32fb48c739953ba4a3dcb1970e39b52e1a3ca484c85be367dd561144b15ad4e6

Analysis

max time kernel
158s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 11:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
24.6.1824.2.exe
Size 733.5MB
Sample260925-ndn5hadf82
SHA256 32fb48c739953ba4a3dcb1970e39b52e1a3ca484c85be367dd561144b15ad4e6
MD5 dcfd5411829471fdf7d46f0a4fc86f7c
SHA1 8506b1012a013c583839f4bf764470b98e514f42
SHA512 a7760276292332972e01bdf4da82fd8ee78a5e70ccdfea2f545c6586c3cc6ab9924fdea5133ee0d9a617205a4f0b90c207ea3e8d3b614102b1303853e6a7727f
SSDEEP 12582912:7PjJ1tWxRaBwRtyYVw3BOAY3MeslRq9m/Oe20uo0VjS829RstAbXtTmRL19N:7PV1tNBaWBpY8es7qMd0VjS8xGTiLd
TLSH
T17B892303F2E18198D06B84348A6BB323F6317C19072496E797D0FE256F77BC06A7A756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5440	php.exe

Loads dropped DLL 1 IoCs

pid	Process
5440	php.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 5440	1856	24.6.1824.2.exe	89

C:\Users\Admin\AppData\Local\Temp\24.6.1824.2.exe
"C:\Users\Admin\AppData\Local\Temp\24.6.1824.2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1856
- C:\INST_TEMP\24.6.1824.2\php.exe
  "C:\INST_TEMP\24.6.1824.2\php.exe" -f C:\INST_TEMP\24.6.1824.2\install.php
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

php.exe

Path C:\INST_TEMP\24.6.1824.2\php.exe
Size 181KB
SHA256 59dab3a2640cdbd3ee2173b435ff5d0351c87c197436d317b5a2eee7c4b40430
MD5 ca28c2f733c9891f205f18e333d03371
SHA1 1a18e34745d4c4e74573e22feebf22fa8ec060b5
SHA512 5b4033cfc7f2a8dca9d9f82001d774616540aedbcc73145a1573152874e0956d5274fe09ad0c7b78f7f62616f4b2003730ca18bbbed4121881e5a0b93924c20a
SSDEEP 3072:50KY4Aoh8jCj637crgTs32UXHCJgyMITT/UiOJai9US5cUU/k9mK:51vAOtMEC6ynT/UkYUSDUc9
TLSH
T1720418D731A2B0E6CFC7603E846685A6B772F1BD0B9087DFBA54D1280F052E85F7650A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

php8.dll

Path C:\INST_TEMP\24.6.1824.2\php8.dll
Size 13.0MB
SHA256 2164d7ee42805207f18af292ed53babedfb004198dc491181a128e775b0271aa
MD5 10262711cbf232d39f896547cc8add22
SHA1 e7c8fd14e67a6caa84db55bc0b36c18ffd18255c
SHA512 42b56d3684d29ea7b953eceb65db7f9649dc72739ace40b4bf7abd84eb9109aad10cdc0ffaaeacc0998b3d42983e1dd39e3d02aed57980043ac34030c6dc2cb6
SSDEEP 98304:nlF1LKmP1QX/Yy5cpk7JuJkeMZfV/1Zl2MCFcdeMEm5NBq3vWWF5r9BAUZL4j7uk:lF1LKm9Kh3lu6Tcd9VAmMnKF
TLSH
T183D68C17B3A541A9D56BC138CA975367D7B1FC04132097CF02A0B6692F33BE62A3A3D5
MD5 SHA1 SHA512 SSDEEP TLSH