5339bb3d93ecd04ebdd4f72c23226c32367a768c3571df60c657194aad43443f

Analysis

user interaction
yes
max time kernel
167s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 17:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
real.png.exe
Size 6.6MB
Sample261020-v4dvsaszdv
SHA256 5339bb3d93ecd04ebdd4f72c23226c32367a768c3571df60c657194aad43443f
MD5 dd81cd27ffd97fc40df17eef05283094
SHA1 0883d2140ddea7d994f29a964a803465ac098333
SHA512 055e8e8cc9ed060fcbdf2dd6e96f68ff796c7c0f8900a6bba6476c82b223a262524512b246bd38015614095ba0771989e03a03bbb5eafd02fff17ffbc8e1bbb8
SSDEEP 98304:OB1jYdn2E+feIrtI4Q9Yhfe2m6hagsgJM4NPDAOUTWdoa91rpC85LM:UzI4l86E2W4BDAO6ioa9BjLM
TLSH
T10166AE4369DB0DA9CED667BC61C75335A778FE31CA291F2BAB04C22169532C4AD1EF40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3420	~0E58B03E.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 3420	3192	real.png.exe	89

C:\Users\Admin\AppData\Local\Temp\real.png.exe
"C:\Users\Admin\AppData\Local\Temp\real.png.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Users\Admin\AppData\Local\Temp\~0E58B03E.exe
  C:\Users\Admin\AppData\Local\Temp\~0E58B03E.exe
  2⤵
  - Executes dropped EXE
  PID:3420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

~0E58B03E.exe

Path C:\Users\Admin\AppData\Local\Temp\~0E58B03E.exe
Size 2.7MB
SHA256 c7c478edaf28992424d63148946eca58ad3bd3f9401fdea0da6ed696135e8107
MD5 897f1f1180bdc33e1c8acaf2683729e6
SHA1 5cb02b4a9fbd370acf9792241c88dd5a629eaded
SHA512 37c5c304bb471ad8dc7a9baa9aec265d7834f0b8e15daaf42c84cd29c0c0d2e1c7a7110f062c48eced93f1ffd4dbfeeb28ee1edc95b31cc666882edd65e1f231
SSDEEP 24576:fPDDPM0X3TWIN/Ec3CYCgrOG0FSVdOEqPeDisRucjbzX+Ec0xMkl81sU3AoQYdn8:fPDD/XDWOSfG0FSVdGPGYdnL3J2hV
TLSH
T14DD5D68329DB0DE9CED677BC61D75335A778FD318A291F2BAA04C2212D532C4AD1EB50
MD5 SHA1 SHA512 SSDEEP TLSH