Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/09/2026, 23:58

General

  • Target
    83d874507817a85f88d73e54fb3052e354df7bcb759b77ad53d14bb1c7b37bf8.exe
  • Size 9.3MB
  • Sample260910-31d1daxfla
  • SHA256 83d874507817a85f88d73e54fb3052e354df7bcb759b77ad53d14bb1c7b37bf8
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 TTPs 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 31 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\83d874507817a85f88d73e54fb3052e354df7bcb759b77ad53d14bb1c7b37bf8.exe
    "C:\Users\Admin\AppData\Local\Temp\83d874507817a85f88d73e54fb3052e354df7bcb759b77ad53d14bb1c7b37bf8.exe"
    1⤵
      PID:4352
    • C:\Users\Admin\AppData\Local\Temp\83d874507817a85f88d73e54fb3052e354df7bcb759b77ad53d14bb1c7b37bf8.exe
      C:\Users\Admin\AppData\Local\Temp\83d874507817a85f88d73e54fb3052e354df7bcb759b77ad53d14bb1c7b37bf8.exe --service
      1⤵
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1516
      • C:\Windows\system32\getmac.exe
        "getmac" /fo csv /nh
        2⤵
          PID:2444
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic" diskdrive get serialnumber /format:csv
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1240
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic" csproduct get uuid /format:csv
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1488
      • C:\Users\Admin\AppData\Local\Temp\83d874507817a85f88d73e54fb3052e354df7bcb759b77ad53d14bb1c7b37bf8.exe
        C:\Users\Admin\AppData\Local\Temp\83d874507817a85f88d73e54fb3052e354df7bcb759b77ad53d14bb1c7b37bf8.exe
        1⤵
        • Adds Run key to start application
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4064
        • C:\Windows\system32\getmac.exe
          "getmac" /fo csv /nh
          2⤵
            PID:5920
          • C:\Windows\System32\Wbem\wmic.exe
            "wmic" diskdrive get serialnumber /format:csv
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2952
          • C:\Windows\System32\Wbem\wmic.exe
            "wmic" csproduct get uuid /format:csv
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:2208

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              iptpub.json

              • Path C:\Users\Admin\AppData\Local\torproject\Arti\data\hss\web-analytics-client\iptpub.json
              • Size 52B
              • SHA256 9fd26a914523bf3562399dbd61d4d404d81dacd020881c5a5edd0082fe401cab
              • MD5 SHA1 SHA512 TLSH

              iptpub.json

              • Path C:\Users\Admin\AppData\Local\torproject\Arti\data\hss\web-analytics-client\iptpub.json
              • Size 426B
              • SHA256 16995f77c23b2501268c9ef5e40cfe3d6a0e30ec241b0cc94d4947486258c15d
              • MD5 SHA1 SHA512 TLSH

              iptpub.json

              • Path C:\Users\Admin\AppData\Local\torproject\Arti\data\hss\web-analytics-client\iptpub.json
              • Size 426B
              • SHA256 3a1e32c8a3093631cff6a289350d128e35be03887e944191711042d261994d3a
              • MD5 SHA1 SHA512 TLSH

              iptpub.tmp

              • Path C:\Users\Admin\AppData\Local\torproject\Arti\data\hss\web-analytics-client\iptpub.tmp
              • Size 178B
              • SHA256 21d1e344644b2ae80dc9f4ed5d8155a34eaf26eab7803c020e75b90b1642c229
              • MD5 SHA1 SHA512 TLSH

              iptpub.tmp

              • Path C:\Users\Admin\AppData\Local\torproject\Arti\data\hss\web-analytics-client\iptpub.tmp
              • Size 178B
              • SHA256 94e245414789f2c52996fd53ffa90223a5a40dad30b9adc8a9ad77ccd04e1a3d
              • MD5 SHA1 SHA512 TLSH

              iptpub.tmp

              • Path C:\Users\Admin\AppData\Local\torproject\Arti\data\hss\web-analytics-client\iptpub.tmp
              • Size 426B
              • SHA256 acd0297dba4ee4b4152cb5c88e696e71cabecb3f510659b9e287465a34120301
              • MD5 SHA1 SHA512 TLSH

              iptpub.tmp

              • Path C:\Users\Admin\AppData\Local\torproject\Arti\data\hss\web-analytics-client\iptpub.tmp
              • Size 178B
              • SHA256 6660f2cdab17f99542bde1f5bad03bc30a7bad5cf29d888fe542776a397dd694
              • MD5 SHA1 SHA512 TLSH

              iptpub.tmp

              • Path C:\Users\Admin\AppData\Local\torproject\Arti\data\hss\web-analytics-client\iptpub.tmp
              • Size 178B
              • SHA256 ce259c285caf9cdac6c5605f0bcb4b5a77491ae648d3423e2034efd754ac8546
              • MD5 SHA1 SHA512 TLSH

              ipts.json

              • Path C:\Users\Admin\AppData\Local\torproject\Arti\data\hss\web-analytics-client\ipts.json
              • Size 1KB
              • SHA256 963f1f86cfbad875e571fb072baee5cee38d0eae9f6d72f19377b34ff25eb09d
              • MD5 SHA1 SHA512 TLSH

              ipts.tmp

              • Path C:\Users\Admin\AppData\Local\torproject\Arti\data\hss\web-analytics-client\ipts.tmp
              • Size 1KB
              • SHA256 6fc30640ccdcf2cdbe6f1633ade942b673d241ac2ba6bc668386f5b74abe651b
              • MD5 SHA1 SHA512 TLSH

              ks_hs_blind_id+20705_1440_43200.ed25519_expanded_private

              • Path C:\Users\Admin\AppData\Local\torproject\Arti\data\keystore\hss\web-analytics-client\ks_hs_blind_id+20705_1440_43200.ed25519_expanded_private
              • Size 456B
              • SHA256 18641959199b1bbd949ebc83edb44b76c101b16509a409c998aa33e0cebcc2c5
              • MD5 SHA1 SHA512 TLSH

              ks_hs_blind_id+20706_1440_43200.ed25519_expanded_private

              • Path C:\Users\Admin\AppData\Local\torproject\Arti\data\keystore\hss\web-analytics-client\ks_hs_blind_id+20706_1440_43200.ed25519_expanded_private
              • Size 456B
              • SHA256 97c536b77b47cd26ceef21f95d9d1c580c62ca9ff8dd7c3c483ff7733c346f97
              • MD5 SHA1 SHA512 TLSH

              ks_hs_desc_sign+20705_1440_43200.ed25519_private

              • Path C:\Users\Admin\AppData\Local\torproject\Arti\data\keystore\hss\web-analytics-client\ks_hs_desc_sign+20705_1440_43200.ed25519_private
              • Size 387B
              • SHA256 139633c577e5009009cbbc171ccf5e60057905e21dd67503c4951d44340e7459
              • MD5 SHA1 SHA512 TLSH

              ks_hs_desc_sign+20706_1440_43200.ed25519_private

              • Path C:\Users\Admin\AppData\Local\torproject\Arti\data\keystore\hss\web-analytics-client\ks_hs_desc_sign+20706_1440_43200.ed25519_private
              • Size 387B
              • SHA256 f5674a6c84536dc431890fe81a3656880b296a22e566f16b2cac99b1102c816f
              • MD5 SHA1 SHA512 TLSH

              ks_hs_id.ed25519_expanded_private

              • Path C:\Users\Admin\AppData\Local\torproject\Arti\data\keystore\hss\web-analytics-client\ks_hs_id.ed25519_expanded_private
              • Size 456B
              • SHA256 64b2f4e23dbb4d393e25b074732131eb23aa3e28bd420c5857f379c33741a585
              • MD5 SHA1 SHA512 TLSH

              circuit_timeouts.json

              • Path C:\Users\Admin\AppData\Local\torproject\Arti\data\state\circuit_timeouts.json
              • Size 65B
              • SHA256 9dbe12675e515f32f07aea11cc9f8bea69b3f143b3d825d98ca1ef41b2988ee7
              • MD5 SHA1 SHA512 TLSH

              guards.json

              • Path C:\Users\Admin\AppData\Local\torproject\Arti\data\state\guards.json
              • Size 10KB
              • SHA256 5e6dbccada4273daf758c6af64a2cd1806210377686fcb2aafc1f75a158292e9
              • MD5 SHA1 SHA512 SSDEEP TLSH

              guards.tmp

              • Path C:\Users\Admin\AppData\Local\torproject\Arti\data\state\guards.tmp
              • Size 121B
              • SHA256 a2c2287ea6aa4ba07c2c1ab66268828c011a5d9cacef6dba1179a6bd196c2c3d
              • MD5 SHA1 SHA512 TLSH

              con_microdesc_sha3-256-4b7fead8d4b17498964ee850310a8981ad92c583688b568fad7fb8a899afc3d8

              • Path C:\Windows\System32\config\systemprofile\AppData\Local\torproject\Arti\cache\dir_blobs\con_microdesc_sha3-256-4b7fead8d4b17498964ee850310a8981ad92c583688b568fad7fb8a899afc3d8
              • Size 3.2MB
              • SHA256 f1e0f2d967a37f766f4ea96874191d910b5f0400050dc9f9151bf6bab0367e6e
              • MD5 SHA1 SHA512 SSDEEP TLSH

              iptpub.json

              • Path C:\Windows\System32\config\systemprofile\AppData\Local\torproject\Arti\data\hss\web-analytics-client\iptpub.json
              • Size 426B
              • SHA256 f36fc61ba937d1ac3d1be2583b4aee3ff8bb064ea06d2da5c8d9f0599bab602f
              • MD5 SHA1 SHA512 TLSH

              iptpub.tmp

              • Path C:\Windows\System32\config\systemprofile\AppData\Local\torproject\Arti\data\hss\web-analytics-client\iptpub.tmp
              • Size 52B
              • SHA256 fbefec068607ae11b064339c0e291f9372d18b741468ce4ce1cb6e7530180226
              • MD5 SHA1 SHA512 TLSH

              iptpub.tmp

              • Path C:\Windows\System32\config\systemprofile\AppData\Local\torproject\Arti\data\hss\web-analytics-client\iptpub.tmp
              • Size 426B
              • SHA256 7ff612425b049fa499204be96b98955c7c5823ec29c25dfd520152222a6cd9d6
              • MD5 SHA1 SHA512 TLSH

              iptpub.tmp

              • Path C:\Windows\System32\config\systemprofile\AppData\Local\torproject\Arti\data\hss\web-analytics-client\iptpub.tmp
              • Size 426B
              • SHA256 c90aecbbebb9176e24ede6f01d1ded3b267de62afc6259ba09efa2bb3ca2bdb5
              • MD5 SHA1 SHA512 TLSH

              iptpub.tmp

              • Path C:\Windows\System32\config\systemprofile\AppData\Local\torproject\Arti\data\hss\web-analytics-client\iptpub.tmp
              • Size 426B
              • SHA256 c8336f162494e6e325c8d03d1e9ee10df77efd9c6b442cdc97891f6ad830194e
              • MD5 SHA1 SHA512 TLSH

              iptpub.tmp

              • Path C:\Windows\System32\config\systemprofile\AppData\Local\torproject\Arti\data\hss\web-analytics-client\iptpub.tmp
              • Size 426B
              • SHA256 70bd43466c80b77a48e2af7df4fe87f2ea9e7855f662190087b49b55f62e0d89
              • MD5 SHA1 SHA512 TLSH

              iptpub.tmp

              • Path C:\Windows\System32\config\systemprofile\AppData\Local\torproject\Arti\data\hss\web-analytics-client\iptpub.tmp
              • Size 426B
              • SHA256 0f957a4526ae05709058bd8ffbf46f53523eb4060f8084857a3a3fde885d61e8
              • MD5 SHA1 SHA512 TLSH

              ipts.tmp

              • Path C:\Windows\System32\config\systemprofile\AppData\Local\torproject\Arti\data\hss\web-analytics-client\ipts.tmp
              • Size 1KB
              • SHA256 36a5930c0c42d5232e4827567ac45e931898d578ce1a887f03e9020d011e1f12
              • MD5 SHA1 SHA512 TLSH

              ks_hs_blind_id+20705_1440_43200.ed25519_expanded_private

              • Path C:\Windows\System32\config\systemprofile\AppData\Local\torproject\Arti\data\keystore\hss\web-analytics-client\ks_hs_blind_id+20705_1440_43200.ed25519_expanded_private
              • Size 456B
              • SHA256 7057dd652fce28b933b3b00880f69334d5892fa1877f7787bfca136ba55261f5
              • MD5 SHA1 SHA512 TLSH

              ks_hs_blind_id+20706_1440_43200.ed25519_expanded_private

              • Path C:\Windows\System32\config\systemprofile\AppData\Local\torproject\Arti\data\keystore\hss\web-analytics-client\ks_hs_blind_id+20706_1440_43200.ed25519_expanded_private
              • Size 456B
              • SHA256 29b90266eef10bfff85693a8a79187d2272e71c0634b8339ba575cb57965607a
              • MD5 SHA1 SHA512 TLSH

              ks_hs_desc_sign+20705_1440_43200.ed25519_private

              • Path C:\Windows\System32\config\systemprofile\AppData\Local\torproject\Arti\data\keystore\hss\web-analytics-client\ks_hs_desc_sign+20705_1440_43200.ed25519_private
              • Size 387B
              • SHA256 cf0d8cb630d49e5249210496c8cae16e2d8ff59d34532eb0f7d11aefe4062a18
              • MD5 SHA1 SHA512 TLSH

              ks_hs_desc_sign+20706_1440_43200.ed25519_private

              • Path C:\Windows\System32\config\systemprofile\AppData\Local\torproject\Arti\data\keystore\hss\web-analytics-client\ks_hs_desc_sign+20706_1440_43200.ed25519_private
              • Size 387B
              • SHA256 cd2db7a8cc8b56aea233014b4c79dec8df3b22e03f79595ff418599eccfbbbad
              • MD5 SHA1 SHA512 TLSH

              ks_hs_id.ed25519_expanded_private

              • Path C:\Windows\System32\config\systemprofile\AppData\Local\torproject\Arti\data\keystore\hss\web-analytics-client\ks_hs_id.ed25519_expanded_private
              • Size 456B
              • SHA256 b7d1288aaad1a050539676b61f7eb991497beb54f551650045ea04f5ae1f2c27
              • MD5 SHA1 SHA512 TLSH