Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 06:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe
- Size 592KB
- Sample261102-hebynstt5m
- SHA256 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5
- MD5 f8dc955eae32bb527fc828e0ba41d583
- SHA1 175b83aa0954661051192f010795cebdfc2c9d48
- SHA512 539102dd2740d86964ecd0d0dd0ffebf3ad900b92ea7d443e1ac6dbc05361c4f30f00c6f3b5cca39e47c7c0a5377f60f83e83868ee5ce10ff50719fc0a0f1e51
- SSDEEP 6144:GwhU/ozDR+0xmnm3Mm6da8hBZ/gXl4Wl2+tAOFsesj0a1zrVs3ZH0Eym:VZz9HO+36daE/ol4uLtM1zrVs3Um
- TLSH T12FD48C05FAF2C1B2C9A701B50C65D71E5536E8651B250FE7FBC80F2E8E213C1AE7A169
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\tkjsidfsd 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 6044 wrote to memory of 4428 6044 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe"C:\Users\Admin\AppData\Local\Temp\0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe"2⤵
- System Location Discovery: System Language Discovery
PID:4428
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\tkjsidfsd
- Size 140B
- SHA256 51070150fdd130e7be0d7267ebe490e18215c314a8367cd6de5c1edc047ec663
- MD5 9586e22bc81bc0991b3ca8f2c3e5092a
- SHA1 4d63f357eb2910c0ec57c1911d01fa2c27348439
- SHA512 79f79add4ae9bdf30eaf697f9cb223b07800736e7c6ad4507734990e0db535b570fba97b9851045854cd06e8632923f5163b4f6db2ee3cf98e37f998467f5d36
- TLSH T135C000294C321020A222688049AD4A88010FAAB0F928F0AB7225CE246823C61D8A2E88
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\tkjsidfsd
- Size 70B
- SHA256 3a7da8e3ce0c022434302b4770f40556e8a66673756bc2e7042b29b4bf5effa2
- MD5 68660f05c1946651897f8e4556c4380a
- SHA1 e9d32fa068d9240301a4a8730655caa074239d89
- SHA512 bd5752d013ad8b7151a98c61b207c50e8e161547368befbfadfb49466dcac88dea9bba1f7ab033602ceb7ce1bd0820af042a7a5e6fd52ad71c38dbabd5d25960
- TLSH T17BA0010C0C32003082236C40442C0A88000B6AB0A928F0AB7225CE005003C619850D40
- MD5 SHA1 SHA512 TLSH