004bba9c163ee46353f75a9813453736820c292a901e6a41c01544a2060819f0

Analysis

max time kernel
40s
max time network
38s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 23:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
004bba9c163ee46353f75a9813453736820c292a901e6a41c01544a2060819f0.exe
Size 3.4MB
Sample260905-3hmvkabl3v
SHA256 004bba9c163ee46353f75a9813453736820c292a901e6a41c01544a2060819f0
MD5 5810ce8ff09ba73173a395faa460dc44
SHA1 64825fe564b461b3bea89506d6eea9ff089b8f89
SHA512 f4e114388b53e07d5250e5821890802a8f5e237f8fe040fc0ea611185adb77f31d7f2e6c84097c90cef6afa514505a852ef74113613ccffb7dfb5eade471ee9c
SSDEEP 98304:X0sbgRDSy7U3Z8RVZjpZiVOon7ydAVpaCFEIjRiEapU3PonCLF:EsbgBSyY3Z8/Zjfsp7+AzE+YEau33LF
TLSH
T1CBF501527F828961C046ABB08665D7FCF335FF588A118B4B32D66E077EEA1C35D226C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	004bba9c163ee46353f75a9813453736820c292a901e6a41c01544a2060819f0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	004bba9c163ee46353f75a9813453736820c292a901e6a41c01544a2060819f0.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	004bba9c163ee46353f75a9813453736820c292a901e6a41c01544a2060819f0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	004bba9c163ee46353f75a9813453736820c292a901e6a41c01544a2060819f0.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3756	004bba9c163ee46353f75a9813453736820c292a901e6a41c01544a2060819f0.exe
3756	004bba9c163ee46353f75a9813453736820c292a901e6a41c01544a2060819f0.exe

C:\Users\Admin\AppData\Local\Temp\004bba9c163ee46353f75a9813453736820c292a901e6a41c01544a2060819f0.exe
"C:\Users\Admin\AppData\Local\Temp\004bba9c163ee46353f75a9813453736820c292a901e6a41c01544a2060819f0.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3756-0-0x0000000140067000-0x0000000140249000-memory.dmp

Download

memory/3756-1-0x0000000140000000-0x00000001405B2000-memory.dmp

Download

memory/3756-3-0x0000000140000000-0x00000001405B2000-memory.dmp

Download

memory/3756-2-0x00007FFC8B390000-0x00007FFC8B392000-memory.dmp

Download

memory/3756-6-0x0000000140000000-0x00000001405B2000-memory.dmp

Download

memory/3756-7-0x0000000140000000-0x00000001405B2000-memory.dmp

Download

memory/3756-8-0x0000000140067000-0x0000000140249000-memory.dmp

Download