8cc23ec8a9c33899def338b152f8a9522f52981b47eff9caf8c64fe6d3951746

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 15:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bk_client-windows7-x86_64.exe
Size 7.1MB
Sample261113-tbe2psds71
SHA256 8cc23ec8a9c33899def338b152f8a9522f52981b47eff9caf8c64fe6d3951746
MD5 72a56eedded601760581ffebe9d3a076
SHA1 4e1cd79ba9c62d971892fa59583588e324fbc65a
SHA512 f7c588acc3bdcfda185b15942cd715cc93b5f6cea943797dd0db6d365e0cc09f45812885c877ccbc504e0901e5c0ee4b14354a433b23066e9eed4e181a6b8dc2
SSDEEP 49152:QsBfKaDfBj87VKrb/TfvO90d7HjmAFd4A64nsfJJ02pB+x0xCvvw0V4GhSNciOPk:el7VpnzxA5P84RosFCPEayM
TLSH
T15A762907F89151A9C1EAD1308A669213BA717C9A4B3073D33B5CF7B82F32BD46A79354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	bk_client-windows7-x86_64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	bk_client-windows7-x86_64.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
788	bk_client-windows7-x86_64.exe
788	bk_client-windows7-x86_64.exe
788	bk_client-windows7-x86_64.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
788	bk_client-windows7-x86_64.exe
788	bk_client-windows7-x86_64.exe
788	bk_client-windows7-x86_64.exe

C:\Users\Admin\AppData\Local\Temp\bk_client-windows7-x86_64.exe
"C:\Users\Admin\AppData\Local\Temp\bk_client-windows7-x86_64.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads