c21d46b067cb5f86af94d6cee1e0754fa9f15eb73c041a3ae35b4364eb0921b7

Analysis

user interaction
yes
max time kernel
60s
max time network
51s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DriftBootstrapper.exe
Size 322KB
Sample260827-pg53vstgnf
SHA256 c21d46b067cb5f86af94d6cee1e0754fa9f15eb73c041a3ae35b4364eb0921b7
MD5 33a87409c02b784366bf978f5bb3de7f
SHA1 93286cbd9c129b1fc42f1beb8380721c7602f23c
SHA512 dea1493a1d06f9be4be0b5de8404bc3a719a50970e50717c97fa567251c5f70db49b07f345de58ea35d1bfa66297c0f7f0f873cbaa61d41c130b1d62f6fe4db4
SSDEEP 6144:UvgvkNFNaxmNEJJ20n3Mbii8JmferrBYHn:UvggNaxmB0n35irn
TLSH
T14E647D12A3A8417AD2BB4778C8610941EB73781B5BA1E7CF03951CBD5EA37829F35723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3920	Drift.exe
4704	Drift.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2396	DriftBootstrapper.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 3920	2396	DriftBootstrapper.exe	90

C:\Users\Admin\AppData\Local\Temp\DriftBootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\DriftBootstrapper.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Users\Admin\AppData\Local\Drift\Drift.exe
  "C:\Users\Admin\AppData\Local\Drift\Drift.exe"
  2⤵
  - Executes dropped EXE
  PID:3920

C:\Users\Admin\AppData\Local\Drift\Drift.exe
"C:\Users\Admin\AppData\Local\Drift\Drift.exe"
1⤵
- Executes dropped EXE
PID:4704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

installer.log

Path C:\Users\Admin\AppData\Local\DriftExternal\installer.log
Size 1KB
SHA256 b8d81255b18879eb9974f724c53b6ad56e9e5021592659ec11694dbb9bfc87fe
MD5 65fccdb0e8cc6b6736ec9649305bf7ed
SHA1 1fe016243810d08e97030281797342d33d8e0c32
SHA512 f9deae0df3192ffae03292434984af96996b1eedf479fc90b00cd6d1da977b81a01909177910cbc027659c8799fe523feb22d845d0efad875fb7b1fc7490bc01
TLSH
T170317CD242F5AA771E06229ED7726FCAD2A134101B9A6D05E395CA8C34C8D1B5AEF313
MD5 SHA1 SHA512 TLSH

Submit Download

Drift.exe

Path C:\Users\Admin\AppData\Local\Drift\Drift.exe
Size 4.0MB
SHA256 9291b3a8218998328d359e0188b58ebfa04333ea4901868ac5af1e8529406d5c
MD5 6e2e573c3facf3179f9c56d7b0e54807
SHA1 02392e77dfa1637c6452551c42bce19a82058e83
SHA512 300dba1920fff62335b1eb8f565e1f50fbbaf9882eb7e1fa48ccffed4241a662cdfde7a0b019742ba19ae557b1a760f312cb2e23cddae8698e8bfef008709acd
SSDEEP 98304:4DIa2gPOPBFXSZz7r/fqt/4JwDWMwQ1r9E6+:CIhpFX4z7rfIJXj1D+
TLSH
T12C16BF26E6A900FCD472D07DEA97A913E7B2380503306EDB13D04A161F6B6F46A7FB51
MD5 SHA1 SHA512 SSDEEP TLSH