General
- Target ToDesk_x64_5.exe
- Size 122.6MB
- Sample261110-v8e9eahd76
- SHA256 e42d8580e193b484d85f5fd17e7e16e1afd18aca70278a635279b4620afbb11f
- MD5 1bc37b70ca2c76608717e83f6619e68b
- SHA1 addeb76b032bec535981edfe73a481d1d49707bb
- SHA512 69a3e71f4a77170eb8da3117fec2b241fa082cf51fe3e0ddb4d8d04255052f7d1abe27022d70171e9a3505ac298fb9a78ef3e6dbc013a4d18da7acf53ab40416
- SSDEEP 3145728:tdvGTxpP59WydHJw3hNT129VuU5VaB2XDom6jg:tYTxV59H8hNxg5hxB
- TLSH T18E583321E351C074F15602B0E4AA1BBF4E3E7E748B2990D35BF07E1AB9316C1AB39759
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
ToDesk_x64_5.exe
Resource
win10v2004-20260911-en
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
ToDesk_x64_5.exe
Resource
win11ltsc2024-20260911-en
24 signatures
150 seconds
Malware Config
Targets
-
- Target ToDesk_x64_5.exe
- Size 122.6MB
- SHA256 e42d8580e193b484d85f5fd17e7e16e1afd18aca70278a635279b4620afbb11f
- MD5 1bc37b70ca2c76608717e83f6619e68b
- SHA1 addeb76b032bec535981edfe73a481d1d49707bb
- SHA512 69a3e71f4a77170eb8da3117fec2b241fa082cf51fe3e0ddb4d8d04255052f7d1abe27022d70171e9a3505ac298fb9a78ef3e6dbc013a4d18da7acf53ab40416
- SSDEEP 3145728:tdvGTxpP59WydHJw3hNT129VuU5VaB2XDom6jg:tYTxV59H8hNxg5hxB
- TLSH T18E583321E351C074F15602B0E4AA1BBF4E3E7E748B2990D35BF07E1AB9316C1AB39759
- MD5 SHA1 SHA512 SSDEEP TLSH
Suspicious use of NtCreateUserProcessOtherParentProcess
Executes dropped EXE
Loads dropped DLL
Modifies file permissions
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Access Token Manipulation
1Parent PID Spoofing
1Process Injection
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Access Token Manipulation
1Parent PID Spoofing
1File and Directory Permissions Modification
1Hide Artifacts
2Hidden Files and Directories
2Process Injection
1