077b0f67edd0143b2c2c16c5a802f1036208afd8c035ccf71164a6813bb4533a

Analysis

max time kernel
154s
max time network
183s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 14:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ida-pro_93_x64win.exe
Size 619.0MB
Sample261002-r5vm5svvcs
SHA256 077b0f67edd0143b2c2c16c5a802f1036208afd8c035ccf71164a6813bb4533a
MD5 2ab7e2555b80a51dfa6d344fbd088922
SHA1 36e0b7a6782bd90de6fa677b9083a7bc72561658
SHA512 8dfc70adc63e706c613254c717e92cfbf4ce468bac072f2135f542b6f4570058bf8fb08cd54dc3a751698cd047ab62c0317d9f312233829ca9a410999691f4c5
SSDEEP 12582912:WiXhmBLKgLXxQ/WwOM+nPsJbZZ7prmCJ1awLAOv76GoJN1IQT1RtpLqusM7:WBLzTwhfVi61aqAGCJnX5RtwusM7
TLSH
T1D2693353EA90D4E8C97BC13D87234576AE31BC816024593FAB159BF13E63EF81B6A11C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion trojan

Malware Config

Signatures

Loads dropped DLL 14 IoCs

pid	Process
3752	ida-pro_93_x64win.exe
3752	ida-pro_93_x64win.exe
3752	ida-pro_93_x64win.exe
3752	ida-pro_93_x64win.exe
3752	ida-pro_93_x64win.exe
3752	ida-pro_93_x64win.exe
3752	ida-pro_93_x64win.exe
3752	ida-pro_93_x64win.exe
3752	ida-pro_93_x64win.exe
3752	ida-pro_93_x64win.exe
3752	ida-pro_93_x64win.exe
3752	ida-pro_93_x64win.exe
3752	ida-pro_93_x64win.exe
3752	ida-pro_93_x64win.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ida-pro_93_x64win.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ida-pro_93_x64win.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	ida-pro_93_x64win.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ida-pro_93_x64win.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3752	ida-pro_93_x64win.exe
3752	ida-pro_93_x64win.exe

C:\Users\Admin\AppData\Local\Temp\ida-pro_93_x64win.exe
"C:\Users\Admin\AppData\Local\Temp\ida-pro_93_x64win.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BR6D80.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000ea8\BR6D80.tmp
Size 128KB
SHA256 86bed5024f4dfb6c0b28f88a2d635653b3c8e7c8c13bb5c0276190efa00943d0
MD5 0a500f909ef4b58dba234bb3b8c779f7
SHA1 3b056818bae0da39c96b4c3fb42fd427b4a39c8d
SHA512 547b68421e0296e6919bd0d395749c0e26c7e6f341e905b5ec833108241126709639b3c2776942b7f2551dfce8e853fce62329f09f76faf853cd2cb6faff85d7
SSDEEP 1536:1LA+LGw/JeTcTLJ7MVg2dE75XlqqIClRHnroiLRX2UKbxSOAie+9+gRpkjzRB:jLGIJeTc/W/EFnRmTx3c+cgTkjzRB
TLSH
T15BD3F796A7D59C97DA28433945E6C325A33CF88437838F076E25D9391F337A0BF85682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BR6DFE.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000ea8\BR6DFE.tmp
Size 356KB
SHA256 3524ec77985e390acf9d07d81b1b44305165d711bbca770f7458ea0a78751f82
MD5 c3c4f3fe90e3b3b02bea0e8da3447ed2
SHA1 7ac0f54119d2273a2cd261f1fe6c5667e9c486df
SHA512 0e24c9394c635a3f1671a297f97b613e6936cd8f862a214125d3456324a18668ae138d5c4fde036f55e2b13b158e4cebc53f78153862a008b1ae747eab228a60
SSDEEP 6144:VaGsA5DNPvUvxrBSTj80COxO7PnDrK9RmvHCV7/Zv1fuvIl2:9sA5DlvUvNBSTjwOn9Avi71WvIE
TLSH
T1EA742933EFA215E9D87FC07889A3A313EEF1758C0429B68B4654CF055F66B51B239B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BR6EAB.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000ea8\BR6EAB.tmp
Size 59KB
SHA256 be88244da9faaa6636a9d2f4c4249c08066a0b48359690b9b27a2b9ed47e093d
MD5 f62dd6ce51e19349ec1d1f2e88c4ef4d
SHA1 60bd29538b4fecaf527ba8b7d92b7f32d2e72ddb
SHA512 ba68a59427ec252b895e1c3d6879e0c7a010893d23b5a8687ce86d738faaec1367f73abbcf63fb8ce8b95d32afa3049cd59f22f0bc5a2ff2a3b123a54fe02012
SSDEEP 768:kpR8lUiZHswDCxdJvuD0WZVVVR8RiTg8U2GO6WtxHDVBNqxsC4:uilUiihx3vVWGgTgT2GVWtC+D
TLSH
T1EC43D69679D49CDADA38823C45E7D2337638F9E006134B1B6634AA360F23FD17ED9681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BR6EFA.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000ea8\BR6EFA.tmp
Size 198KB
SHA256 ce4d21e414a7e8868bc5720c0da92000cdecb9744030598d7a36b5575b700133
MD5 3a2b68e78263a393af39b1d936c67de1
SHA1 d27907f49aeb9b155d60d17d3800a00388bcebe7
SHA512 236f35a1f0bd41cb77dec4a571f0ca1aebd332a001c835bef31c6bddeb8e64b4bc9ab47d7148659faf4a1bae9a994afee4c3bca35aab0a1e9ea0f21fda54e7a0
SSDEEP 3072:3e9hNL2L5Wrfw26bny4ChutEDaR0HiwQId:3MhxXjw20y4CuEuDId
TLSH
T10D144C43B2D19D9ECE3A563949FFC3123375F094175AAF1B2A348A321F63AA03F85645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BR6F1B.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000ea8\BR6F1B.tmp
Size 813KB
SHA256 6d917bee03ffee7fd95c089684a9fd4b38b054d28b9c726f2daf370ed9ef7909
MD5 0807da9e4eb4f568f29c32c5ede1a72c
SHA1 7300b34eeeed3e907a803bb2239a096eaf92800d
SHA512 d1e67507353e99cb42f07f6f9a115d8c647c9c9c3b61dfc59072fddd06104147f854359ff98f92799b66dc22e169ab3a818ce77b71f768fd8b631c194e5ba510
SSDEEP 24576:ROM97Zu2kJOkR38ilVCwLlLgftA4vAt0yT38u3D:ROOpkJOG38CVyvASAsu
TLSH
T149054C13EDA251FDE8DFC1385796C326E872F41C16337BAB0E52EA356E52A611387603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BR6FE7.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000ea8\BR6FE7.tmp
Size 235KB
SHA256 aaa3d7e589e9be1911eee5974afa68c64af1bbd5e039ff6a82a15c2b54c0f9f0
MD5 51c675fc1ef0a62322052d3e86567c06
SHA1 e295d0b668105d81f9180ef1056d0528e4b2116a
SHA512 a352e82db5c930c73165a48337ae51acda7ebd393b8b0b57d03d2e1b5057c41c26b1f321759b7bc521166890853ecdad7b37531212243ad86e181e2252a3b78d
SSDEEP 1536:fvHdOlJYzc4WrA5jDuSILZnyjGi98RkYD1a9okwGN0DCcFAyG6MifymQxz+ZIKx3:ATc5WrA5jiAjXKR3HdCcqyG6e/NC5
TLSH
T192342CC875D4A8D3E67F837566C2F92272BCF2909723DF0392908E35052ABC56F66D81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BR7007.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000ea8\BR7007.tmp
Size 24KB
SHA256 2b93420dc2b1b8a74bf3d75fe99232303a3f692ceb1fdf2df27d40b7e8e6fa53
MD5 485ee2bcd31212c6088086081e7427ae
SHA1 749f4ed6ce7b5b26ac1f2d947afba7acdb19aaf9
SHA512 74b42018747b15420fa31004f07c7cffbda9517799864fdc4990a25595a942bf21f40e3b181fe182aaae4625049b665c80bbaebae0e63c0a1113a6a24c7c0741
SSDEEP 384:EwdQDOvZjrRVQ5UIyxqJbbSdn8X8SrTBBdofPviG2GLGnT:7Qcv5IBqn9Sryd
TLSH
T100B2E82FB7536CADC426C3BC52F68673E9F1781626329A2D4210D6703F72CA05BBE954
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BR70F2.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000ea8\BR70F2.tmp
Size 19KB
SHA256 034756f772399552cd33605a189ee0e45d7947860e0d83ec12aa6da1a5a42054
MD5 a56543b9cd3aa403311b49189d25851e
SHA1 bd2609d35d4a967fe23ef4092b1daa6f74a858ad
SHA512 2237f493d70799675ae0e395f551b6cd46ff4789e46e2453c48fede07b7623b4b8111904d6fa139c204eea4405b5fd5812b0a91f27374219b721339149c25edf
SSDEEP 384:szVLiyxZuZ1R0PCtHIsyhxCTPBX0O1Ok:ELiyx60Y2XC5L1
TLSH
T10E92F90FBBC294ADC53BD37482F7D732987174611236762A0764DB705FA0EA0AB7D628
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BR72C8.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000ea8\BR72C8.tmp
Size 96KB
SHA256 9426e96a97f41645fab524385a852687792f99b505554b6b9809ed99451b2399
MD5 9b299884420745d80c70bba6b8a7f05a
SHA1 195423185a7776e072a65fbabae868c15f7b2f56
SHA512 ed839dc1b6ef53f3663b6055fb2869a522600b2af8d8a800958ddb531154f4e9a3f1733f32dff5511a22fe01525191c8683519cbdcedec138b1bcf3425f2155b
SSDEEP 1536:EbWmOP8RKRZ6j2oGbgY2pUA6hHkVWWdXW:rf8XyoxpUA+HYdXW
TLSH
T13BA319817B945CD9C9759A3C46F6D3326A3DF5E002B39F4B9B2496380F12AD1FF88648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BR72E8.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000ea8\BR72E8.tmp
Size 179KB
SHA256 ef4616f642d3a809b124fdc2eb75bbac155689c844c03c45cf848923b2cb4bd9
MD5 a48e0e11b1a62963bb3676dd44b9d944
SHA1 6e6d9e8dbeb2b155a721746a893b91496d916f46
SHA512 0717dd85f55730b7492f6f98e72cfbfba4f91d3cb18f1c757cd136d619ac4e774eb62e7080579a806856deaf462dbe4561f3e2b2896bc93a343f611a2e02488e
SSDEEP 3072:ZilUKN/dJi3I1V2PfBKb8Ftxhc8C9EY4RVWySluN3HW:ZFC/deQK7UE1WluN3HW
TLSH
T1EC043983A7A59CEFCD29433945ABC322B375F4801777EF5B192089351F63AA03F86646
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BR7357.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000ea8\BR7357.tmp
Size 26KB
SHA256 44e5f5f11a3c25be0880819cb42647fb7840d6b3260ef32c91a8ae44d308e58f
MD5 56ec6f11e89a3b8c34d7465a7a887a68
SHA1 8aa6f5a584a5fbc195d9ec2fe9aaf05203615b9c
SHA512 81362d299a5259db9dbd12d654ce2372ca2eac36bdfec29071f2ded353cbe6ca41dee801d3fdaf0ef0232027ca2042179faeb6c92da1fc896f47e7e026c1a227
SSDEEP 384:Gpdh0MtlEe5dufwwHezmAWZtxbS4vVuBpoOdWoTMB8JFtOezSpQ9t:gRtl/LwH2FW7SnJWoppOY
TLSH
T1D7C2FA1AE36315EDC527C57582BAE333E8B17C161134B32A9A60EF351F31BD0A71A729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BR7367.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000ea8\BR7367.tmp
Size 40KB
SHA256 c9deef1cc37b85c2c166fbcbee6f018a2d65128abb170174e80c129f3171b065
MD5 8374ba3961c06702059039498055bd6b
SHA1 ffa611afc2487744f2bff64f16ad4bc9c50a5c40
SHA512 9082448a999951a2fa2d27762641237f8dcbf59fef8edf7459eebfd30147617192bfb8ab0d6080c611560703b99ff0825166ceb763b2b0811bbbb813969b6493
SSDEEP 384:Lxv9Ls6tWNkrErbyRibbk7S8sirUEKlvYr5vbZGTYBFSX/zTzfTUrHczc:du6tWir1sJINtGTHzfTov
TLSH
T1AE132A5AB983C8ADC513C1B082B6BB33E5B174110125ED3E2721DF745FB7F906A2BA19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BR7378.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000ea8\BR7378.tmp
Size 209KB
SHA256 3257c2d167916a57e61022fff9a9bd9ea0a7c9f1ce8f00eea4c84039f4519200
MD5 92214d8b40f8a391e3ce67ceb9780e39
SHA1 81cb719a5a72420f611082dd93eebc39921892d1
SHA512 3295ea719445377c9ff7a009dc6bf077d180dd8803ee2a94cb44c45f98b8045505734f74aba34239013f84f06c15a095aabec019d1fde1addeb47d6972e5b7e4
SSDEEP 3072:hLNfuqA0ZtfRIRbWqGM+Bi7j54yKnocqdslQe4aoMXycswAoaMszgwpUVbV:FNY0j6RygZj6yKnpqmlx4aDic2oJ3
TLSH
T1AE247D47E2B35CBCDA57C1748257E372BA71B8610234EE7F0AA4DB311D11D607B2AA39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BR73A8.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000ea8\BR73A8.tmp
Size 90KB
SHA256 150ac0b7099a90f654c070275ede790cd9ad10dedcb537d9730e97d13d56bc1c
MD5 8b866ca087f9c424bdb8caadd124e1e0
SHA1 41832ea2035dbb92db93cff1c6b30a0ea307431f
SHA512 2f977962c8fdcdab1725fda9a3b304a29e9ac977b3589f7d0449be8ea965a32f12fe971cafc0daecad54f0d668dd61f4d5b418249ccd7f6b583a1ef2aacc0d5d
SSDEEP 1536:VF7bWaW4Ct4jdJrnz9vBrqcMTtjqqzTvX5FTpRn6dhdIObIOP:VFHI4pphvBrdMEqzjX5FTph2XNP
TLSH
T116937E576A9761FCC67781B0C2E2CB7AAA30F81015706BAF5258EBB01F11D902F596FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3752-71-0x0000000056670000-0x0000000056696000-memory.dmp

Download

memory/3752-83-0x00000000564C0000-0x00000000564DF000-memory.dmp

Download

memory/3752-74-0x0000000056590000-0x0000000056667000-memory.dmp

Download

memory/3752-82-0x00000000564E0000-0x000000005651E000-memory.dmp

Download

memory/3752-81-0x0000000056520000-0x0000000056533000-memory.dmp

Download

memory/3752-80-0x0000000056540000-0x0000000056550000-memory.dmp

Download

memory/3752-78-0x0000000066C00000-0x0000000066C1B000-memory.dmp

Download

memory/3752-77-0x000000006CA00000-0x000000006CA0E000-memory.dmp

Download

memory/3752-76-0x0000000070140000-0x000000007014F000-memory.dmp

Download

memory/3752-75-0x000000006C580000-0x000000006C599000-memory.dmp

Download

memory/3752-73-0x00000000710C0000-0x00000000710F4000-memory.dmp

Download

memory/3752-72-0x0000000066680000-0x0000000066695000-memory.dmp

Download

memory/3752-70-0x00000000009E0000-0x0000000000CBD000-memory.dmp

Download

memory/3752-79-0x0000000056550000-0x0000000056582000-memory.dmp

Download

memory/3752-84-0x00000000009E0000-0x0000000000CBD000-memory.dmp

Download

memory/3752-98-0x00000000009E0000-0x0000000000CBD000-memory.dmp

Download

memory/3752-112-0x00000000009E0000-0x0000000000CBD000-memory.dmp

Download

memory/3752-126-0x00000000009E0000-0x0000000000CBD000-memory.dmp

Download

memory/3752-140-0x00000000009E0000-0x0000000000CBD000-memory.dmp

Download

memory/3752-154-0x00000000009E0000-0x0000000000CBD000-memory.dmp

Download

memory/3752-168-0x00000000009E0000-0x0000000000CBD000-memory.dmp

Download

memory/3752-182-0x00000000009E0000-0x0000000000CBD000-memory.dmp

Download

memory/3752-196-0x00000000009E0000-0x0000000000CBD000-memory.dmp

Download

memory/3752-210-0x00000000009E0000-0x0000000000CBD000-memory.dmp

Download

memory/3752-224-0x00000000009E0000-0x0000000000CBD000-memory.dmp

Download

memory/3752-238-0x00000000009E0000-0x0000000000CBD000-memory.dmp

Download

memory/3752-252-0x00000000009E0000-0x0000000000CBD000-memory.dmp

Download