5996d7b661e6fa797f8255c958ef22b48ead21ec3046bb94adba84c782c63d8e

Analysis

max time kernel
158s
max time network
194s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ida-pro_95_x64win.exe
Size 717.2MB
Sample261018-vbld6assbt
SHA256 5996d7b661e6fa797f8255c958ef22b48ead21ec3046bb94adba84c782c63d8e
MD5 6365ad4216399781cc5c66d8315d193e
SHA1 db76c25d465332139adac40d7d4b8854ba44de14
SHA512 bb76153f34d7918bdaeb9735b97433fb6087f4a1fc27dbb5c87ad1f3e2baef4b31d5bcea3e4d7c04c86b14bfd24f16a9fb47ece6630b0704cb2cf177a7a3a438
SSDEEP 12582912:/7K2s1JwUnyk17zx4Dwc32iispBmaMQxv2APn2ulOpAiXbXcHSnZ5NYjsb/FZCua:/7KJJFB7g3sszFJBP2nlbMy6jY/FZCua
TLSH
T120793363E6B5C4E8CD7B80350E234B669E327C5660259E3F7A10BFA43E72D786B6510C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion trojan

Malware Config

Signatures

Loads dropped DLL 14 IoCs

pid	Process
5544	ida-pro_95_x64win.exe
5544	ida-pro_95_x64win.exe
5544	ida-pro_95_x64win.exe
5544	ida-pro_95_x64win.exe
5544	ida-pro_95_x64win.exe
5544	ida-pro_95_x64win.exe
5544	ida-pro_95_x64win.exe
5544	ida-pro_95_x64win.exe
5544	ida-pro_95_x64win.exe
5544	ida-pro_95_x64win.exe
5544	ida-pro_95_x64win.exe
5544	ida-pro_95_x64win.exe
5544	ida-pro_95_x64win.exe
5544	ida-pro_95_x64win.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ida-pro_95_x64win.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ida-pro_95_x64win.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	ida-pro_95_x64win.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ida-pro_95_x64win.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5544	ida-pro_95_x64win.exe
5544	ida-pro_95_x64win.exe

C:\Users\Admin\AppData\Local\Temp\ida-pro_95_x64win.exe
"C:\Users\Admin\AppData\Local\Temp\ida-pro_95_x64win.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:5544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BREB3C.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL000015a8\BREB3C.tmp
Size 128KB
SHA256 f3cc3f05682e1c6930fbf2cb35ecee4a5aa2fcada9cff72322bc1e289cbba718
MD5 8d9e765f0e8963c18d7c6587da2f0c9f
SHA1 9c2f62434d516c3dbdc2eb7fd0a21fef70a0617c
SHA512 efe49a56eae43c69a9b6ce7581bb965f4ea13e96c23f685ed5f245605476314b9635f1125be5c40deb1ca1a442bd2d96740718ad0bc3ce966321b3a042491bcd
SSDEEP 1536:EJGaZWpycAiciLJ7yVh2BE75flq60ClRHnroiSRQUKjBopuWVagyvbbDkjzRB:xpycAicYwEExaRQrBoJaLvXDkjzRB
TLSH
T16BD3F696A7D59C97DA28433945EAC325A33CF88437838F076E25D9391F33790BF85682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BREB9B.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL000015a8\BREB9B.tmp
Size 356KB
SHA256 3524ec77985e390acf9d07d81b1b44305165d711bbca770f7458ea0a78751f82
MD5 c3c4f3fe90e3b3b02bea0e8da3447ed2
SHA1 7ac0f54119d2273a2cd261f1fe6c5667e9c486df
SHA512 0e24c9394c635a3f1671a297f97b613e6936cd8f862a214125d3456324a18668ae138d5c4fde036f55e2b13b158e4cebc53f78153862a008b1ae747eab228a60
SSDEEP 6144:VaGsA5DNPvUvxrBSTj80COxO7PnDrK9RmvHCV7/Zv1fuvIl2:9sA5DlvUvNBSTjwOn9Avi71WvIE
TLSH
T1EA742933EFA215E9D87FC07889A3A313EEF1758C0429B68B4654CF055F66B51B239B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BREBF9.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL000015a8\BREBF9.tmp
Size 59KB
SHA256 be88244da9faaa6636a9d2f4c4249c08066a0b48359690b9b27a2b9ed47e093d
MD5 f62dd6ce51e19349ec1d1f2e88c4ef4d
SHA1 60bd29538b4fecaf527ba8b7d92b7f32d2e72ddb
SHA512 ba68a59427ec252b895e1c3d6879e0c7a010893d23b5a8687ce86d738faaec1367f73abbcf63fb8ce8b95d32afa3049cd59f22f0bc5a2ff2a3b123a54fe02012
SSDEEP 768:kpR8lUiZHswDCxdJvuD0WZVVVR8RiTg8U2GO6WtxHDVBNqxsC4:uilUiihx3vVWGgTgT2GVWtC+D
TLSH
T1EC43D69679D49CDADA38823C45E7D2337638F9E006134B1B6634AA360F23FD17ED9681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BREC49.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL000015a8\BREC49.tmp
Size 198KB
SHA256 a1e32888fd83bd0c73c14dd91b31181ada3160e2c953dba631a6035e1ac052cd
MD5 ed9ec10f7e7814ab880744c9a179e49b
SHA1 14e97dbb00c9afbc8a325ca8cd70804496354ad0
SHA512 2acdb9f5143d07df9de91691f7f7be5103e83cbb44a29ae282dd0a5bc60fbc4b9ef0476b5e5622d12a35f0f86a7887cdb65c3cb2e5a558a1f80ddd555ed6b26e
SSDEEP 1536:21jQcEfupU7L88njMOZwhzwqV7GEz9jZREx2omuU4kVz4PpgipP7PVC2kE75Elqt:21jJEf9f4bCqVVREEC78EagR/YpgRBd
TLSH
T10D144C43B2D19D9ECE2A563949FFC3223375F094175AEF1B29348A321F63AA03F85645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BREC59.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL000015a8\BREC59.tmp
Size 819KB
SHA256 2b14ba9c3d7ec52dfa2ff3b506c856bad6205d90484ad6bb1856b3bc89a40920
MD5 d9ccf8c595ce798ef6146451a30f81d0
SHA1 e0b72320ef44d0019c66f304dc77db130e900430
SHA512 837e8c214b4f4f7f64bb61c03fe28b61190ffec3b9dc8c5c8ab218fee367cd0815546c0988efc2c74af63281fa3468fc5e47145fb054b3caf559d3fc1fb23379
SSDEEP 24576:Ily2aQFM3uh+ryZwFpoLqZzg8P/9UQRZWztD:gyVQFM3uMryZQSFIO3z
TLSH
T142054B13E68370FDC897C3345697D722E632B4181E327AAB3292EA35FE52E711397611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BRECE7.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL000015a8\BRECE7.tmp
Size 235KB
SHA256 aaa3d7e589e9be1911eee5974afa68c64af1bbd5e039ff6a82a15c2b54c0f9f0
MD5 51c675fc1ef0a62322052d3e86567c06
SHA1 e295d0b668105d81f9180ef1056d0528e4b2116a
SHA512 a352e82db5c930c73165a48337ae51acda7ebd393b8b0b57d03d2e1b5057c41c26b1f321759b7bc521166890853ecdad7b37531212243ad86e181e2252a3b78d
SSDEEP 1536:fvHdOlJYzc4WrA5jDuSILZnyjGi98RkYD1a9okwGN0DCcFAyG6MifymQxz+ZIKx3:ATc5WrA5jiAjXKR3HdCcqyG6e/NC5
TLSH
T192342CC875D4A8D3E67F837566C2F92272BCF2909723DF0392908E35052ABC56F66D81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BRED07.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL000015a8\BRED07.tmp
Size 24KB
SHA256 2b93420dc2b1b8a74bf3d75fe99232303a3f692ceb1fdf2df27d40b7e8e6fa53
MD5 485ee2bcd31212c6088086081e7427ae
SHA1 749f4ed6ce7b5b26ac1f2d947afba7acdb19aaf9
SHA512 74b42018747b15420fa31004f07c7cffbda9517799864fdc4990a25595a942bf21f40e3b181fe182aaae4625049b665c80bbaebae0e63c0a1113a6a24c7c0741
SSDEEP 384:EwdQDOvZjrRVQ5UIyxqJbbSdn8X8SrTBBdofPviG2GLGnT:7Qcv5IBqn9Sryd
TLSH
T100B2E82FB7536CADC426C3BC52F68673E9F1781626329A2D4210D6703F72CA05BBE954
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BREDD3.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL000015a8\BREDD3.tmp
Size 19KB
SHA256 034756f772399552cd33605a189ee0e45d7947860e0d83ec12aa6da1a5a42054
MD5 a56543b9cd3aa403311b49189d25851e
SHA1 bd2609d35d4a967fe23ef4092b1daa6f74a858ad
SHA512 2237f493d70799675ae0e395f551b6cd46ff4789e46e2453c48fede07b7623b4b8111904d6fa139c204eea4405b5fd5812b0a91f27374219b721339149c25edf
SSDEEP 384:szVLiyxZuZ1R0PCtHIsyhxCTPBX0O1Ok:ELiyx60Y2XC5L1
TLSH
T10E92F90FBBC294ADC53BD37482F7D732987174611236762A0764DB705FA0EA0AB7D628
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BREF3C.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL000015a8\BREF3C.tmp
Size 96KB
SHA256 9426e96a97f41645fab524385a852687792f99b505554b6b9809ed99451b2399
MD5 9b299884420745d80c70bba6b8a7f05a
SHA1 195423185a7776e072a65fbabae868c15f7b2f56
SHA512 ed839dc1b6ef53f3663b6055fb2869a522600b2af8d8a800958ddb531154f4e9a3f1733f32dff5511a22fe01525191c8683519cbdcedec138b1bcf3425f2155b
SSDEEP 1536:EbWmOP8RKRZ6j2oGbgY2pUA6hHkVWWdXW:rf8XyoxpUA+HYdXW
TLSH
T13BA319817B945CD9C9759A3C46F6D3326A3DF5E002B39F4B9B2496380F12AD1FF88648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BREF4C.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL000015a8\BREF4C.tmp
Size 179KB
SHA256 648ffef1fcaa0b277b2009deb753e0aa81e04cc36d2f19dd3b3ead63022d8fb2
MD5 6498a76fc812d2c1408ad35a21a54fc4
SHA1 de958eed35ee0a2cb2ad1a98c75e5679c88af2ec
SHA512 0aa49324d82df3384e2682ff8652aae651d02a3a12e11380474a808f740ba064e03c672adab9329980283d137a4535203e3d6a59bc1aab32aebf8f75e55e6531
SSDEEP 3072:klUgA9IdDxAZRf21EpQTfaLQod63IdLEB9M8EzMR1NiIIS/dHW:kY9IdyAzToMIs9bEAxIS/dHW
TLSH
T152044983A7A59CEFCD29433945ABC321B375F48017B7AF5F192089351F63AA03F8A645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BREF9B.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL000015a8\BREF9B.tmp
Size 26KB
SHA256 44e5f5f11a3c25be0880819cb42647fb7840d6b3260ef32c91a8ae44d308e58f
MD5 56ec6f11e89a3b8c34d7465a7a887a68
SHA1 8aa6f5a584a5fbc195d9ec2fe9aaf05203615b9c
SHA512 81362d299a5259db9dbd12d654ce2372ca2eac36bdfec29071f2ded353cbe6ca41dee801d3fdaf0ef0232027ca2042179faeb6c92da1fc896f47e7e026c1a227
SSDEEP 384:Gpdh0MtlEe5dufwwHezmAWZtxbS4vVuBpoOdWoTMB8JFtOezSpQ9t:gRtl/LwH2FW7SnJWoppOY
TLSH
T1D7C2FA1AE36315EDC527C57582BAE333E8B17C161134B32A9A60EF351F31BD0A71A729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BREFAC.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL000015a8\BREFAC.tmp
Size 40KB
SHA256 c9deef1cc37b85c2c166fbcbee6f018a2d65128abb170174e80c129f3171b065
MD5 8374ba3961c06702059039498055bd6b
SHA1 ffa611afc2487744f2bff64f16ad4bc9c50a5c40
SHA512 9082448a999951a2fa2d27762641237f8dcbf59fef8edf7459eebfd30147617192bfb8ab0d6080c611560703b99ff0825166ceb763b2b0811bbbb813969b6493
SSDEEP 384:Lxv9Ls6tWNkrErbyRibbk7S8sirUEKlvYr5vbZGTYBFSX/zTzfTUrHczc:du6tWir1sJINtGTHzfTov
TLSH
T1AE132A5AB983C8ADC513C1B082B6BB33E5B174110125ED3E2721DF745FB7F906A2BA19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BREFBD.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL000015a8\BREFBD.tmp
Size 209KB
SHA256 3257c2d167916a57e61022fff9a9bd9ea0a7c9f1ce8f00eea4c84039f4519200
MD5 92214d8b40f8a391e3ce67ceb9780e39
SHA1 81cb719a5a72420f611082dd93eebc39921892d1
SHA512 3295ea719445377c9ff7a009dc6bf077d180dd8803ee2a94cb44c45f98b8045505734f74aba34239013f84f06c15a095aabec019d1fde1addeb47d6972e5b7e4
SSDEEP 3072:hLNfuqA0ZtfRIRbWqGM+Bi7j54yKnocqdslQe4aoMXycswAoaMszgwpUVbV:FNY0j6RygZj6yKnpqmlx4aDic2oJ3
TLSH
T1AE247D47E2B35CBCDA57C1748257E372BA71B8610234EE7F0AA4DB311D11D607B2AA39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BREFEC.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL000015a8\BREFEC.tmp
Size 90KB
SHA256 150ac0b7099a90f654c070275ede790cd9ad10dedcb537d9730e97d13d56bc1c
MD5 8b866ca087f9c424bdb8caadd124e1e0
SHA1 41832ea2035dbb92db93cff1c6b30a0ea307431f
SHA512 2f977962c8fdcdab1725fda9a3b304a29e9ac977b3589f7d0449be8ea965a32f12fe971cafc0daecad54f0d668dd61f4d5b418249ccd7f6b583a1ef2aacc0d5d
SSDEEP 1536:VF7bWaW4Ct4jdJrnz9vBrqcMTtjqqzTvX5FTpRn6dhdIObIOP:VFHI4pphvBrdMEqzjX5FTph2XNP
TLSH
T116937E576A9761FCC67781B0C2E2CB7AAA30F81015706BAF5258EBB01F11D902F596FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5544-76-0x0000000070140000-0x000000007014F000-memory.dmp

Download

memory/5544-83-0x0000000059F80000-0x0000000059F9F000-memory.dmp

Download

memory/5544-74-0x000000005A050000-0x000000005A128000-memory.dmp

Download

memory/5544-82-0x0000000059FA0000-0x0000000059FDE000-memory.dmp

Download

memory/5544-81-0x0000000059FE0000-0x0000000059FF3000-memory.dmp

Download

memory/5544-80-0x000000005A000000-0x000000005A010000-memory.dmp

Download

memory/5544-79-0x000000005A010000-0x000000005A042000-memory.dmp

Download

memory/5544-77-0x000000006CA00000-0x000000006CA0E000-memory.dmp

Download

memory/5544-78-0x0000000066C00000-0x0000000066C1B000-memory.dmp

Download

memory/5544-75-0x000000006C580000-0x000000006C599000-memory.dmp

Download

memory/5544-73-0x00000000710C0000-0x00000000710F4000-memory.dmp

Download

memory/5544-70-0x0000000000F00000-0x00000000011E2000-memory.dmp

Download

memory/5544-71-0x000000005A130000-0x000000005A156000-memory.dmp

Download

memory/5544-72-0x0000000066680000-0x0000000066695000-memory.dmp

Download

memory/5544-84-0x0000000000F00000-0x00000000011E2000-memory.dmp

Download

memory/5544-98-0x0000000000F00000-0x00000000011E2000-memory.dmp

Download

memory/5544-112-0x0000000000F00000-0x00000000011E2000-memory.dmp

Download

memory/5544-126-0x0000000000F00000-0x00000000011E2000-memory.dmp

Download

memory/5544-140-0x0000000000F00000-0x00000000011E2000-memory.dmp

Download

memory/5544-154-0x0000000000F00000-0x00000000011E2000-memory.dmp

Download

memory/5544-168-0x0000000000F00000-0x00000000011E2000-memory.dmp

Download

memory/5544-182-0x0000000000F00000-0x00000000011E2000-memory.dmp

Download

memory/5544-196-0x0000000000F00000-0x00000000011E2000-memory.dmp

Download

memory/5544-210-0x0000000000F00000-0x00000000011E2000-memory.dmp

Download

memory/5544-224-0x0000000000F00000-0x00000000011E2000-memory.dmp

Download

memory/5544-238-0x0000000000F00000-0x00000000011E2000-memory.dmp

Download

memory/5544-252-0x0000000000F00000-0x00000000011E2000-memory.dmp

Download