421dee20c98287f1e6483a9629ab388423a99cdc99e86d3757f220b167853be5

Analysis

user interaction
yes
max time kernel
66s
max time network
65s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 18:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IDA_Pro_8.3.exe
Size 622KB
Sample261107-wr3ttazw5m
SHA256 421dee20c98287f1e6483a9629ab388423a99cdc99e86d3757f220b167853be5
MD5 03f4334f9db7123733566cd8e53a06ca
SHA1 42062e09dae39703d3085c88bee0b22ed12ad653
SHA512 7fabfe9b26f0b292e8606a9cd110d2be2734b7295003581d54fa87a568e18b260d49802efc8305fe77549ce446e4bb5857eb5003ff0a01551b1836f306f5f3f3
SSDEEP 12288:V/2tNzYBJUYdYlozwUhwazaL50DgkIAySn65NtBE:yYYizwU2PL50ByS6/tBE
TLSH
T181D42341B884A6BFC1CC2B36F933C9F15454F0C52D2C5158BE39B98EE9FED89C292658
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3812	cmd.exe
4272	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5392 wrote to memory of 2156	5392	IDA_Pro_8.3.exe	89
PID 2156 wrote to memory of 4272	2156	IDA_Pro_8.3.exe	92

C:\Users\Admin\AppData\Local\Temp\IDA_Pro_8.3.exe
"C:\Users\Admin\AppData\Local\Temp\IDA_Pro_8.3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5392
- C:\Users\Admin\AppData\Local\Temp\IDA_Pro_8.3.exe
  "C:\Users\Admin\AppData\Local\Temp\IDA_Pro_8.3.exe" 2
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c Pause
    3⤵
    - Executes a command shell one-liner
    PID:4272

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\PopGrant.cmd" "
1⤵
- Executes a command shell one-liner
PID:3812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2156-3-0x00007FF657F20000-0x00007FF65806A000-memory.dmp

Download

memory/2156-7-0x00007FF657F20000-0x00007FF65806A000-memory.dmp

Download

memory/5392-0-0x00007FF657F20000-0x00007FF65806A000-memory.dmp

Download

memory/5392-2-0x00007FF657F20000-0x00007FF65806A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads