3c1c6b94e57afd57f58b1c9e16d5f8261b16af2654ffd3196edc2ac9fe6db67e

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 8.2MB
Sample260929-tw8vhsbb23
SHA256 3c1c6b94e57afd57f58b1c9e16d5f8261b16af2654ffd3196edc2ac9fe6db67e
MD5 9e6cc0f8079d16fc6286fc9547235410
SHA1 d6c1238bc6b00181392ac99e7c173b448c33b386
SHA512 1ee6fcae5af8d37b8ef73045a2b8b838b0d18c15bac2a52b04ea1f327092d5b0a7898a13307c4b173d28d574f62a2f2579fcbec01739a32dbde20aca73f94fe0
SSDEEP 49152:ERaM2wWFvG79bKoYWoW38dj5kj5br1IHc6ivuHleJB3K7PaBcgKb/tBRKQ:+FH/UjKjRxIHcZvuHleJ
TLSH
T1FF96C72592080395F539F3BE4AD97BB87B143F28B0340419B7DE6993A513DA1E3F43A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4836	build_x64.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	build_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	build_x64.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5732	file.exe
5732	file.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
5732	file.exe
816	Process not Found
5732	file.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	5732	file.exe
Token: SeLoadDriverPrivilege	5732	file.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5732 wrote to memory of 4836	5732	file.exe	89

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5732
- C:\Users\Admin\AppData\Local\Temp\build_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\build_x64.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:4836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

build_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\build_x64.exe
Size 620KB
SHA256 7ff52b7d9918e9f049d119cf8437bc90c5dc7d032aa65e4c9f7775f96a465a44
MD5 3b37102f10863330a2fe6658cd6058af
SHA1 c2b47dd2650965acffa3b5e72daf30d624a2c094
SHA512 672f7d7bc539c19472d753c4451e3ae48fcbc329007c50615a237c73f516fe01c74a54ecaa28a892df8d1744a7a307f1228c9408bd0d18d6d7e9490e64647583
SSDEEP 6144:qKOEx+/9I7iIPqiSomRTcWbHiddZZSuXx2+4bPKm4+WCTNZil10lAJNxcGUv1ocI:qK+MFSoiTcWbCddgo1Tb2vGcqgp
TLSH
T165D47C56EBE402F9D17BC1B4CA829856EB77B855133065CB03E209675F3B6A05F3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download