1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 04:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe
Size 39KB
Sample261017-esepyaht2m
SHA256 1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4
MD5 a489ff41e67c097052da2f1ac009db7d
SHA1 4bb912bcc2c142129bfb909b6786ce47e3394833
SHA512 6c082cf1dd429d4e7f949bcd0a12911caa5758728af25d080c6b6451e5584411e44f840f7ddee6008707f18e6f6be9f834133c22b39c4bf2b03c16faa83ab830
SSDEEP 768:XpiyA8wmnNlzk9rrKmut8/wp3JklVHzRnn7SLKW7:5iyA8wmnNl0r1dKZkld1nn7SmY
TLSH
T15B033A5573ACCF6BD27E0FBC61A1111947B266272616DBCC0DC8A4DE2DA77808610FEB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings	1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 3940	4460	1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe	90
PID 4460 wrote to memory of 2236	4460	1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe	92
PID 4460 wrote to memory of 1460	4460	1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe	96
PID 4460 wrote to memory of 1744	4460	1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe	98
PID 4460 wrote to memory of 6020	4460	1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe	100
PID 4460 wrote to memory of 1772	4460	1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe	102
PID 4460 wrote to memory of 3476	4460	1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe	105
PID 4460 wrote to memory of 2572	4460	1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe	107
PID 4460 wrote to memory of 3544	4460	1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe	109
PID 4460 wrote to memory of 2192	4460	1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe	111
PID 4460 wrote to memory of 3296	4460	1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe	113
PID 4460 wrote to memory of 4948	4460	1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe	115
PID 4460 wrote to memory of 5128	4460	1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe	117
PID 4460 wrote to memory of 256	4460	1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe	119
PID 4460 wrote to memory of 6052	4460	1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe	121
PID 4460 wrote to memory of 1748	4460	1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe	123
PID 4460 wrote to memory of 4500	4460	1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe	125
PID 4460 wrote to memory of 3420	4460	1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe	127
PID 4460 wrote to memory of 4656	4460	1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe	129
PID 4460 wrote to memory of 5972	4460	1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe	131
PID 4460 wrote to memory of 1556	4460	1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe	133
PID 4460 wrote to memory of 3596	4460	1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe	135
PID 4460 wrote to memory of 3704	4460	1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe	137
PID 4460 wrote to memory of 1820	4460	1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe	139
PID 4460 wrote to memory of 1368	4460	1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe	141
PID 4460 wrote to memory of 3680	4460	1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe	143
PID 4460 wrote to memory of 4672	4460	1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe	145
PID 4460 wrote to memory of 3456	4460	1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe	147
PID 4460 wrote to memory of 5100	4460	1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe	149
PID 4460 wrote to memory of 1680	4460	1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe	151

C:\Users\Admin\AppData\Local\Temp\1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe
"C:\Users\Admin\AppData\Local\Temp\1c5859d8de01ba71cff836cdaf7b49db583127a6005f87e98c363586df5168e4.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --noproxy "*" -o NUL -sS --connect-timeout 2 --max-time 2 -w "%{time_appconnect},%{time_starttransfer},%{remote_ip},%{http_code}" "https://example.com/"
  2⤵
  PID:3940
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --noproxy "*" -o NUL -sS --connect-timeout 2 --max-time 2 -w "%{time_appconnect},%{time_starttransfer},%{remote_ip},%{http_code}" "https://example.com/"
  2⤵
  PID:2236
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --noproxy "*" -o NUL -sS --connect-timeout 2 --max-time 2 -w "%{time_appconnect},%{time_starttransfer},%{remote_ip},%{http_code}" "https://example.com/"
  2⤵
  PID:1460
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --noproxy "*" -o NUL -sS --connect-timeout 2 --max-time 2 -w "%{time_appconnect},%{time_starttransfer},%{remote_ip},%{http_code}" "https://example.com/"
  2⤵
  PID:1744
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --noproxy "*" -o NUL -sS --connect-timeout 2 --max-time 2 -w "%{time_appconnect},%{time_starttransfer},%{remote_ip},%{http_code}" "https://example.com/"
  2⤵
  PID:6020
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --noproxy "*" -o NUL -sS --connect-timeout 2 --max-time 2 -w "%{time_appconnect},%{time_starttransfer},%{remote_ip},%{http_code}" "https://example.com/"
  2⤵
  PID:1772
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --noproxy "*" -o NUL -sS --connect-timeout 2 --max-time 2 -w "%{time_appconnect},%{time_starttransfer},%{remote_ip},%{http_code}" "https://example.com/"
  2⤵
  PID:3476
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --noproxy "*" -o NUL -sS --connect-timeout 2 --max-time 2 -w "%{time_appconnect},%{time_starttransfer},%{remote_ip},%{http_code}" "https://example.com/"
  2⤵
  PID:2572
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --noproxy "*" -o NUL -sS --connect-timeout 2 --max-time 2 -w "%{time_appconnect},%{time_starttransfer},%{remote_ip},%{http_code}" "https://example.com/"
  2⤵
  PID:3544
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --noproxy "*" -o NUL -sS --connect-timeout 2 --max-time 2 -w "%{time_appconnect},%{time_starttransfer},%{remote_ip},%{http_code}" "https://example.com/"
  2⤵
  PID:2192
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --noproxy "*" -o NUL -sS --connect-timeout 2 --max-time 2 -w "%{time_appconnect},%{time_starttransfer},%{remote_ip},%{http_code}" "https://example.com/"
  2⤵
  PID:3296
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --noproxy "*" -o NUL -sS --connect-timeout 2 --max-time 2 -w "%{time_appconnect},%{time_starttransfer},%{remote_ip},%{http_code}" "https://example.com/"
  2⤵
  PID:4948
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --noproxy "*" -o NUL -sS --connect-timeout 2 --max-time 2 -w "%{time_appconnect},%{time_starttransfer},%{remote_ip},%{http_code}" "https://example.com/"
  2⤵
  PID:5128
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --noproxy "*" -o NUL -sS --connect-timeout 2 --max-time 2 -w "%{time_appconnect},%{time_starttransfer},%{remote_ip},%{http_code}" "https://example.com/"
  2⤵
  PID:256
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --noproxy "*" -o NUL -sS --connect-timeout 2 --max-time 2 -w "%{time_appconnect},%{time_starttransfer},%{remote_ip},%{http_code}" "https://example.com/"
  2⤵
  PID:6052
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --noproxy "*" -o NUL -sS --connect-timeout 2 --max-time 2 -w "%{time_appconnect},%{time_starttransfer},%{remote_ip},%{http_code}" "https://example.com/"
  2⤵
  PID:1748
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --noproxy "*" -o NUL -sS --connect-timeout 2 --max-time 2 -w "%{time_appconnect},%{time_starttransfer},%{remote_ip},%{http_code}" "https://example.com/"
  2⤵
  PID:4500
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --noproxy "*" -o NUL -sS --connect-timeout 2 --max-time 2 -w "%{time_appconnect},%{time_starttransfer},%{remote_ip},%{http_code}" "https://example.com/"
  2⤵
  PID:3420
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --noproxy "*" -o NUL -sS --connect-timeout 2 --max-time 2 -w "%{time_appconnect},%{time_starttransfer},%{remote_ip},%{http_code}" "https://example.com/"
  2⤵
  PID:4656
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --noproxy "*" -o NUL -sS --connect-timeout 2 --max-time 2 -w "%{time_appconnect},%{time_starttransfer},%{remote_ip},%{http_code}" "https://example.com/"
  2⤵
  PID:5972
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --noproxy "*" -o NUL -sS --connect-timeout 2 --max-time 2 -w "%{time_appconnect},%{time_starttransfer},%{remote_ip},%{http_code}" "https://example.com/"
  2⤵
  PID:1556
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --noproxy "*" -o NUL -sS --connect-timeout 2 --max-time 2 -w "%{time_appconnect},%{time_starttransfer},%{remote_ip},%{http_code}" "https://example.com/"
  2⤵
  PID:3596
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --noproxy "*" -o NUL -sS --connect-timeout 2 --max-time 2 -w "%{time_appconnect},%{time_starttransfer},%{remote_ip},%{http_code}" "https://example.com/"
  2⤵
  PID:3704
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --noproxy "*" -o NUL -sS --connect-timeout 2 --max-time 2 -w "%{time_appconnect},%{time_starttransfer},%{remote_ip},%{http_code}" "https://example.com/"
  2⤵
  PID:1820
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --noproxy "*" -o NUL -sS --connect-timeout 2 --max-time 2 -w "%{time_appconnect},%{time_starttransfer},%{remote_ip},%{http_code}" "https://example.com/"
  2⤵
  PID:1368
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --noproxy "*" -o NUL -sS --connect-timeout 2 --max-time 2 -w "%{time_appconnect},%{time_starttransfer},%{remote_ip},%{http_code}" "https://example.com/"
  2⤵
  PID:3680
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --noproxy "*" -o NUL -sS --connect-timeout 2 --max-time 2 -w "%{time_appconnect},%{time_starttransfer},%{remote_ip},%{http_code}" "https://example.com/"
  2⤵
  PID:4672
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --noproxy "*" -o NUL -sS --connect-timeout 2 --max-time 2 -w "%{time_appconnect},%{time_starttransfer},%{remote_ip},%{http_code}" "https://example.com/"
  2⤵
  PID:3456
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --noproxy "*" -o NUL -sS --connect-timeout 2 --max-time 2 -w "%{time_appconnect},%{time_starttransfer},%{remote_ip},%{http_code}" "https://example.com/"
  2⤵
  PID:5100
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" --noproxy "*" -o NUL -sS --connect-timeout 2 --max-time 2 -w "%{time_appconnect},%{time_starttransfer},%{remote_ip},%{http_code}" "https://example.com/"
  2⤵
  PID:1680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5364

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

metrics.csv

Path C:\Users\Admin\AppData\Local\IPMonitorV5\metrics.csv
Size 4KB
SHA256 c1aa55de3341c4b648021911399cece1b51348a76149e8fec43a7cf40d018f38
MD5 712b8c745900fac248d2e506309e50b5
SHA1 fb2036cd10b8410e1d3a6421b6c7e397d64a529c
SHA512 5f44644c298e647072581dec02cbff13b6167a9af51c29f3faf07f999eecc550dd4d5d918f19212e43b09fd7db672368b3e690021a0180385b65cd8c4ad6116e
SSDEEP 48:7p2T2xFasHNwyb/ne1/80/eZ/vSqtz7kN1u/S0U/7b/7x/T:JNX/e1/1/a//YNw/9U/P/l/T
TLSH
T1D6A1D0084F6791F754D18A78D7CFD95A0BB50322304A18C2BAB6E745CC26D06E5C1BBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

monitor.xml

Path C:\Users\Admin\AppData\Local\IPMonitorV5\monitor.xml
Size 1KB
SHA256 68a3c0dc0b08736e6f8d4a65ac42c5820dbb3205ebb0f5451e07ce3427c49390
MD5 7da97208e51275e17aa64d5520545da1
SHA1 3c247220f24c6b8377b3effb7069d175039fe46c
SHA512 6ea71a13fafe8000be1dee4b58ee61e2df003c917a4fbe86210a8f37dac3796b6b9e03deaf888f14d0be562d0e4aa243c4c45729fa32f8271d47fbf48c254be3
TLSH
T17C21579D7BCC14D64A39C265D870E64BED3283CB428E04A1B0FC820B0F349A61917A33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4460-8-0x00007FFED5C80000-0x00007FFED6624000-memory.dmp

Download

memory/4460-9-0x00007FFED5C80000-0x00007FFED6624000-memory.dmp

Download

memory/4460-3-0x00007FFED5C80000-0x00007FFED6624000-memory.dmp

Download

memory/4460-5-0x00007FFED5C80000-0x00007FFED6624000-memory.dmp

Download

memory/4460-6-0x00007FFED5C80000-0x00007FFED6624000-memory.dmp

Download

memory/4460-7-0x00007FFED5C80000-0x00007FFED6624000-memory.dmp

Download

memory/4460-0-0x00007FFED5E0F000-0x00007FFED5E10000-memory.dmp

Download

memory/4460-4-0x00007FFED5C80000-0x00007FFED6624000-memory.dmp

Download

memory/4460-10-0x00007FFED5C80000-0x00007FFED6624000-memory.dmp

Download

memory/4460-2-0x00007FFED5C80000-0x00007FFED6624000-memory.dmp

Download

memory/4460-29-0x00007FFED5C80000-0x00007FFED6624000-memory.dmp

Download

memory/4460-35-0x00007FFED5C80000-0x00007FFED6624000-memory.dmp

Download

memory/4460-36-0x00007FFED5C80000-0x00007FFED6624000-memory.dmp

Download

memory/4460-37-0x00007FFED5C80000-0x00007FFED6624000-memory.dmp

Download

memory/4460-1-0x0000000000F30000-0x0000000000F40000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads