1503e8eabef07af75ff2635d0fd31bf001d565ed8402d258dcc6aba2796cc926

Analysis

max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Profaktura br 442121.exe
Size 2.9MB
Sample261107-wtqx2aey2k
SHA256 1503e8eabef07af75ff2635d0fd31bf001d565ed8402d258dcc6aba2796cc926
MD5 b7f39b814dc3ae1e914cdf6ebfe1389c
SHA1 17fba647b6dd513d33aee6c5d90378000038bf3c
SHA512 276bb7055a50be56060a7b1925f9bcd70ba3abf279cfcf40a01adc2a0770f56cb98a6fe02ccf5b22003dcabb551960405aa4869c3b0c595db5a624e1a29c3a13
SSDEEP 49152:Taj/OhdNvl7jW3Bql7ifW+ayuB9I9NYe43A6IOOGwMnxhE05u:TUOhdNvpjW3Bw7carXfFOGxxhE0M
TLSH
T168E53348BEC3E5DAC8BA89F0E6E393F76C51BD58C5A0165F02197F2F7E71661881A700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion persistence

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4876	Profaktura br 442121.exe
4876	Profaktura br 442121.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\Startup key = "C:\\Users\\Admin\\AppData\\Local\\Temp\\subfolder1\\Gonorteen.exe"	Profaktura br 442121.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
4876	Profaktura br 442121.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4876	Profaktura br 442121.exe
4876	Profaktura br 442121.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4876	Profaktura br 442121.exe
4876	Profaktura br 442121.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4876	Profaktura br 442121.exe
4876	Profaktura br 442121.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 2932	4876	Profaktura br 442121.exe	89
PID 4876 wrote to memory of 2932	4876	Profaktura br 442121.exe	89

C:\Users\Admin\AppData\Local\Temp\Profaktura br 442121.exe
"C:\Users\Admin\AppData\Local\Temp\Profaktura br 442121.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Users\Admin\AppData\Local\Temp\Profaktura br 442121.exe
  "C:\Users\Admin\AppData\Local\Temp\Profaktura br 442121.exe"
  2⤵
  PID:2932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Debugger Evasion

T1622

Modify Registry

T1112

Credential Access

Discovery

Debugger Evasion

T1622

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Setting_load.ini

Path C:\Users\Admin\AppData\Local\Temp\Setting_load.ini
Size 76B
SHA256 af8aa34e320f43d66be1c3062c367c90365cbb3b7ac0104578190c6a6d8b8b24
MD5 2c42d37f98421bfeec3b866fe1cd757c
SHA1 aca98faee3f058c332aa7c857084ec2a9ecce84a
SHA512 5192de6f19ad6365fd317ad0fcee7b003b295b235959923decf57894a14c217a07263ef3edde30f5670ca1d53b2a271469942d236aca2ad5d428380b3c8e492f
TLSH
T13CA0220302E00008E000C3F20C808A222003080B808FA00A323C00228B0E832BC0E802
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu7225.tmp\System.dll
Size 25KB
SHA256 33b570d86c4aac8c6785944f9b2992dc3eccc99e35c20ab79d81917bbef35622
MD5 7f6837692e4c3ee810fe8302b7e0db99
SHA1 2dff99100da9588dd828fc4436a82d0b1a9f1354
SHA512 923d20a4396a788f2073ee9a1f34c7a74013e4a424a39a1b0bc14c1533c0c496e06e3ab702debfa193c84adf909203db8bb9ad52cad436c4d7a3b5cde6776678
SSDEEP 384:WZ2pfUx9eVLwDKO9XYD/isN7lCEjgwMU/ktKi+R45Duwomq8pqdDvHb1Q:Wr96YIrx7lC7vU/kaG9uLmCdb
TLSH
T120B24C07F38398BFC50BC1B186EF5772AA32BE211B616F6F1220F5756E24E90871DA14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2932-69-0x0000000000080000-0x0000000000153000-memory.dmp

Download

memory/2932-72-0x00007FFE9C9A9000-0x00007FFE9C9AB000-memory.dmp

Download

memory/4876-44-0x00007FFE90DA0000-0x00007FFE90DAF000-memory.dmp

Download

memory/4876-43-0x00007FFE90DA9000-0x00007FFE90DAA000-memory.dmp

Download

memory/4876-68-0x0000000003790000-0x00000000049C4000-memory.dmp

Download

memory/4876-70-0x0000000140000000-0x0000000140115000-memory.dmp

Download