bcd8a829cfbceb6174c3649d9c3b2fd90687379ed6c08319f858497d453b109f

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 23:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gitl__it_64-v.7.230.exe
Size 5.6MB
Sample261104-3gl7msgv2r
SHA256 bcd8a829cfbceb6174c3649d9c3b2fd90687379ed6c08319f858497d453b109f
MD5 eee062dc6a7573f1cdf485b4a1f81e10
SHA1 450dd465567d18cfc2fdcf4150afe46f6f558df2
SHA512 0660c875aabac4c90a514eed3b390d596efdccc7f99f3058796668ed8151a1613f21c986626848977bf04fe0c9a0ddb597a99f377fc3ec317d91fea25f1e0e13
SSDEEP 49152:flSmZaPDtGgd5bpXOygAbsS7F9pl0WojDsvERYknxjQQ:fen5dXX9x+DsviYkOQ
TLSH
T11D465B23ADD695AAC496E630C8AB51427AB4F84C6B3033E31F90BF741EB27D05D78B45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	gitl__it_64-v.7.230.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	gitl__it_64-v.7.230.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2320	gitl__it_64-v.7.230.exe
2320	gitl__it_64-v.7.230.exe
2320	gitl__it_64-v.7.230.exe
2320	gitl__it_64-v.7.230.exe
2320	gitl__it_64-v.7.230.exe
2320	gitl__it_64-v.7.230.exe

C:\Users\Admin\AppData\Local\Temp\gitl__it_64-v.7.230.exe
"C:\Users\Admin\AppData\Local\Temp\gitl__it_64-v.7.230.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:2320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2320-0-0x0000000148EE0000-0x0000000148FCA000-memory.dmp

Download

memory/2320-1-0x0000000148EE0000-0x0000000148FCA000-memory.dmp

Download

memory/2320-2-0x0000000148EE0000-0x0000000148FCA000-memory.dmp

Download

memory/2320-3-0x0000000148EE0000-0x0000000148FCA000-memory.dmp

Download