Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/08/2026, 23:28
Behavioral task
behavioral1
Sample
598b8c321e031f9d95edc3d4c66be1d7b86a81706f64446a07ee0a4b50f0fd55.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
598b8c321e031f9d95edc3d4c66be1d7b86a81706f64446a07ee0a4b50f0fd55.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 598b8c321e031f9d95edc3d4c66be1d7b86a81706f64446a07ee0a4b50f0fd55.exe
- Size 205KB
- Sample260830-3gdv9ssbjd
- SHA256 598b8c321e031f9d95edc3d4c66be1d7b86a81706f64446a07ee0a4b50f0fd55
- MD5 3a2bc8ccea3bd12096b20153859b56b1
- SHA1 7c4756bf258be0f31910805b074b5ede9e6e2361
- SHA512 60e961b0419f0124baa9b3ee7338bc167fc883fabb6f71f6d4f6674664a4e36064be124025fcf59d57885529cac066a511c6376e47936f5c24bb1a1ccdf6ccbc
- SSDEEP 6144:xOKF6HevlpPyPoEPuOIKhuOtbeUg0AC5IXe:TsHevlUgEPuO4ObDEGI
- TLSH T1D92423AD59A285A4DCA1CC7421CF7C54B72F70BA2E8F4B49558936738A3EFC92D0520B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\System32\config\system.dat 598b8c321e031f9d95edc3d4c66be1d7b86a81706f64446a07ee0a4b50f0fd55.exe -
resource yara_rule behavioral2/memory/4192-0-0x0000000000740000-0x00000000007F0000-memory.dmp upx behavioral2/memory/4192-3-0x0000000000740000-0x00000000007F0000-memory.dmp upx - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4192 598b8c321e031f9d95edc3d4c66be1d7b86a81706f64446a07ee0a4b50f0fd55.exe 4192 598b8c321e031f9d95edc3d4c66be1d7b86a81706f64446a07ee0a4b50f0fd55.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\598b8c321e031f9d95edc3d4c66be1d7b86a81706f64446a07ee0a4b50f0fd55.exe"C:\Users\Admin\AppData\Local\Temp\598b8c321e031f9d95edc3d4c66be1d7b86a81706f64446a07ee0a4b50f0fd55.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4192