3d75ce1417a3075647bcf9a09c7437b1524bfc4f7854b5a69c2ef99f00c84cda

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3d75ce1417a3075647bcf9a09c7437b1524bfc4f7854b5a69c2ef99f00c84cda.exe
Size 2.1MB
Sample261014-rzd37set61
SHA256 3d75ce1417a3075647bcf9a09c7437b1524bfc4f7854b5a69c2ef99f00c84cda
MD5 d9f1623512116db011770795827b58b9
SHA1 05e34a2f184519798e792269eaeb8adfe6fe957c
SHA512 4a85b79f1ca87b115a2988f00cd1de40a02cca5d83f99cfadf074bbf8db0c91454d6c35c3b1f4e6165c91047e114ea0a74e5829b607665dc5b19c45ad64ad50a
SSDEEP 49152:PZWQXjf2mdHW2L2wO3REUe8PpBelT390X/R75c5Gm8yqD+snjRKllGKInISL:PkENxFO3RE5lT390X/R75c5RRqD+snj5
TLSH
T1D6A58E4BB7A411E8E1B7C17DCD574A06EBB2BC155331D7CF02A4469A1F232E14EBA722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5936	unst1791988657511-copied.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 5936	4316	3d75ce1417a3075647bcf9a09c7437b1524bfc4f7854b5a69c2ef99f00c84cda.exe	89

C:\Users\Admin\AppData\Local\Temp\3d75ce1417a3075647bcf9a09c7437b1524bfc4f7854b5a69c2ef99f00c84cda.exe
"C:\Users\Admin\AppData\Local\Temp\3d75ce1417a3075647bcf9a09c7437b1524bfc4f7854b5a69c2ef99f00c84cda.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Users\Admin\AppData\Local\Temp\unst1791988657511-copied.exe
  "C:\Users\Admin\AppData\Local\Temp\unst1791988657511-copied.exe" --source_path="C:\Users\Admin\AppData\Local\Temp\3d75ce1417a3075647bcf9a09c7437b1524bfc4f7854b5a69c2ef99f00c84cda.exe"
  2⤵
  - Executes dropped EXE
  PID:5936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Dola-uninstaller.log

Path C:\Users\Admin\AppData\Local\Temp\Cici\User Data\sdk_storage\log\Dola-uninstaller.log
Size 1KB
SHA256 a4d05dba6b789ddac3976b51d3034fbcb12e6e83cba09adf1fcfde84aefa26fc
MD5 58fd1b035871d81230ac9690de068793
SHA1 bca4840708e07f09ce2d08e3ef049a2741051073
SHA512 ff4d4efd9780c08c62c6c2c3571e922ac9abf90d334382948c697b57b8b6be6e29e5478140e8b067e623c70ddc804defabe11cac222075c6bc24aea22496abd9
TLSH
T1BA3124CB2C5190B7B9CCC661208E6D4AE8E2E47F4F8C5B487386C6548E4F306667EA58
MD5 SHA1 SHA512 TLSH

Submit Download

unst1791988657511-copied.exe

Path C:\Users\Admin\AppData\Local\Temp\unst1791988657511-copied.exe
Size 2.1MB
SHA256 3d75ce1417a3075647bcf9a09c7437b1524bfc4f7854b5a69c2ef99f00c84cda
MD5 d9f1623512116db011770795827b58b9
SHA1 05e34a2f184519798e792269eaeb8adfe6fe957c
SHA512 4a85b79f1ca87b115a2988f00cd1de40a02cca5d83f99cfadf074bbf8db0c91454d6c35c3b1f4e6165c91047e114ea0a74e5829b607665dc5b19c45ad64ad50a
SSDEEP 49152:PZWQXjf2mdHW2L2wO3REUe8PpBelT390X/R75c5Gm8yqD+snjRKllGKInISL:PkENxFO3RE5lT390X/R75c5RRqD+snj5
TLSH
T1D6A58E4BB7A411E8E1B7C17DCD574A06EBB2BC155331D7CF02A4469A1F232E14EBA722
MD5 SHA1 SHA512 SSDEEP TLSH