42b340c9feaaee6c4f539566cbf0c379398493517c380c9c49270a351958f46d

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-it
resource tags

arch:x64arch:x86image:win10v2004-20260513-itlocale:it-itos:windows10-2004-x64systemwindows
submitted
08/09/2026, 16:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VirusTotalAnalys (1).exe
Size 87KB
Sample260908-vhtdcavshs
SHA256 42b340c9feaaee6c4f539566cbf0c379398493517c380c9c49270a351958f46d
MD5 a8bd925c2bd1b35af4a9be07f8dc3de9
SHA1 3cc4f13d10e5c8a727c3bf5e6adb6d12b08be41f
SHA512 62e0ce6e7398ac54656acfec7ed8425357837ff46c0b5a8f8d405e95ded474cd9b6499355c735017ca501effcab422a79b58847486fa79d862f0045b38433307
SSDEEP 1536:/BmigTWR28sbPhkqZOxomA+RwfmznWcK9JBvUygn8hU:7PsDGqxWRvWcyNy
TLSH
T12E9339697765EE26EB68533549FF1E0911B463CB0B91C2361EC64CC06B82388CB5AFD7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
5220	netstat.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5220	netstat.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
5852	VirusTotalAnalys (1).exe
5852	VirusTotalAnalys (1).exe
5852	VirusTotalAnalys (1).exe
5852	VirusTotalAnalys (1).exe
5852	VirusTotalAnalys (1).exe
5852	VirusTotalAnalys (1).exe
5852	VirusTotalAnalys (1).exe
5852	VirusTotalAnalys (1).exe
5852	VirusTotalAnalys (1).exe
5852	VirusTotalAnalys (1).exe
5852	VirusTotalAnalys (1).exe
5852	VirusTotalAnalys (1).exe
5852	VirusTotalAnalys (1).exe
5852	VirusTotalAnalys (1).exe
5852	VirusTotalAnalys (1).exe
5852	VirusTotalAnalys (1).exe
5852	VirusTotalAnalys (1).exe
5852	VirusTotalAnalys (1).exe
5852	VirusTotalAnalys (1).exe
5852	VirusTotalAnalys (1).exe
5852	VirusTotalAnalys (1).exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5852	VirusTotalAnalys (1).exe
Token: SeDebugPrivilege	5220	netstat.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5852 wrote to memory of 5220	5852	VirusTotalAnalys (1).exe	86

C:\Users\Admin\AppData\Local\Temp\VirusTotalAnalys (1).exe
"C:\Users\Admin\AppData\Local\Temp\VirusTotalAnalys (1).exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5852
- C:\Windows\SYSTEM32\netstat.exe
  "netstat" -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:5220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5852-0-0x0000000000E60000-0x0000000000E7C000-memory.dmp

Download

memory/5852-1-0x00007FFD862D0000-0x00007FFD86471000-memory.dmp

Download

memory/5852-2-0x0000000003080000-0x00000000030C0000-memory.dmp

Download

memory/5852-6-0x00007FFD862D0000-0x00007FFD86471000-memory.dmp

Download