3f1a53d4dd687e581c755d2dd2225266f787fbf8b85660fd898b502aecf35927

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 20:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
caf0cbf8bc9f795c2b5cc116e625839a.exe
Size 466KB
Sample261024-yyagyswygx
SHA256 3f1a53d4dd687e581c755d2dd2225266f787fbf8b85660fd898b502aecf35927
MD5 639b204871757af946e213a64d97ade1
SHA1 05edc2514a01fae133ef95d7c019bd6fbc407e42
SHA512 946c5dc34d80d0ee27a927462d1a66019e1b166132a0993e4cdedcf2ae13e4941913c6b09880d99b0c8d0547772dc567eeea8d5ec253e8a393ed615ed3a7613e
SSDEEP 12288:+aKJUbrf/rFy9fffffffWC5VrgBMruO83yQEX5Hh23X:p9yNVWMruO9X5Y3X
TLSH
T17FA47D59E6A400FDD5B7C6B8C9174903EBB278560771AA4F03E0EA721F276624F2FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5116	a2209d39d6a900f69fbf2f6f0299fb95.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	caf0cbf8bc9f795c2b5cc116e625839a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	caf0cbf8bc9f795c2b5cc116e625839a.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3888	caf0cbf8bc9f795c2b5cc116e625839a.exe
3888	caf0cbf8bc9f795c2b5cc116e625839a.exe
3888	caf0cbf8bc9f795c2b5cc116e625839a.exe
3888	caf0cbf8bc9f795c2b5cc116e625839a.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 5116	3888	caf0cbf8bc9f795c2b5cc116e625839a.exe	90

C:\Users\Admin\AppData\Local\Temp\caf0cbf8bc9f795c2b5cc116e625839a.exe
"C:\Users\Admin\AppData\Local\Temp\caf0cbf8bc9f795c2b5cc116e625839a.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Users\Admin\AppData\Local\74a6aec5648f2e1150d56c69a3100e3c\app\a2209d39d6a900f69fbf2f6f0299fb95.exe
  "C:\Users\Admin\AppData\Local\74a6aec5648f2e1150d56c69a3100e3c\app\a2209d39d6a900f69fbf2f6f0299fb95.exe" --ruby-launch=r1.955e809c2146aeed73ce8f431b62ad5b.75f348f98d314278c23e8421a91a5740c19e7cc1c9ab517d91c6d7c2f46626cf
  2⤵
  - Executes dropped EXE
  PID:5116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

195d8e5d5e484776de88fb04a2a65114.bin

Path C:\Users\Admin\AppData\Local\74a6aec5648f2e1150d56c69a3100e3c\app\195d8e5d5e484776de88fb04a2a65114.bin
Size 731KB
SHA256 6891ce68a3c51c25f81c3ccfddfaab6bd46dd5cdd54cf1ae2568948913fa03a2
MD5 809727c11b41a4fc67c507c57de1aa43
SHA1 34f06178ddee1b29e99317d738614c772586c9b9
SHA512 81a35b3a53f13f5da15a14c6d2b51909e07e674be2acb2840f5db042b8f634f73dd1a4e9173b4f70727237f9cd72a0a22a1e65ef6b5d75f164d98a6fd2fd185f
SSDEEP 12288:JMiUf8OZll9DWmdRabYyiYvkz3PFSj8kcbvv2bApHRVO:Effl18YyiYvUFSj8km3UApHHO
TLSH
T1B3F48D2AEB5401FCD5B7D1F58F2A5913DBB2780A03356A9F03D0EA620F1661A5B2FF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2209d39d6a900f69fbf2f6f0299fb95.exe

Path C:\Users\Admin\AppData\Local\74a6aec5648f2e1150d56c69a3100e3c\app\a2209d39d6a900f69fbf2f6f0299fb95.exe
Size 731KB
SHA256 7715f45199f84489d3302d63a578a50a7cf28ac3031b6d41319f3103cf61fd49
MD5 0e3cdbf2aab850d0bdc0fc9d01df9f4f
SHA1 b8392ff8152db5b0640b4c88280bcdc492bfc6ee
SHA512 ed83f24932186aa703210b0f483ddc14369a766dd3f65b8cb015e436124e17428da3d4a23ad3be060ddc5ae553ab16b8256add4ce03d7d9ac38adf6c5c942170
SSDEEP 12288:u/iUf4Ohlp9PWmpR6bY2u8vkj3PFS30kcbvv2bApHRVT:wfLlZcY2u8vcFS30km3UApHHT
TLSH
T16EF48D2AEB5401FCD5B7D1F58F2A5923D7B2780A03356A9F03D0EA620F1661A5B2FF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download