Overview

overview

7

Static

static

3

DriftBootstrapper.exe

windows10-2004-x64

7

DriftBootstrapper.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    64s
  • max time network
    65s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/08/2026, 12:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    DriftBootstrapper.exe
  • Size 322KB
  • Sample260827-pg53vstgnf
  • SHA256 c21d46b067cb5f86af94d6cee1e0754fa9f15eb73c041a3ae35b4364eb0921b7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DriftBootstrapper.exe
    "C:\Users\Admin\AppData\Local\Temp\DriftBootstrapper.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3896
    • C:\Users\Admin\AppData\Local\Drift\Drift.exe
      "C:\Users\Admin\AppData\Local\Drift\Drift.exe"
      2⤵
      • Executes dropped EXE
      PID:5904
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:844
    • C:\Users\Admin\AppData\Local\Drift\Drift.exe
      "C:\Users\Admin\AppData\Local\Drift\Drift.exe"
      1⤵
      • Executes dropped EXE
      PID:2148

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          Drift.exe
          • Path C:\Users\Admin\AppData\Local\Drift\Drift.exe
          • Size 4.0MB
          • SHA256 9291b3a8218998328d359e0188b58ebfa04333ea4901868ac5af1e8529406d5c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OFL-PlusJakartaSans.txt
          • Path C:\Users\Admin\AppData\Local\Temp\DriftStaging\fonts\OFL-PlusJakartaSans.txt
          • Size 4KB
          • SHA256 995c7199cab65954f545996326755daee7b63cc6b42b06c13da1f9502ab08a99
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PlusJakartaSans-Bold.ttf
          • Path C:\Users\Admin\AppData\Local\Temp\DriftStaging\fonts\PlusJakartaSans-Bold.ttf
          • Size 129KB
          • SHA256 14972f80fb151f32fb7129c6ad1893f6dd2a9d8bac30c40508c99e7f289b6682
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PlusJakartaSans-Regular.ttf
          • Path C:\Users\Admin\AppData\Local\Temp\DriftStaging\fonts\PlusJakartaSans-Regular.ttf
          • Size 128KB
          • SHA256 6bcfbb10639b8a206b4f8a0a1a29459e7255b1481c95e20d587dd1f1a4b24646
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PlusJakartaSans-SemiBold.ttf
          • Path C:\Users\Admin\AppData\Local\Temp\DriftStaging\fonts\PlusJakartaSans-SemiBold.ttf
          • Size 129KB
          • SHA256 de75ddb3917c5a3f2b7d0cd65fcf63795710f2e1fd944199a73a01731e66fd43
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fa-solid-900.ttf
          • Path C:\Users\Admin\AppData\Local\Temp\DriftStaging\fonts\fa-solid-900.ttf
          • Size 409KB
          • SHA256 fbbf06d7437aa30f3cd44c968380193545a8fc3eadfb7ad897bbb101eefec5a2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download