Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 17:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
GokalpWare.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
GokalpWare.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target GokalpWare.exe
- Size 1012KB
- Sample261027-vmr13sts8m
- SHA256 16483195243104c20c8833d941373b4b6e540507a86f1e857f117cba98621f58
- MD5 a1d9fcd86913a9f761ba46d4df89516b
- SHA1 e3bef17dc036bce7c6342ddbf2e0771e8300bf05
- SHA512 a66c3d719823969c12344b1ca5aad1ce8683a4ccf65a37ed2e2dc180151a99b04d9c74359bcb1cb085d8836f331bc3892ec32f09f250a67f9e1f767af561b916
- SSDEEP 24576:FIMhbtunFhcVnmKOqFuL89BVKtSmtisnuG4dnu5K:FJhgXcl9BQwsnP41
- TLSH T18525AE42F2F951F9E0369134D5DBAA1BE732381507204ADB53E41AA93FB37E05ABB311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe 3764 GokalpWare.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3764 GokalpWare.exe