d7cf025eb876f6f40f6ea7aab13fdc5e847641b6d2fc1dcd8e7f5cb0807f9388

Analysis

user interaction
yes
max time kernel
64s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/04/2026, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vega1.6.exe
Size 275KB
Sample260417-rr3rlacs5v
SHA256 d7cf025eb876f6f40f6ea7aab13fdc5e847641b6d2fc1dcd8e7f5cb0807f9388
MD5 dc948b7c302e5b67ecd516d3128424e6
SHA1 c73bc574b6d58f35cf7cda83634b9f1bdeec756a
SHA512 3303c5bc293ff6d09be2184e3f3bf720e1c607ffdd950daca05fe90860934d3f105e1fd3dcdc563491bfb2831b344f24209fd0b755c04a2b5d54135467927b03
SSDEEP 6144:P72/Ck03Yw+Hwuon3vCy0uxZB33RnWcvzQnCHSaM/Axa5:PgCkkYwH3KExZvWOQnCYAo
TLSH
T1EB545B85B2E80DE8F8674078D4A6A71BD5323C545F20D6CF33D801592FB36E0A9F6B66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion

Malware Config

Signatures

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4744	ipconfig.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3100	vega1.6.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 1432	3100	vega1.6.exe	82
PID 1432 wrote to memory of 4744	1432	cmd.exe	83
PID 3100 wrote to memory of 2388	3100	vega1.6.exe	84
PID 3100 wrote to memory of 4864	3100	vega1.6.exe	85

C:\Users\Admin\AppData\Local\Temp\vega1.6.exe
"C:\Users\Admin\AppData\Local\Temp\vega1.6.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ipconfig /flushdns
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Windows\system32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:4744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del imgui.ini
  2⤵
  PID:2388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:4864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads