fbcc202299e3d05aab564373b031cfd62870665c996362174cda7314b1c8693c

Analysis

max time kernel
298s
max time network
59s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
17/04/2026, 13:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
monoxide/x86/.rdata
Size 46KB
Sample260417-qagblaex2r
SHA256 fbcc202299e3d05aab564373b031cfd62870665c996362174cda7314b1c8693c
MD5 8b9010f893c9326319ddcfc3cf165d88
SHA1 e919850f8362eb69309d7fac75d1b036d962ebeb
SHA512 3d0c1bb7c7e8a5e18753543843d0ec4dc1bdf21ab69c7049d9e3c893a624f18ebb52332a50f3ce50df4d81df9f5c3159989c40980fb9a77fe8f8c0f44e886fca
SSDEEP 768:SgSppdyQxZCJWgilusWogNcdUSjD9vm3NdiM4INduPbOUDgaNMbcr+:c9CJclusWogNcdUGQNdiMBNh4q
TLSH
T14D23F701B6EA8995F6B71F715CB08A85097AFC509F71DE2F3384235F1DA86D48A21F32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3480	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\monoxide\x86\.rdata
1⤵
- Modifies registry class
PID:4124

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3480-0-0x000002B4B7CD0000-0x000002B4B843C000-memory.dmp

Download