 TLSH

Submit Download

unst1787768032496-copied.exe

Path C:\Users\Admin\AppData\Local\Temp\unst1787768032496-copied.exe
Size 1.1MB
SHA256 6b1d30b4b5859f65dd1e78bb02a1ed91391d77bfa4ace1da2179742306ccffda
MD5 2376434a9ca07f26004d2483a5188a0f
SHA1 92ba454138b824875be9f54c1cd65cab8adf05e0
SHA512 375c9e0539d6e6805ea71f93bca6119efa281e899c256c3d68cf79ce1501489d5861a065a8e8fab81daaa0d067f78511a3580fecfcb9ed6917190534d1f4ec67
SSDEEP 24576:8bRbJaK2B91yhM3tqFdz7FPlUJmHdel/ck7:CwK2Bcz7FPlUJmZk
TLSH
T1E2358C1BABE521F5E477C178CD6A4406E7B378650771C7CF12A546AB0F232E09E3A722
MD5 SHA1 SHA512 SSDEEP TLSH