9fdd10ee84b9448254b8a8aa2d2296cb0c2bfb55de051692eba2be77632eaf44

Analysis

max time kernel
174s
max time network
42s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-de
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-delocale:de-deos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 10:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
portmaster-core.exe
Size 41.5MB
Sample261107-mvtkwabs3x
SHA256 9fdd10ee84b9448254b8a8aa2d2296cb0c2bfb55de051692eba2be77632eaf44
MD5 b5814892871d5fb99c0458886ee32eba
SHA1 3891288026a13efb4e20b5cd00668e111cbbe579
SHA512 25645d281a13e88c6b0c026e9c48d818d963eaeace6718ce23b7ca3152d91c072d59ac25b967ae129ee55b70682d77d042d5028e44976ddbc9bc8d9c3d93290b
SSDEEP 786432:xbu3VqoHGPw/SECnGSLWdCye5Kkh6anrGSsMLuT:NMqcCykn6e6sK
TLSH
T1DBA79E83FE2545D9CAADD635C6A642237B713C445B3223D72BA1B2206F77BD06DBA700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	portmaster-core.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3532	portmaster-core.exe
3532	portmaster-core.exe
3532	portmaster-core.exe
3532	portmaster-core.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3532	portmaster-core.exe

C:\Users\Admin\AppData\Local\Temp\portmaster-core.exe
"C:\Users\Admin\AppData\Local\Temp\portmaster-core.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads