14b5dd95adc937a34a7018b5bb8cc20d09b691a476fc8f8860923e3d3c7a3b55

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 13:27

Target
SacredStep_v3.exe
Size 484KB
Sample260905-qqlagseb49
SHA256 14b5dd95adc937a34a7018b5bb8cc20d09b691a476fc8f8860923e3d3c7a3b55
MD5 632984d0b42a7b5f66d94e00e0063bf4
SHA1 8639132b7f18514a261f42b50db9bd60c4a05465
SHA512 1c3d1b70cdbefdd8c5b709a7810da54293b08a485ced71ba840439199549c8769de24b07592878136379c60580469ff8bc7421468e0f8103b962ab14529fe179
SSDEEP 12288:iGm0OrOUVAVWiKL6f8QtrUZRv3PupMbkm54iw:iGmgZKqrUXubm5o
TLSH
T10BB4011BB2A531F9D4A7953989611906E73678361B309FDF03A053AA3F332D18E3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
5148	rvqeakhw.tmp

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5148	rvqeakhw.tmp

Suspicious behavior: EnumeratesProcesses 64 IoCs

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 5148	3216	SacredStep_v3.exe	89

C:\Users\Admin\AppData\Local\Temp\SacredStep_v3.exe
"C:\Users\Admin\AppData\Local\Temp\SacredStep_v3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Users\Admin\AppData\Local\Temp\rvqeakhw.tmp
  "C:\Users\Admin\AppData\Local\Temp\rvqeakhw.tmp"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:5148

rvqeakhw.tmp

Path C:\Users\Admin\AppData\Local\Temp\rvqeakhw.tmp
Size 345KB
SHA256 5b8673f57bd30f56da8a0ccb9010c7cef1c4489e07496a0bcfdc354d906e7ca5
MD5 2147fe3eb013df3693e62080454780f0
SHA1 dd21ba7488b85f61432dcb7a531f73b9ddc6573a
SHA512 e8ccc239bc12dd090d8812b0291e443bc5607866ed314e767196b292c2dabee1d1b6651a5f955df374de8483ec428293be1ca34f4d2f9e1184d4d47fade8a83d
SSDEEP 6144:C3Ljom74RdEc/SulZjhfFX8bvOOmm3sXXf7+p8FO6v1:QjJMxfO78XXzNFO6d
TLSH
T14D749F24FA6818FDE177C1788A676907E7323C8A037069DB23A059A61F276D44F3F716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download