744437d93633c87382f9d1a1fdf0c1a3a908c5f9e0435bb480771dbdc0282fae

Analysis

max time kernel
150s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/09/2026, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8101 Fatura 4883- 2026-8.exe
Size 1.2MB
Sample260914-pbptpack91
SHA256 744437d93633c87382f9d1a1fdf0c1a3a908c5f9e0435bb480771dbdc0282fae
MD5 895e427449556e15d357670e9e499dcb
SHA1 a51a18b3908126f1f1c11895e92c1d65230903be
SHA512 1df4c47c6b7b54f086897542e8724bcf340d517a7472827992ee5c7e73f4aa3298a095475444760d5e0150ed63f30ca081417cfa7cdbd0494345a47bb7328bff
SSDEEP 24576:La2MB8zNnVoYED6xpoInKiwtWlPmSenEz+T10lpfC7Mh8:u2MuzNnV4GSiwtWsnEz+ulpCgh
TLSH
T1EA551255F64171FCCC34CCB475A250735AB47C3AC990699B258DF3AE2CB18B2EA3E258
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
404	8101 Fatura 4883- 2026-8.exe
404	8101 Fatura 4883- 2026-8.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
404	8101 Fatura 4883- 2026-8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
404	8101 Fatura 4883- 2026-8.exe
404	8101 Fatura 4883- 2026-8.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
404	8101 Fatura 4883- 2026-8.exe
404	8101 Fatura 4883- 2026-8.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
404	8101 Fatura 4883- 2026-8.exe
404	8101 Fatura 4883- 2026-8.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 4256	404	8101 Fatura 4883- 2026-8.exe	90
PID 404 wrote to memory of 4256	404	8101 Fatura 4883- 2026-8.exe	90

C:\Users\Admin\AppData\Local\Temp\8101 Fatura 4883- 2026-8.exe
"C:\Users\Admin\AppData\Local\Temp\8101 Fatura 4883- 2026-8.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:404
- C:\Users\Admin\AppData\Local\Temp\8101 Fatura 4883- 2026-8.exe
  "C:\Users\Admin\AppData\Local\Temp\8101 Fatura 4883- 2026-8.exe"
  2⤵
  PID:4256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi62B9.tmp\System.dll
Size 25KB
SHA256 2c39c42e16dc819c7b7a4a136bac7e0df898e2c1d4bcd26d41ba2922bfd89276
MD5 24936b0f61dc04401fcd1c2675235a8f
SHA1 cafa6dbf5ee820de30d6651fac8a0625cc85e0e6
SHA512 f82fb8fc75f057053422d0d5e3d2d98f31b205b9ff0d9b6533bb24f255b94de5bc7b3d8ab3eee2d5ba8e4f1f6b9346c0db92f357c0b994d99e5b20540ce8d698
SSDEEP 384:lZ2pfUx9eVLwDKO9XYD/isN7lCEjgwMU/ktKi+R45Duwomq8pqdDvHy1Q:lr96YIrx7lC7vU/kaG9uLmCdb
TLSH
T139B24C07F38398BFC50BC17186EF5772AA32BE211B616F6F1220F5756E24E90871DA18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/404-22-0x00007FF8380A0000-0x00007FF8380AF000-memory.dmp

Download

memory/404-20-0x00007FF8380A9000-0x00007FF8380AA000-memory.dmp

Download

memory/404-44-0x00000000036E0000-0x0000000005DA6000-memory.dmp

Download

memory/404-46-0x0000000140000000-0x000000014014B000-memory.dmp

Download

memory/4256-45-0x0000000000080000-0x0000000000183000-memory.dmp

Download

memory/4256-48-0x00007FF843F49000-0x00007FF843F4B000-memory.dmp

Download