Overview
overview
10Static
static
10BIN/AgentC...ib.dll
windows10-2004-x64
1BIN/AgentC...ib.dll
windows11-21h2-x64
1BIN/Connec...is.exe
windows10-2004-x64
1BIN/Connec...is.exe
windows11-21h2-x64
1BIN/Coreinfo.exe
windows10-2004-x64
3BIN/Coreinfo.exe
windows11-21h2-x64
3BIN/Databa...er.exe
windows10-2004-x64
1BIN/Databa...er.exe
windows11-21h2-x64
1BIN/Displa...te.exe
windows10-2004-x64
1BIN/MDECli...er.exe
windows10-2004-x64
3BIN/MDECli...on.exe
windows10-2004-x64
1BIN/MDECli...on.exe
windows11-21h2-x64
1BIN/Procmon.exe
windows10-2004-x64
8BIN/Procmon.exe
windows11-21h2-x64
8BIN/SQLCheck.exe
windows10-2004-x64
5BIN/SQLCheck.exe
windows11-21h2-x64
5BIN/Showpriv.exe
windows10-2004-x64
3BIN/Showpriv.exe
windows11-21h2-x64
3BIN/Sysmon.exe
windows10-2004-x64
4BIN/Sysmon.exe
windows11-21h2-x64
4BIN/VmlTrace.exe
windows10-2004-x64
1BIN/VmlTrace_2012.exe
windows10-2004-x64
1BIN/VmlTrace_2012.exe
windows11-21h2-x64
1BIN/WinHTTPDiag.exe
windows10-2004-x64
1BIN/WinHTTPDiag.exe
windows11-21h2-x64
1BIN/accesschk.exe
windows10-2004-x64
3BIN/accesschk.exe
windows11-21h2-x64
3BIN/autorunsc.exe
windows10-2004-x64
3BIN/autorunsc.exe
windows11-21h2-x64
3BIN/avdnettest.exe
windows10-2004-x64
1BIN/avdnettest.exe
windows11-21h2-x64
1BIN/diskspd.exe
windows10-2004-x64
1Analysis
- max time kernel
149s - max time network
137s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
09/04/2026, 00:18
Static task
static1
Behavioral task
behavioral1
Sample
BIN/AgentConfigManagerLib.dll
Resource
win10v2004-20260129-en
Behavioral task
behavioral2
Sample
BIN/AgentConfigManagerLib.dll
Resource
win11-20260130-en
Behavioral task
behavioral3
Sample
BIN/ConnectivityDiagnosis.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral4
Sample
BIN/ConnectivityDiagnosis.exe
Resource
win11-20260130-en
Behavioral task
behavioral5
Sample
BIN/Coreinfo.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral6
Sample
BIN/Coreinfo.exe
Resource
win11-20260130-en
Behavioral task
behavioral7
Sample
BIN/DatabaseAnalyzer.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral8
Sample
BIN/DatabaseAnalyzer.exe
Resource
win11-20260130-en
Behavioral task
behavioral9
Sample
BIN/DisplayExtendedAttribute.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral10
Sample
BIN/MDEClientAnalyzer.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral11
Sample
BIN/MDEClientAnalyzerPreviousVersion.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral12
Sample
BIN/MDEClientAnalyzerPreviousVersion.exe
Resource
win11-20260130-en
Behavioral task
behavioral13
Sample
BIN/Procmon.exe
Resource
win10v2004-20260129-en
Behavioral task
behavioral14
Sample
BIN/Procmon.exe
Resource
win11-20260130-en
Behavioral task
behavioral15
Sample
BIN/SQLCheck.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral16
Sample
BIN/SQLCheck.exe
Resource
win11-20260130-en
Behavioral task
behavioral17
Sample
BIN/Showpriv.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral18
Sample
BIN/Showpriv.exe
Resource
win11-20260130-en
Behavioral task
behavioral19
Sample
BIN/Sysmon.exe
Resource
win10v2004-20260129-en
Behavioral task
behavioral20
Sample
BIN/Sysmon.exe
Resource
win11-20260130-en
Behavioral task
behavioral21
Sample
BIN/VmlTrace.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral22
Sample
BIN/VmlTrace_2012.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral23
Sample
BIN/VmlTrace_2012.exe
Resource
win11-20260130-en
Behavioral task
behavioral24
Sample
BIN/WinHTTPDiag.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral25
Sample
BIN/WinHTTPDiag.exe
Resource
win11-20260130-en
Behavioral task
behavioral26
Sample
BIN/accesschk.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral27
Sample
BIN/accesschk.exe
Resource
win11-20260130-en
Behavioral task
behavioral28
Sample
BIN/autorunsc.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral29
Sample
BIN/autorunsc.exe
Resource
win11-20260130-en
Behavioral task
behavioral30
Sample
BIN/avdnettest.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral31
Sample
BIN/avdnettest.exe
Resource
win11-20260130-en
Behavioral task
behavioral32
Sample
BIN/diskspd.exe
Resource
win10v2004-20260129-en
General
- Target BIN/autorunsc.exe
- Size 701KB
- Sample260409-alts3ag16y
- SHA256 666aa8972b4b0a1e5df53c076af44479f2f94b16f9fb56e15e6d104ed86ca9f4
- MD5 b76978d483ee6afcf5b919a51a7d111e
- SHA1 6b0292325505fc3ba638d42330a75cbdf237561b
- SHA512 2e7f076441f7cceb1e1eb38044d7a7df4226249d4526621bb23e28fefaca80820f5a5899709862191b03837aa659be076dfc960488e24a8dd5f87b28aefe804d
- SSDEEP 12288:WN/2Ekjc139fb/AJEAs8K85G3wwgwI6Ox1y95:WN/LX/AJ9s8/5G9gwI6gy7
- TLSH T1FEE45A0076A59035F1F252B029399776383EBC719A358CDFA3C0695E1DB5AC1AB3872F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language autorunsc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1908 autorunsc.exe 1908 autorunsc.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1908 autorunsc.exe Token: SeImpersonatePrivilege 1908 autorunsc.exe Token: SeSecurityPrivilege 1908 autorunsc.exe Token: SeDebugPrivilege 1908 autorunsc.exe Token: SeBackupPrivilege 1908 autorunsc.exe Token: SeRestorePrivilege 1908 autorunsc.exe