9bb6f0bdf474f8333f7567121296c983db145c3a67a0c23b92ff1f8a66a5e12f

Analysis

user interaction
yes
max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 16:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
disk-drill-win.exe
Size 54.0MB
Sample260930-t11ppsx16m
SHA256 9bb6f0bdf474f8333f7567121296c983db145c3a67a0c23b92ff1f8a66a5e12f
MD5 7f9487eaf5b2e641acde6f422b90c4ad
SHA1 19ea70014c329d0c4725c346e167b138219e96d3
SHA512 12d8512af95242ad783f0806798086af63bcf79444ca827d8cafcda923b3de39919784abede7886ed4aeb0d58b01a4973e9683c70f135bffe4c573211496fa99
SSDEEP 1572864:UWMUZXtM+4zcBraoJ9V4s4I1wzMe2/nt5m3qfzCZtS6x:brDfb1wo3/uoz2SM
TLSH
T13BC733B623E028E6D6F98336E5548531BEB07D0D232244ABC5A5FD2D3F36A6125BF305
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 2 IoCs

pid	Process
5392	wixstdba.exe
716	netcoresearch.exe

Loads dropped DLL 2 IoCs

pid	Process
2044	disk-drill-win.exe
716	netcoresearch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
716	netcoresearch.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 5392	2044	disk-drill-win.exe	90
PID 2044 wrote to memory of 716	2044	disk-drill-win.exe	91

C:\Users\Admin\AppData\Local\Temp\disk-drill-win.exe
"C:\Users\Admin\AppData\Local\Temp\disk-drill-win.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\TEMP\{3A23A842-E120-4F7A-B8E4-EE5C9285E4BB}\.ba\wixstdba.exe
  "C:\Windows\TEMP\{3A23A842-E120-4F7A-B8E4-EE5C9285E4BB}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{DA6A91E7-1249-42CA-B251-005A30701AE1} {641EB96E-02DE-4B2B-B83C-CE84206EC543}
  2⤵
  - Executes dropped EXE
  PID:5392
- C:\Windows\TEMP\{3A23A842-E120-4F7A-B8E4-EE5C9285E4BB}\.ba\Wix4NetfxBootstrapperExtension_X64\x64\netcoresearch.exe
  "C:\Windows\TEMP\{3A23A842-E120-4F7A-B8E4-EE5C9285E4BB}\.ba\Wix4NetfxBootstrapperExtension_X64\x64\netcoresearch.exe" runtime 9 Microsoft.WindowsDesktop.App
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Time Discovery
  PID:716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

thm.wxl

Path C:\Windows\TEMP\{3A23A842-E120-4F7A-B8E4-EE5C9285E4BB}\.ba\1033\thm.wxl
Size 5KB
SHA256 5e371262d9020a6b5a068c26d322543163148473e58342f13d77f0b18fdaefed
MD5 5123182334a9c071b158ec9b8cbe2db2
SHA1 3d2c4f4d426199edd70e392a8bb31baf994e675f
SHA512 893829b9c9006726585a8c9349452cb3493f26eb2891b928f2f2677b84e4d3c0b908beef6ac1e9807d14ddb5d7bb2310827a3838f8a0f39cb15a3bf509614955
SSDEEP 96:HLnw7K0beMsifTuMG1+XSBc0zFA0SDwZQpCeYP4b0i:MbRXT/GTeS1wgi
TLSH
T101B1DF6FA8CFEBE02673265472F755862518C2DA532B2CF1FC66050B836760163B3B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{3A23A842-E120-4F7A-B8E4-EE5C9285E4BB}\.ba\BootstrapperApplicationData.xml
Size 16KB
SHA256 060f88080c0d8ef9d56709402e1004c40ae88d6647b4ed5f9da16703851080c4
MD5 183c7bfb522adbca3d370d1bd7e13fa6
SHA1 87a92bcf8574b593f394bb1d1950d03bcecd8a6d
SHA512 7d40e3e30f7596b01168ec1d2d5c6f622f74347033e506135be23a6a5ac000b35d29074548b892d599ab5c8a0907b40849f43da97f53ec86ec61f7bb5ad01fde
SSDEEP 192:DzDqRV2MUX3gU/LkgORRiZmj0/WsyqgW/qPZ1ykgw/ERpgNu2+QuQ4033D8szcsR:G5ZBiBu9PW3sJsosu
TLSH
T1B47235152BFD0229F1F35F48EEF945166A35BC91AE38CA2D00611E0F4972E41D8B2F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DD.ico

Path C:\Windows\TEMP\{3A23A842-E120-4F7A-B8E4-EE5C9285E4BB}\.ba\DD.ico
Size 220KB
SHA256 5c45a051dd6cd7ca010a30898eb36b72452517924cc769dd4535dd5839be8c6a
MD5 1a0f29ffcb1df4a930463870146d36c3
SHA1 00ac4450baaaf035b19b5fb05b157fa843245bda
SHA512 0ec05a30be8752c94f106180096000a47a77f3e94c7e7d0b461085264d94af82a5078713cb9f30b64a26b30315bb87b4c3cac7182dfe8c2d9dae8efe02a15144
SSDEEP 6144:VQRYLEVJysny9mg5xALb8aGelLHyGZsNj8m7Zaot:a8mJTy9mg5qLbWelryGyNj8mZ
TLSH
T10B249FB4FA412A2AC52E7436D0378D6124512EADC178DD9749F3BDAF3C1E0539E38A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostfxr.dll

Path C:\Windows\TEMP\{3A23A842-E120-4F7A-B8E4-EE5C9285E4BB}\.ba\Wix4NetfxBootstrapperExtension_X64\x64\hostfxr.dll
Size 366KB
SHA256 cbde5e0bb9260e4ceeb0c7d774cb3aba0f885f150c9c8fe3922da4c71125f628
MD5 d78ba64f3c660b2af200757ae3a41688
SHA1 aef16497474845b15fc5a60494d53c79cc3e4961
SHA512 31aca945758bee357a6625440d910c49ad005695990028323a1e634be597ee047b25c36594c776d8776945e8363a8148ffebcd25ca77064d747889d2c0917fa4
SSDEEP 6144:6r6HIxaAxFwPGChDDJ4zHzqEnEA229D4Fc9xAyK:m6HIxhx6PGChczQylAyK
TLSH
T18E841916E2AC056CF1BBE23896B79901F6763C4A4770D6CF03A0416A2F77BD09E79721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo-200pct.png

Path C:\Windows\TEMP\{3A23A842-E120-4F7A-B8E4-EE5C9285E4BB}\.ba\logo-200pct.png
Size 231KB
SHA256 7fa4ca56fdde25236d18f0dfa5d94dffc918358fe7cea58e1c23dbe3af7cc073
MD5 f7451f8a0c7dde366a0ef6a18c05aca4
SHA1 daf6e2c0bfd101e32810b50e86a9d26a3aa7eb42
SHA512 a7251f08beddcde2c60b7d718e2815a4977de742b49f151ae44d7ead7ef4ecc67a3becec54d22fff6c16b9a42bf0ab4c8d4cf997319a4e2a54fe71dc209ab3cc
SSDEEP 3072:WwWyZBEGhIyv9KTyzlOXzwob8Zl+jU+oKZJWh25EfuVE8xXyfyMdn2b59xj1YYiU:WwWgPhImYJz98ZlOU+fAunxCfwrxGA
TLSH
T1D634230007E2B96FE92BE71A0BE35EE7808F7284C71C29F46F0871755D698B1DD54A39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\TEMP\{3A23A842-E120-4F7A-B8E4-EE5C9285E4BB}\.ba\logo.png
Size 80KB
SHA256 bcc352480c5bb9be1021442b5f1c948a33504d75b9c76f899eb3244e0b40c786
MD5 bc348d03ed3d614eeb776df9c17dd0c9
SHA1 0d0628742f480a07e08f251d7ffa6d2c671b6811
SHA512 12b12b6ccece3de9e76562ca83e078cf502e0de34747abe84f70665bd2727f4cdd62d04a1811095440c5f52fcc2b4a07f3c45b2fd3bf7d1933b596a09b5cf311
SSDEEP 1536:Y4MCaiPJfg3hBU6Olus7//oJYr3/IdazNsQfCx3Endtc0XwRxw:Y5M6wbwdMyxUnzz
TLSH
T19C8312642F76038D638F001A734BCBC16A9347D98B3EA6BA527B8D2F91C86301BDD557
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{3A23A842-E120-4F7A-B8E4-EE5C9285E4BB}\.ba\thm.xml
Size 9KB
SHA256 f4c0b1b149aaa5655c21beccac78914b3359562ea9edcd99ad026c0612fdee2a
MD5 fc7ad661159f901a91038cea8105cebd
SHA1 ae31728145a73d6ad6ae2fb019d7d16cd0b16034
SHA512 35fe13406dbb312a6a1f99e3862b33731c1668e12d5b7150f92ffc22442d1f0cf24156e599c2ee65a83c4e1660eab98d0ac11c74b845b0826025d7ac4cb7142e
SSDEEP 96:HLBbrHRe13xsSqPNLMYMtlqpLqkXgTeiiQL0BZLJBvL0qu3hXOZkLM1MXpIqoJLc:FjRevsfNMDSQCk23K/M6X8yU0
TLSH
T159229BB966DD7806D223F72366F322C17E17BC60C5D42A49B90D2AB71BD212078732BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

netfxbe.dll

Path C:\Windows\Temp\{3A23A842-E120-4F7A-B8E4-EE5C9285E4BB}\.ba\Wix4NetfxBootstrapperExtension_X64\netfxbe.dll
Size 185KB
SHA256 116be6ab9bf4f967a045ace9f7646d788710c7f1652bb2df94d7f626d3de18fb
MD5 6479772b6687cfb0bfdf5a18a239aaa7
SHA1 a39b18a9bfb5ec892a1bc3140e0d59ec75e4a2a3
SHA512 e0535646fbfbaa7b714c7edcab3b8f7757222526d8bc9be0f25d94166a294eb0cb305a4d50ae081277b59c2cfff2e832a7b874235dbb1c0f4cd92fe63eb6ef3d
SSDEEP 3072:Fk8jMR4qeDXSB0xOWF/lQ0LWWTBH4LQTfOjZHSw9P4:Fk8jj/UK9zLTV8FxG
TLSH
T177047C1A77B400BAEDB74278C8930616FB727815172097EF43A442399F3F391A97EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

netcoresearch.exe

Path C:\Windows\Temp\{3A23A842-E120-4F7A-B8E4-EE5C9285E4BB}\.ba\Wix4NetfxBootstrapperExtension_X64\x64\netcoresearch.exe
Size 158KB
SHA256 e8abfbe092b6284f951b320163551253027d2ba5e31908237639c4d120cf0ec3
MD5 c5587fe3ff3736f62c8b4212e5dfe0a6
SHA1 b1fb9870c26b4b13c1232d660e5d8e3a739182e8
SHA512 6657ea8d966cea2aa128041cbb7563f49a9882ee9340a61c8c4919fe37c6101ba857b86e4f6b86126464ae91d684e3080e7f4030feb49da3603d1b4c7dd453e0
SSDEEP 3072:wyEgJvJxw1n2a/k6P2cHuUx4pPFzi5v4Rb3GswP9:wyEgJBaga/b2VUx4gibWl
TLSH
T1D2F36B5773A430E9E1B78638C8911612FB76B43117209BDF47A4827A1F276D1AE3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{3A23A842-E120-4F7A-B8E4-EE5C9285E4BB}\.ba\wixstdba.exe
Size 489KB
SHA256 e05dda0c23421cfc7a2a39b91074928605e1e69ad5f0a2a4e230ed5996fe2ff9
MD5 8c03e8907ba4ab272dd305a3bca52bc7
SHA1 bdf3b9ad081792cce2a6ea8ac4b23d54c8add31f
SHA512 36a96a722df0d9a3e8ea8b9e4d98b4fee3c869883c2530863c6ef5b8255c73488e9607280f0491d9969fea8bf09381310a5684a2ac475ba569834549f5e119af
SSDEEP 6144:5jdeA6Rk9w8aCu8CwlLSHosx7BxoUzLKo2XSgt5Yxsuy:5ZfwkOpCu8N+jEUnOXSgLBZ
TLSH
T1F5B45BBA22F422E9C5F94276D581A122FF70B54C370091AF8614C93D6F3B9A939BF345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads