0950597d3f6a747c6e7b2255475cfe3c559c6812d400abd8e6e07802758eef93

Resubmissions

30/10/2026, 11:17

261030-ndtd8aec837

30/10/2026, 11:11

261030-nacmasec757

30/10/2026, 11:01

261030-m4xc5ayv7l10

Analysis

user interaction
yes
max time kernel
898s
max time network
473s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 11:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Files.zip
Size 8.7MB
Sample261030-ndtd8aec83
SHA256 0950597d3f6a747c6e7b2255475cfe3c559c6812d400abd8e6e07802758eef93
MD5 106f4accfb3fba8600ec5c32cfef8900
SHA1 32aed06f772318cec5d8fc1aefbad5e3d8dc70b1
SHA512 2413dfcd1ee851d509f509ba0540fd0863d5233f10e7756528316b94acdb4488ff3d8c575fe2952172897df2fd45b8e8992588bd4a04305bc37ba53e749bb06e
SSDEEP 196608:ZY5rrgoaf82r2eiUdCXJF59GqYZ1sW1jjF/XcFi6APoW+ywz6pU:wHMf8k2e/d8JFC95t5XcFi6fByvU
TLSH
T1439633223640FA8394B0E79CE2AEFC61A2ADB7E5C2D33187D355C105F5D45026C6B7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5012	sys_task.exe
1416	sys_task.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\EventAggregation.dll	sys_task.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	1416	sys_task.exe
Token: SeDebugPrivilege	1416	sys_task.exe
Token: SeDebugPrivilege	1416	sys_task.exe
Token: SeDebugPrivilege	1416	sys_task.exe
Token: SeBackupPrivilege	1416	sys_task.exe
Token: SeRestorePrivilege	1416	sys_task.exe
Token: 35	1416	sys_task.exe
Token: SeProfSingleProcessPrivilege	1416	sys_task.exe
Token: SeDebugPrivilege	2156	services.exe
Token: SeBackupPrivilege	1416	sys_task.exe
Token: SeRestorePrivilege	1416	sys_task.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 5012	4176	dropper.exe	103
PID 4176 wrote to memory of 1416	4176	dropper.exe	105
PID 2156 wrote to memory of 524	2156	services.exe	4

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:524

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Files.zip
1⤵
PID:4628

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {24AC8F2B-4D4A-4C17-9607-6A4B14068F97} -Embedding
1⤵
PID:4100

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4700

C:\Users\Admin\Documents\Files\dropper.exe
"C:\Users\Admin\Documents\Files\dropper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Users\Admin\AppData\Local\Temp\sys_task.exe
  "C:\Users\Admin\AppData\Local\Temp\sys_task.exe" -chain -item \"4|HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" -trigger now
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Users\Admin\AppData\Local\Temp\sys_task.exe
  "C:\Users\Admin\AppData\Local\Temp\sys_task.exe" -k MsMpEng.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  PID:1416
- - C:\Windows\System32\services.exe
    "C:\Windows\System32\services.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

sys_task.exe

Path C:\Users\Admin\AppData\Local\Temp\sys_task.exe
Size 382KB
SHA256 a1fd881b1f4deb168570f8d86cde628ae683390feaa817e1286d0d4404e61bfe
MD5 e368f37c47ff27c0227a2d75816a9241
SHA1 0984a1cfbdafa126e8aa66a768cdc54d422795e8
SHA512 205175b3472d0edf02fa8e826507da55c28f1845154e1cac46d5872de3e43d565b81a8e460527fdaddbc9bc851d99199bfa168fa88fccc872be7c3bae739a388
SSDEEP 6144:ohGkooUWiQdCX+QhjvUIML8CgEI4RYOAt:oo7oUWiNhjvw836tA
TLSH
T1BC846B55F3E804F8E4B7927C89624906E776BC160771E6CF23A0466A2F376D09E3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download