753c8a5f46643aafb158c03a2b0271ba20c7009a50c14657c171c4da4110b97d

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lighttpd-service-tools-v1.1.1/lighttpd-service-install.exe
Size 63KB
Sample260925-pmlleaea89
SHA256 753c8a5f46643aafb158c03a2b0271ba20c7009a50c14657c171c4da4110b97d
MD5 d690679f5f6a857dacdbc5ee6ce7e736
SHA1 01fd9a97220c5fce3dcd7c756b07deff4428b240
SHA512 f8e11de83a8511f7e7c1e363426eff955b600e78dcfa47fd3ef1cdfbbbfbd56ae799381b05daa738f3ea7066437958f35ae220473031d597261f6c0987c6910c
SSDEEP 1536:IU9RNMwPS/OWg1gDlU62RBWx5DaC1ByfelAqFBokxN7HI1:FhMyGLxiLRBc5DdBiqQkxNE1
TLSH
T1375302D473D9982CE34A85782FF286453B19DD9D3FB4AF0B936060D617B430C536CAA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/memory/4916-0-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral4/memory/4916-4-0x0000000000400000-0x000000000042B000-memory.dmp	upx

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2428	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lighttpd-service-install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 2428	4916	lighttpd-service-install.exe	90

C:\Users\Admin\AppData\Local\Temp\lighttpd-service-tools-v1.1.1\lighttpd-service-install.exe
"C:\Users\Admin\AppData\Local\Temp\lighttpd-service-tools-v1.1.1\lighttpd-service-install.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bt4846.bat "C:\Users\Admin\AppData\Local\Temp\lighttpd-service-tools-v1.1.1\lighttpd-service-install.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bt4846.bat

Path C:\Users\Admin\AppData\Local\Temp\bt4846.bat
Size 3KB
SHA256 7e0fab01adf20dfa59d957f2e751b54ca62b06a0d10e3b71987640404c3a239c
MD5 c24c6a7317bb223d2e9e228a1a3ed456
SHA1 871251e0fd1202674fbde808039f7ddb2ded0b62
SHA512 649ccf099093e8f059022528149e83b3686af75e7875fd580f6b7d19544217c1356a66ad4e88d96965a370444cbad2cf3b92f49cae83fcfd655967afd41ac94b
TLSH
T18D61FDD619D906E051926383BF43D206D22BB286A90D6A4936DDB80E1BCFB5C44BB4DF
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4916-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4916-4-0x0000000000400000-0x000000000042B000-memory.dmp