7eeba41f9ee707f8b8b19687277d8a3bb620989c4453512413b7ae8af9b924e8

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 8.5MB
Sample260929-tw86aabb25
SHA256 7eeba41f9ee707f8b8b19687277d8a3bb620989c4453512413b7ae8af9b924e8
MD5 06fbda80c7ff5d8ef226e354e39deaa9
SHA1 af0c70c638d1cad9671033db08a420a84addb8a2
SHA512 df74c7adb04508bf8650240281db3659a1ff2de36a1d68b56f8133d13df0301d0b9707019a3111bfdf0ac61281f811f6d06e147b06c02f38610419cc214adf3f
SSDEEP 49152:y8o64w8jQlwqyKtzoMD8DUodhFzi/qx2I9dQ2JgTg1kp3zrmTzf59RNlpV9MBMyr:y8Z4NMbpteLe/L4j
TLSH
T16A96E92592080395F539F3BE0AD97BB97A147F28B0340519F7DE6993A103DA0E7F43A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4920	build_x64.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	build_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	build_x64.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4652	file.exe
4652	file.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
4652	file.exe
820	Process not Found
4652	file.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	4652	file.exe
Token: SeLoadDriverPrivilege	4652	file.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 4920	4652	file.exe	89

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Users\Admin\AppData\Local\Temp\build_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\build_x64.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:4920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

build_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\build_x64.exe
Size 620KB
SHA256 9933d6f33b2a70b9d019fe206c43085695954ad38395ac4c56ba7044ea5d1882
MD5 fef0ce8403596c14d21c74479c7ed0a9
SHA1 d1626f0f0e9bf9312bfe06f526c49cc9013eb727
SHA512 f8d06094d43607c8c97d80a7a64f9cd59e1a9fdd0910b622315167d9c6b60cef3c501cdea2fa348354bedb88bd10992da9287ff52e0512b46077e1d10bc6fd37
SSDEEP 6144:/KOEx+/9I7iIPqiSomRTcWbHiddZZSuXx2+4bPKm4+WCTNZil10lAJNxcGUv1ocW:/K+MFSoiTcWbCddgo1Tb2vGcqgP
TLSH
T192D47C16EBE402F9D17BC1B4CA829856EB77B855533065CB03E209675F3B6A05F3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download