18bd0b003e64fad26bbebf7ec27fd4aae71919c238756f147122f7562f828cf0

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/11/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9820 #2109200-QY72190027-20261103.Pdf.exe
Size 762KB
Sample261103-phlqlsaa53
SHA256 18bd0b003e64fad26bbebf7ec27fd4aae71919c238756f147122f7562f828cf0
MD5 92091b9bbabd6d73164ab306be276a0c
SHA1 45d484a266456d77aa781ba753ddff2638e4ca04
SHA512 6db1bb1625da89072dfb59dc7cc558d85f2077aa3847673408186bbb7ad960df2bbeb9a4589f1ec415d577e498cfb85cfe47e64464f95e06f915bac0e5a53390
SSDEEP 12288:zN+C5hhfgEiaMNMMLcYvdDGY6vz2J5mwSwbjsqWz7P5tk8DsUExzfe:MYf9MNMMLnvdCDw5mwSysl/jKE
TLSH
T1F1F42335F7D278D9D0BD46768DB399129071BEBA053AA10B7601F93BBC386A0C53B358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion persistence

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1228	9820 #2109200-QY72190027-20261103.Pdf.exe
1228	9820 #2109200-QY72190027-20261103.Pdf.exe
1228	9820 #2109200-QY72190027-20261103.Pdf.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Kjestine = "C:\\Users\\Admin\\AppData\\Local\\Temp\\peptogenous\\Tarsonemidae.exe"	9820 #2109200-QY72190027-20261103.Pdf.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
1228	9820 #2109200-QY72190027-20261103.Pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1228	9820 #2109200-QY72190027-20261103.Pdf.exe
1228	9820 #2109200-QY72190027-20261103.Pdf.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1228	9820 #2109200-QY72190027-20261103.Pdf.exe
1228	9820 #2109200-QY72190027-20261103.Pdf.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1228	9820 #2109200-QY72190027-20261103.Pdf.exe
1228	9820 #2109200-QY72190027-20261103.Pdf.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 4452	1228	9820 #2109200-QY72190027-20261103.Pdf.exe	89
PID 1228 wrote to memory of 4452	1228	9820 #2109200-QY72190027-20261103.Pdf.exe	89

C:\Users\Admin\AppData\Local\Temp\9820 #2109200-QY72190027-20261103.Pdf.exe
"C:\Users\Admin\AppData\Local\Temp\9820 #2109200-QY72190027-20261103.Pdf.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe"
  2⤵
  PID:4452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Debugger Evasion

T1622

Modify Registry

T1112

Credential Access

Discovery

Debugger Evasion

T1622

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

draft.ini

Path C:\Users\Admin\AppData\Local\Temp\draft.ini
Size 78B
SHA256 def3a734b7b620aa814633bbdff9a6456b855864da02ec78a1c1558fd1070d4d
MD5 8c6c8f9e8103cd15516ef321ed7541d3
SHA1 dac86e7b98f8d4c1f280c92b8258506e4ba5a07d
SHA512 c951ff271511a7d630ea4b5150a11752c01aad525c5fc67bb8cd7d03d24e3378a034b6ae36312cb2defafd25908eb67ab92dec18d03fef2bed253f2839016a18
TLSH
T10DA0222288E00208C0A3C3B30880CA223C0B000B80CF080332BC80A0C30AB32C00F802
MD5 SHA1 SHA512 TLSH

Submit Download

Math.dll

Path C:\Users\Admin\AppData\Local\Temp\nseA60B.tmp\Math.dll
Size 36KB
SHA256 d761e5e06e054f60b335d2d756c57909e6cac560db1afa74492f724a7c5709ba
MD5 db5b3302875a95ce4a6049fb837617d7
SHA1 3bfe838c3adf8ad4f007b19ae9d69e72ec3e4b34
SHA512 4734930d41e12c95e47b39a4cc9a9ee95626f619c58de515cc919a50f1af540beb2788a688b6fc4d21046a62e3e7f0d5cb92cda2d9d5b2d7be4e57692ca20ec5
SSDEEP 768:00jjHnaaIGBX/Dsv/B7coYfY7HVE/cu0Z/ivpvWKKKKKKKg7tEd:FRBX/Ds3BPB71Jqvpvm
TLSH
T160F21A27EAE184B9C49691BC67C7AD71B5F2BC090530D31E07A096503E6FE702F7AB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nseA60B.tmp\System.dll
Size 27KB
SHA256 d976014dab1c1ca93a8f94242a709fb16037f4b047d6ae51d56c9404544e8816
MD5 c9b9b95558d7c44497637a376a3eb9e2
SHA1 d3f988f792f5f80b551f9cef0ff3ad97a4712a30
SHA512 8b615f38e740be03d0d1ed35e5268603efa428d26b56783ec88cf7f36f2f4f1e0f422fa1928abe677c72a78743cf3022040d157f46f7a980e9f330cc895cd0dd
SSDEEP 768:xq2d6pSEIUzBHDG9iAZ/aR2RKKKKKKF91:F0D4S
TLSH
T160C2F8B7F7A2846DC087D278A6C6CBB2B4F1FC645430241E452176313F66AA49FBE2C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1228-42-0x00007FF891CC0000-0x00007FF891CD0000-memory.dmp

Download

memory/1228-41-0x00007FF891CCB000-0x00007FF891CCC000-memory.dmp

Download

memory/1228-43-0x0000000003750000-0x00000000070DC000-memory.dmp

Download

memory/1228-46-0x0000000140000000-0x0000000140128000-memory.dmp

Download

memory/1228-47-0x00007FF88BF00000-0x00007FF88BF1B000-memory.dmp

Download

memory/4452-44-0x00000206D7920000-0x00000206D7A2B000-memory.dmp

Download

memory/4452-45-0x00007FF89BFC9000-0x00007FF89BFCB000-memory.dmp

Download