Analysis
- max time kernel
150s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/11/2026, 08:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
claudemeter.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
claudemeter.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target claudemeter.exe
- Size 4.2MB
- Sample261113-kstrrasw8q
- SHA256 36efd89fa1cebbe46140983325624c65d2ee1ec7b2e55ce10c9b6a61d91343cc
- MD5 bd503de004283f9a210f4ef5ed71361d
- SHA1 442b8f31e3e2ed3cd1c168efc11def0766213f29
- SHA512 c41ad8761e997bfe1aa1c7962f16a7de2316eba8947d2c44bf5239173d5fbcff2c5c204bf36e2056385403105890d5cd3114ccd4c14a757aa2519a29946a6d5b
- SSDEEP 49152:zQjCSpKdu3G2i994o1p00B4yiGzVNrev3OwUZXCr6VDgLyJ/j5yjxLN54zUqZ9uN:zQ319CyfW7IlDR4AOSn+Jp
- TLSH T1CF168E03F6A440E9C46EC538C726A233FB32BC9D5960B6AF2BD04A212F66F615F1D715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname claudemeter.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain claudemeter.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe 4120 claudemeter.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\config.json
- Size 1KB
- SHA256 f95b4f1f55da8b46b35e73eb3e6166daa7feabd03fbb31b350f2473dad228ab6
- MD5 83b0660074b87efcf18f005651b59d2d
- SHA1 52a0116c71be9a5795f20ba9ef80e73083ce1362
- SHA512 678ee38e546abf1bcec1169de32b3255bf66d3727fa572c101ff46fbc47859d23ff5b0ff4454e55c0f6dbca828cc679abb7805e19d441f31dd3cce91493b7c7f
- TLSH T1E6210500D4398CB617E4A53AA8AD13834725CC4B4B557E38779B091C1F6E7BA21B7BC6
- MD5 SHA1 SHA512 TLSH