Overview
overview
10Static
static
10Cia2O5x.exe
windows10-2004-x64
7Cia2O5x.exe
windows11-21h2-x64
7EBoost.exe
windows10-2004-x64
10EBoost.exe
windows11-21h2-x64
10LdlY2ri.exe
windows10-2004-x64
7LdlY2ri.exe
windows11-21h2-x64
7Loader.exe
windows10-2004-x64
7Loader.exe
windows11-21h2-x64
6StatedPanasonic.exe
windows10-2004-x64
10btZfO26.exe
windows10-2004-x64
7btZfO26.exe
windows11-21h2-x64
7build.exe
windows10-2004-x64
10build.exe
windows11-21h2-x64
10candy.exe
windows10-2004-x64
8candy.exe
windows11-21h2-x64
8hhKfuYso.exe
windows10-2004-x64
10hhKfuYso.exe
windows11-21h2-x64
10kRHhLlh.exe
windows10-2004-x64
7kRHhLlh.exe
windows11-21h2-x64
7lZDeIYoXVz.exe
windows10-2004-x64
10lZDeIYoXVz.exe
windows11-21h2-x64
10rVYGceP.exe
windows10-2004-x64
7rVYGceP.exe
windows11-21h2-x64
7random.exe
windows10-2004-x64
8random.exe
windows11-21h2-x64
7request.exe
windows10-2004-x64
7request.exe
windows11-21h2-x64
7Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260129-en - resource tags
arch:x64arch:x86image:win10v2004-20260129-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/02/2026, 00:04
Behavioral task
behavioral1
Sample
Cia2O5x.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Cia2O5x.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
EBoost.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
EBoost.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
LdlY2ri.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
LdlY2ri.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
Loader.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Loader.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
StatedPanasonic.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
btZfO26.exe
Resource
win10v2004-20260129-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
btZfO26.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral12
Sample
build.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
build.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral14
Sample
candy.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
candy.exe
Resource
win11-20250610-en
windows11-21h2-x64
Behavioral task
behavioral16
Sample
hhKfuYso.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
hhKfuYso.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral18
Sample
kRHhLlh.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
kRHhLlh.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral20
Sample
lZDeIYoXVz.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
lZDeIYoXVz.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral22
Sample
rVYGceP.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
rVYGceP.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral24
Sample
random.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
random.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral26
Sample
request.exe
Resource
win10v2004-20260129-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
request.exe
Resource
win11-20260130-en
windows11-21h2-x64
General
- Target request.exe
- Size 770KB
- Sample260211-acn68act4b
- SHA256 d9db8bdad5edd37400bb6b885f65a0aee158c8b6e3f517e8de9c6a114e3a40be
- MD5 cca25e0ed7f8326f06a45e3163ccfd20
- SHA1 94368a83013e6e408d859c87fe54a7f140e96548
- SHA512 41845c5e1c16e39ae1d3942e11b5a225ae0a66afde21ae88461e7805871a2185c77e471bd7fcc0ab7ca85d51f19f9a1c4d1b441bdb8ff4eed805c65fbd76dc1f
- SSDEEP 24576:nalksa0JaV5yCr6wIv2wnvtVSkIHcStEV:nays5JaKwVwlz
- TLSH T118F433105BF10A2DF8868B70F6BDB0ABF8FC757A519123570568C2247C9A8C781BBBC5
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 816 SecurityGuardService.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-538547578-2715485343-2034567214-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoreSyncManager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System32\\SecurityGuardService.exe" reg.exe - Modifies registry key 1 TTPs 1 IoCs
pid Process 3392 reg.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeLockMemoryPrivilege 1792 request.exe - Suspicious use of FindShellTrayWindow 46 IoCs
pid Process 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe - Suspicious use of SendNotifyMessage 46 IoCs
pid Process 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe 1792 request.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1792 wrote to memory of 1612 1792 request.exe 88 PID 1792 wrote to memory of 3392 1792 request.exe 90 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 1612 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\request.exe"C:\Users\Admin\AppData\Local\Temp\request.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\system32\attrib.exe"attrib" C:\Users\Admin\AppData\Local\Temp\System322⤵
- Views/modifies file attributes
PID:1612
-
-
C:\Windows\system32\reg.exe"reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v CoreSyncManager /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\System32\SecurityGuardService.exe /f2⤵
- Adds Run key to start application
- Modifies registry key
PID:3392
-
-
C:\Users\Admin\AppData\Local\Temp\System32\SecurityGuardService.exeC:\Users\Admin\AppData\Local\Temp\System32\SecurityGuardService.exe1⤵
- Executes dropped EXE
PID:816
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\System32\SecurityGuardService.exe
- Size 770KB
- SHA256 d9db8bdad5edd37400bb6b885f65a0aee158c8b6e3f517e8de9c6a114e3a40be
- MD5 cca25e0ed7f8326f06a45e3163ccfd20
- SHA1 94368a83013e6e408d859c87fe54a7f140e96548
- SHA512 41845c5e1c16e39ae1d3942e11b5a225ae0a66afde21ae88461e7805871a2185c77e471bd7fcc0ab7ca85d51f19f9a1c4d1b441bdb8ff4eed805c65fbd76dc1f
- SSDEEP 24576:nalksa0JaV5yCr6wIv2wnvtVSkIHcStEV:nays5JaKwVwlz
- TLSH T118F433105BF10A2DF8868B70F6BDB0ABF8FC757A519123570568C2247C9A8C781BBBC5
- MD5 SHA1 SHA512 SSDEEP TLSH