ea1fb2197b20e84f82287e5bc7d4e0109ce3a387b0ffa5775cb1be5421ada82d

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 15:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ea1fb2197b20e84f82287e5bc7d4e0109ce3a387b0ffa5775cb1be5421ada82d.exe
Size 2.2MB
Sample261014-talg4aft4t
SHA256 ea1fb2197b20e84f82287e5bc7d4e0109ce3a387b0ffa5775cb1be5421ada82d
MD5 6ba173c68481c0c77994ceee0edaf797
SHA1 4c2edb5bfddc5c55cf50f7c41cfbbaf70171845e
SHA512 f43f88506d43fbd85aa6ebe9207890a915b6153e57205e8e6e4aa68e95de8a39056124d033fcb2fe7a20acf1e8ac5270da3e3b184429d9003a0f8faf7df229bc
SSDEEP 49152:uZWQXjf2mdOWxL2wO3REUe8PpBMuT390X/R75c5Gm8yqD+snjRKllGKInISO:ukENcgO3REnuT390X/R75c5RRqD+snj5
TLSH
T198A58E4BB7A411E8E1B7C17DCD574A06EBB2BC155331D7CF02A4469A1F232E14EBA722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2284	unst1791993080450-copied.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 2284	4964	ea1fb2197b20e84f82287e5bc7d4e0109ce3a387b0ffa5775cb1be5421ada82d.exe	89

C:\Users\Admin\AppData\Local\Temp\ea1fb2197b20e84f82287e5bc7d4e0109ce3a387b0ffa5775cb1be5421ada82d.exe
"C:\Users\Admin\AppData\Local\Temp\ea1fb2197b20e84f82287e5bc7d4e0109ce3a387b0ffa5775cb1be5421ada82d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Users\Admin\AppData\Local\Temp\unst1791993080450-copied.exe
  "C:\Users\Admin\AppData\Local\Temp\unst1791993080450-copied.exe" --source_path="C:\Users\Admin\AppData\Local\Temp\ea1fb2197b20e84f82287e5bc7d4e0109ce3a387b0ffa5775cb1be5421ada82d.exe"
  2⤵
  - Executes dropped EXE
  PID:2284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Dola-uninstaller.log

Path C:\Users\Admin\AppData\Local\Temp\Cici\User Data\sdk_storage\log\Dola-uninstaller.log
Size 1KB
SHA256 740481dd721f194ed8ee89e17e35989df3b9c0d2d0543f52cf3d7652595edfb4
MD5 8628389ec9fc34894dedfb55f19dbafa
SHA1 dd0796d3f8eebdcf0ca78db294fd93c4ffe3dbdb
SHA512 fa547ca4990cf2bcf67c6f9598edb3b07fd88bdda2696b077a40ed91afb8a63e3a6a21f871a0b48dc79f07d4ce01ed149a2a120da7a2944fa8d135cf0c36dd38
TLSH
T1D9311AC34C15947B7E8CC6542F096D89CCE1D0BF9ECC2A88677BF264998E70A605F65C
MD5 SHA1 SHA512 TLSH

Submit Download

unst1791993080450-copied.exe

Path C:\Users\Admin\AppData\Local\Temp\unst1791993080450-copied.exe
Size 2.2MB
SHA256 ea1fb2197b20e84f82287e5bc7d4e0109ce3a387b0ffa5775cb1be5421ada82d
MD5 6ba173c68481c0c77994ceee0edaf797
SHA1 4c2edb5bfddc5c55cf50f7c41cfbbaf70171845e
SHA512 f43f88506d43fbd85aa6ebe9207890a915b6153e57205e8e6e4aa68e95de8a39056124d033fcb2fe7a20acf1e8ac5270da3e3b184429d9003a0f8faf7df229bc
SSDEEP 49152:uZWQXjf2mdOWxL2wO3REUe8PpBMuT390X/R75c5Gm8yqD+snjRKllGKInISO:ukENcgO3REnuT390X/R75c5RRqD+snj5
TLSH
T198A58E4BB7A411E8E1B7C17DCD574A06EBB2BC155331D7CF02A4469A1F232E14EBA722
MD5 SHA1 SHA512 SSDEEP TLSH