d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 08:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
Size 170KB
Sample261102-klgtlsty8k
SHA256 d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf
MD5 901ff7df218f19164e4d289fd6a7064e
SHA1 4bdceade9e88243e39c4c0ce1c6293bc88e9fa92
SHA512 6c4446228e4391bd94a1af2cadb7a809bcf8ce7e4e0cbf2e1935f6545e2334a734fedb2187f02ecbf4f8d34bb702e76a12ded19dd32ea4e964b254ef2fec8398
SSDEEP 3072:e51Wa8DwZU1jQupA47HGdK9ezOWSOSBdC2jPO7c4SyUMCx1asgG4PPAs2TH6Pz9L:e51Wa8DsU1jQKA47HGdK9ezOWSOSBdCL
TLSH
T1B0048D2570D2C0B3D476193114F48BB19ABDBC710B915EBB27E81B3E2E346E19527AB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 14 IoCs

flow	pid	Process
7	4404	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
8	4404	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
8	4404	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
8	4404	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
8	4404	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
8	4404	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
8	4404	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
8	4404	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
8	4404	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
8	4404	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
8	4404	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
8	4404	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
10	4404	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
5	4404	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe

Executes dropped EXE 14 IoCs

pid	Process
1228	QRhOWeWS0.exe
1308	RTj6P8p7rLUi5.exe
4680	qvp6a7yOs.exe
5240	sLQRgAtQl36L.exe
2308	0trMdMkPRHq.exe
2624	g6jgtvbRfE4.exe
4624	K9Q88yO7PS.exe
1464	assOpX87r2v.exe
4812	7Znxpc9wOT6OT.exe
4424	DqO0WXuSsq.exe
3336	wSeSNdFZlNi92.exe
2396	R7mTUlSwAHq8.exe
5952	XWADBxeGK.exe
1056	Nqm5VQIJF.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	R7mTUlSwAHq8.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	9	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 1228	4404	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe	89
PID 4404 wrote to memory of 1308	4404	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe	91
PID 4404 wrote to memory of 4680	4404	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe	93
PID 4404 wrote to memory of 5240	4404	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe	95
PID 4404 wrote to memory of 2308	4404	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe	97
PID 4404 wrote to memory of 2624	4404	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe	100
PID 4404 wrote to memory of 4624	4404	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe	102
PID 4404 wrote to memory of 1464	4404	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe	104
PID 4404 wrote to memory of 4812	4404	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe	106
PID 4404 wrote to memory of 4424	4404	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe	108
PID 4404 wrote to memory of 3336	4404	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe	110
PID 4404 wrote to memory of 2396	4404	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe	112
PID 4404 wrote to memory of 5952	4404	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe	113
PID 4404 wrote to memory of 1056	4404	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe	115

C:\Users\Admin\AppData\Local\Temp\d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
"C:\Users\Admin\AppData\Local\Temp\d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe"
1⤵
- Downloads MZ/PE file
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Users\Admin\AppData\Roaming\TrzRQoqu1\QRhOWeWS0.exe
  "C:\Users\Admin\AppData\Roaming\TrzRQoqu1\QRhOWeWS0.exe"
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Users\Admin\AppData\Roaming\dRvxMML1gXa\RTj6P8p7rLUi5.exe
  "C:\Users\Admin\AppData\Roaming\dRvxMML1gXa\RTj6P8p7rLUi5.exe"
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Users\Admin\AppData\Roaming\vKrja7JbLM\qvp6a7yOs.exe
  "C:\Users\Admin\AppData\Roaming\vKrja7JbLM\qvp6a7yOs.exe"
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Users\Admin\AppData\Roaming\6eFNpzoecP\sLQRgAtQl36L.exe
  "C:\Users\Admin\AppData\Roaming\6eFNpzoecP\sLQRgAtQl36L.exe"
  2⤵
  - Executes dropped EXE
  PID:5240
- C:\Users\Admin\AppData\Roaming\MtMpGGvhS\0trMdMkPRHq.exe
  "C:\Users\Admin\AppData\Roaming\MtMpGGvhS\0trMdMkPRHq.exe"
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Users\Admin\AppData\Roaming\lFfvP\g6jgtvbRfE4.exe
  "C:\Users\Admin\AppData\Roaming\lFfvP\g6jgtvbRfE4.exe"
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Users\Admin\AppData\Roaming\ETIbB\K9Q88yO7PS.exe
  "C:\Users\Admin\AppData\Roaming\ETIbB\K9Q88yO7PS.exe"
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Users\Admin\AppData\Roaming\J6S6NxvDsd7\assOpX87r2v.exe
  "C:\Users\Admin\AppData\Roaming\J6S6NxvDsd7\assOpX87r2v.exe"
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Users\Admin\AppData\Roaming\apshUm7zFuT\7Znxpc9wOT6OT.exe
  "C:\Users\Admin\AppData\Roaming\apshUm7zFuT\7Znxpc9wOT6OT.exe"
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Users\Admin\AppData\Roaming\9gpANntNG7\DqO0WXuSsq.exe
  "C:\Users\Admin\AppData\Roaming\9gpANntNG7\DqO0WXuSsq.exe"
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Users\Admin\AppData\Roaming\rRgjqR6QXq\wSeSNdFZlNi92.exe
  "C:\Users\Admin\AppData\Roaming\rRgjqR6QXq\wSeSNdFZlNi92.exe"
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Users\Admin\AppData\Roaming\t9CTaW7Cf\R7mTUlSwAHq8.exe
  "C:\Users\Admin\AppData\Roaming\t9CTaW7Cf\R7mTUlSwAHq8.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2396
- C:\Users\Admin\AppData\Roaming\gKd16\XWADBxeGK.exe
  "C:\Users\Admin\AppData\Roaming\gKd16\XWADBxeGK.exe"
  2⤵
  - Executes dropped EXE
  PID:5952
- C:\Users\Admin\AppData\Roaming\78OvK\Nqm5VQIJF.exe
  "C:\Users\Admin\AppData\Roaming\78OvK\Nqm5VQIJF.exe"
  2⤵
  - Executes dropped EXE
  PID:1056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

YCL.exe

Path C:\Users\Admin\AppData\Local\Temp\J5d3e4f2f22eAEGz\YCL.exe
Size 2.4MB
SHA256 562befc15c7530127bae89358c12bc7d902b74e747b349064c6a357cd1c49556
MD5 f1b6fe67df44f0865c707dbd39c955ce
SHA1 9b599fd3d12c55f124ff910de1b2a6f27280cea8
SHA512 5690b83914cc6d4025796bc1fe75acad257ce279b7f27ae062dfd8ae0fafdbc56f8a8bd45227ddc660395633b90006bd9c4a09f8435a625b4e7215a016f5320d
SSDEEP 49152:NxbZkNARkhxqH7VDE+46IAGHPx23n4V+bNLrwXx+sE:J2ARkhUILU34V+bNLB
TLSH
T1A3C53807D3F681D8E1FBE730CAB262735D72BC199538A65D1685CA251E30F709F29B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QRhOWeWS0.exe

Path C:\Users\Admin\AppData\Roaming\TrzRQoqu1\QRhOWeWS0.exe
Size 16KB
SHA256 69fe2d9f48833d84fc001182e34d1e004a1019208f261c19654598dbc390bc3c
MD5 eb61c25720cef7e40116b7d7c7a565a8
SHA1 a7446cb76b8023bf7c2903427aa8fa0563990f9c
SHA512 4cb403e2dd27eab25b07ea7bd7599556e99d355e056c5b24f5140c9e2f529e58a12841b779857eeb462d8f8320e60d440779f00f8630f94d2c6c9f284a7c7a0f
SSDEEP 192:sEn3gSr0JFH8CyuMYj+THdI+J0HKVFDqBH+2sY02F0Csza:LQSrUxMYj+Tj0HcFkH+2sJO0CW
TLSH
T1E772A399B75390E9D68ED0B0D8D38FB1E571FDA20674663B2384E2391E31D878A3D117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

R7mTUlSwAHq8.exe

Path C:\Users\Admin\AppData\Roaming\t9CTaW7Cf\R7mTUlSwAHq8.exe
Size 874KB
SHA256 3eb383f192c4a3b30d7fbb6d34238a49c6969597bb286de790df2709f2a26343
MD5 80745874086c55c7bf00814ca112095d
SHA1 4c842796cebf6e6f30032e05377bda48ec81fe81
SHA512 9806dcbe1b7e0ec027408509d060d35450bf8c1c0c3d2896dcdd791a187336e0513b020d11d47bc5345bb92b89c55847cb6b9bdcc9f736893c18763f1e1d00c7
SSDEEP 12288:bYEd//LbpeDJ4jfiIaBRtwfESz9pfYbVC3pKEVj4988fLn:bbJIJ4TiIaBYfTz9wC3pKqH8fLn
TLSH
T18015291EAFB3C072EE63D5B2F6645221393DB82D173885CB62B0282DE9907C1DAF5355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1056-100-0x00007FF7E13E0000-0x00007FF7E13EC000-memory.dmp

Download

memory/1228-23-0x00007FF642490000-0x00007FF64249C000-memory.dmp

Download

memory/1308-29-0x00007FF669C60000-0x00007FF669C6C000-memory.dmp

Download

memory/1464-65-0x00007FF7DFFE0000-0x00007FF7DFFEC000-memory.dmp

Download

memory/2308-47-0x00007FF621960000-0x00007FF62196C000-memory.dmp

Download

memory/2624-53-0x00007FF62AC10000-0x00007FF62AC1C000-memory.dmp

Download

memory/3336-83-0x00007FF776430000-0x00007FF77643C000-memory.dmp

Download

memory/4404-15-0x0000000010000000-0x000000001001C000-memory.dmp

Download

memory/4424-77-0x00007FF75A990000-0x00007FF75A99C000-memory.dmp

Download

memory/4624-59-0x00007FF708FF0000-0x00007FF708FFC000-memory.dmp

Download

memory/4680-35-0x00007FF643DC0000-0x00007FF643DCC000-memory.dmp

Download

memory/4812-71-0x00007FF6CF190000-0x00007FF6CF19C000-memory.dmp

Download

memory/5240-41-0x00007FF72C5A0000-0x00007FF72C5AC000-memory.dmp

Download

memory/5952-94-0x00007FF6F9FA0000-0x00007FF6F9FAC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads