bb4e630195c956983ad3d68d41108c139e3ae2186d86463038f49b1928b750b2

Analysis

max time kernel
298s
max time network
48s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
17/04/2026, 13:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
monoxide/x64/.pdata
Size 5KB
Sample260417-qagblaex2r
SHA256 bb4e630195c956983ad3d68d41108c139e3ae2186d86463038f49b1928b750b2
MD5 9098223b2c59f90338ead418078afe19
SHA1 09a170c90416f1b41afd94210fc48269fb1d8e38
SHA512 5717d38d3dc4d19e1b86fc1be41fe411de0ac8753f1b9b4e2ec1519333b847c8d60cc1fe3bfc3f6934c03ae94fc080d2b112273fd09e84ec9bcc42a831c5412a
SSDEEP 96:MbMBv6nlJL+wJ1JaAHyLKwyjQUgDcAohhgoaV3HW6n76GkqjO6qxF:BEPL+wJ1RyGwNUgDRoaVXWkzVy
TLSH
T12EC1A3833BC929ABCC4F98352B15CB7FC0DB941C07F8E654CB2A4FBC5975B28915A902
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3852	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\monoxide\x64\.pdata
1⤵
- Modifies registry class
PID:4712

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3852-1-0x0000017E0F8F0000-0x0000017E0F945000-memory.dmp

Download

memory/4712-0-0x000001A7FDD80000-0x000001A7FDDD5000-memory.dmp