Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/04/2026, 00:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
restart.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
restart.exe
Resource
win11-20260130-en
windows11-21h2-x64
7 signatures
150 seconds
General
- Target restart.exe
- Size 63KB
- Sample260423-bbvs2sfs4s
- SHA256 b68ee265308dc9da7dbb521bb71238d27ac50a5ee816f21c13818393be982d7a
- MD5 8242ce426ad462eff02edae1487a6949
- SHA1 9a4f382d427e0de729053535aaa3310cac5f087b
- SHA512 aff43a78d29ede49eac386d9b0b44d0f37d5a20bdda8553369d68dec90bbc727c6dd8fe239987a9d2e3affaeff8b72b5023ed973d7aecfbb99de46dca8c99ef1
- SSDEEP 768:xa+/MMnf2XivrjhmxEQSQIjDaGva2XaT+CSxKUAch9Itvo7vq2XFelWn2iED5Vx0:xa0wstmSpDaGS2RCSxK28otXFQwUx
- TLSH T160535B11B691C03AF0A225304DB5D3A18E3EBC32577994CF7794127D4EB27E2EA78366
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 16 IoCs
description ioc Process File created C:\Windows\system32\perfh010.dat WMIADAP.EXE File created C:\Windows\system32\PerfStringBackup.TMP WMIADAP.EXE File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.h WMIADAP.EXE File created C:\Windows\system32\perfc00C.dat WMIADAP.EXE File opened for modification C:\Windows\system32\PerfStringBackup.INI WMIADAP.EXE File created C:\Windows\system32\perfh009.dat WMIADAP.EXE File created C:\Windows\system32\perfh011.dat WMIADAP.EXE File created C:\Windows\system32\perfc007.dat WMIADAP.EXE File created C:\Windows\system32\perfh007.dat WMIADAP.EXE File created C:\Windows\system32\perfc009.dat WMIADAP.EXE File created C:\Windows\system32\perfc00A.dat WMIADAP.EXE File created C:\Windows\system32\perfc010.dat WMIADAP.EXE File created C:\Windows\system32\perfc011.dat WMIADAP.EXE File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini WMIADAP.EXE File created C:\Windows\system32\perfh00A.dat WMIADAP.EXE File created C:\Windows\system32\perfh00C.dat WMIADAP.EXE - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\inf\WmiApRpl\WmiApRpl.h WMIADAP.EXE File opened for modification C:\Windows\inf\WmiApRpl\WmiApRpl.h WMIADAP.EXE File created C:\Windows\inf\WmiApRpl\WmiApRpl.ini WMIADAP.EXE File opened for modification C:\Windows\inf\WmiApRpl\WmiApRpl.ini WMIADAP.EXE - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language restart.exe - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 4584 restart64.exe 4584 restart64.exe 4584 restart64.exe 4584 restart64.exe 4584 restart64.exe 4584 restart64.exe 4584 restart64.exe 4584 restart64.exe 4584 restart64.exe 4584 restart64.exe 4584 restart64.exe 4584 restart64.exe 4584 restart64.exe 4584 restart64.exe 4584 restart64.exe 4584 restart64.exe 4584 restart64.exe 4584 restart64.exe 4584 restart64.exe 4584 restart64.exe 4584 restart64.exe 4584 restart64.exe 4584 restart64.exe 4584 restart64.exe 4584 restart64.exe 4584 restart64.exe 4584 restart64.exe 4584 restart64.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeLoadDriverPrivilege 4584 restart64.exe Token: SeLoadDriverPrivilege 4584 restart64.exe Token: 33 3712 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3712 AUDIODG.EXE Token: SeLoadDriverPrivilege 4584 restart64.exe Token: SeLoadDriverPrivilege 4584 restart64.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4584 restart64.exe 4584 restart64.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1908 wrote to memory of 4584 1908 restart.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\restart.exe"C:\Users\Admin\AppData\Local\Temp\restart.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\restart64.exerestart64.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4584
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004C81⤵
- Suspicious use of AdjustPrivilegeToken
PID:3712
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /R /T1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:4868
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\System32\perfc007.dat
- Size 148KB
- SHA256 4e4e1300a939cc5d58d0c6914410d5ad8eaf876571011fa1c6f0ce27bf59822d
- MD5 6e71c59a539ba8c2d46c4c8f478edf8c
- SHA1 868558341297d83b247f8be13b375541eb58b886
- SHA512 1a86ab970d99430334ba14cc14d75cb902f267e9e15019afcb64400ec6e4335adae3687a5916ccfec5fd0c82c89bfeeac2aed0c6aad693f35e7326f8fb158f9e
- SSDEEP 3072:wb+j2tTPhtqHM8NgVbGc1h9IJO3I+/eOM2pWpry/WmRKpgJVC6vBGA1:XgJVCG
- TLSH T17DE324510BE9051DF2F7BF38AAF24045AE6AFDA6BE32E81D1150118E0572E11DCB5B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\perfc00A.dat
- Size 153KB
- SHA256 53d617778c1ba174c22b47fd2d84035aa28c58bdcab6c3f3224f3777d1d8e7ee
- MD5 6c65a113c1d1dcbc5f7603db0134dcb7
- SHA1 1eb93cc7aeb12860b63129a69b812b694748a816
- SHA512 67c438c141f7d6509db1d0bb17b312b66be8947a623580cc49fcb3000f7e402dda856ab1d422a68bbb25392d00902fef2bd31ce9cc491769205cdd7b31edf605
- SSDEEP 3072:XLx1hD5Jz3qFg2pWprycWTjKZLJVjjvhe0W:lLJVjO
- TLSH T11CF377505AF80216F2F3BF38AAFA55155E3ABD56AD36D42D0160128E0DB2F11DC78B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\perfc00C.dat
- Size 152KB
- SHA256 d15823dbb9f391daed10529f2e9d974ca4dd79dc6e602f5c9551ebdced676d06
- MD5 715bc40ecb88326ce04eff5c6f8f5019
- SHA1 dd7ff748c824f7ab41047dd55cfbe8d08e7c308e
- SHA512 9912d4830aae7afa2d961a93394e0a3f7133ef94e91d1f242619135ef4ec68e394ae9ca0a2e0021faf0accb5a109d29fdc771a560d1254eb0b93b5289fed8e0c
- SSDEEP 3072:SkDp3Z1hu/JK3XKG2pWpryGW1EKWGJVRoRvImR:SwGJVRE
- TLSH T148E39B945BF90116F2F7BF38A9FA11069E6ABD5BAD32D41D0191018E08B2F51DCB873B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\perfc010.dat
- Size 146KB
- SHA256 2e69db7389943a3ed9aee54788510f229b1462c6281e2a3e54d8b7e83fa1a0df
- MD5 31f061dd23766fb40b15c9754bbc5a61
- SHA1 1d6e9a4b87576e771c2c2157919236195aacf4d8
- SHA512 49af16e7d50be8025b3ecf6d4c965339ca4d4db29d3e606318c94f8f0e68d7914c57cb9ee78f5b8d35f5772c0b6e008b3196932785625019d28e6fe5d6ad7369
- SSDEEP 3072:0A67APDh1h9EJ53umw2pWprysWLDK7fJV65+gf8P:PfJV6i
- TLSH T176E3CCA16BF80109F2F77F38AAB951165E3ABE66AD31D42D0191018F09B2F51DCB473B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\perfc011.dat
- Size 126KB
- SHA256 26ee1d72642d1d79b307581e6027a259696d5e3299d9d6685153a68b8c58b61b
- MD5 5afbd30597a275ad6d5e98187742c01b
- SHA1 4e9a82a388532a0fcb3671047504384e040b48a1
- SHA512 6d2514d6a12809a7db4901b586b57e03b6e5b0cc4ecd1baeb4f5188ca033773f7ca077fa8e8beadcf82724fd16d9136c0fc252a0163b71a0ff0eae3363f2c0cf
- SSDEEP 3072:XJWO1h5/JN33o2tAIO2pWpryjWo3KvoJVVJBfYip:EoJVVb
- TLSH T109C3F1A55BF81018F2B77F3CAAF640529E6ABE66AE31D41D01A0114F05B3F12DCB573A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\perfh007.dat
- Size 724KB
- SHA256 d1b8be34dfdff53435bcd3f176f7aa9f17aa8f1145c42edee1ed1eec9faf02b2
- MD5 3bd8043ff69087c78cf81f0aa082664f
- SHA1 c669871201f05f6153dfa3f6a78d4609d818568e
- SHA512 a51d2bb5641aaff1ab091a1c331b6e515bb333d2dfa9f09662d35b2315e6fbd14932102167075cd8bdacf7c8f57fe7313f7b1639090070851c2ecf7662384d6d
- SSDEEP 3072:MhpwBxTEsmVdx1wN8EBNjcbg+hSILPDtzcSx2A8q1JuqaB32rSrSQYCxly/2dj9p:W3ddwzjNHX
- TLSH T1DAF4A76153EA8618F2F77F64AEB812A46E62BCE6FD79D64D1250109D0CB1F40C9B4B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\perfh009.dat
- Size 686KB
- SHA256 a0ae9b96680526dd73b3469504eaeb3882c655e3f4557b9e120de1ddd8edb834
- MD5 efeeda97e31eb12669293d78feaff451
- SHA1 f3680730a9ed165f49be4a2b1be8477196f15afb
- SHA512 452da0e9a2c17de87d5a0db150acf299310d684c50c4f16daa5f1c298267d76d990000a0bf4e5ffb2afe5769e74bfcdf351e8d68b933a432a9130cdcdd81f1b2
- SSDEEP 3072:NUdGNuowE4j0PrRZnpETMDZ8M6d0PHXOZocUqYm3MEnBeHsZhgX3eTxg5o/3ZdOm:78M6d0/OZLMbjNOCm
- TLSH T1C6E4799167FD4608F2F73F64A9B516A45E7ABCA6FD79C25C1250009E0AB2E50CCB0B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\perfh00A.dat
- Size 783KB
- SHA256 ba9df27d32c3fa43d6840146e28e5266908124efde25a4bf459d908c232a88a7
- MD5 ef8cce0162906b208cff1441fe71f927
- SHA1 7a3f2d0dcb39698a6ec9190ea69f2ea01d76935e
- SHA512 35b3dbb9f5cd8b30aa0a26fdb29c562ae65ab9823ba477f082960a19d354a68729008e3c0cfce2f8cce66f6f5bab9fed7d6cbe62628c7a751bc4770a4560f5e8
- SSDEEP 3072:o2xx7F17Fetjvtx1tT3JCF86nceg1ncBLOAv9Dy2Ym3vfKBNQyLLhGPy/+583TXi:+tjvtx1tT5SnyncBLOA5yQyLCt1ZjNA+
- TLSH T150050F5067F9560AF6F77F19A9B91A654E7ABD92EC39C11C0220019E0EB1F84CD78B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\perfh00C.dat
- Size 785KB
- SHA256 e962a408ff9a789b92bc1429637cb30e00fc47bfa3b06a7fd7b22646e1f5b872
- MD5 f5fd5898bda4a68842ec6c6a9088adec
- SHA1 f974a58b258b438e79eb4bea3ae54a91f516a10a
- SHA512 932e551597139b85b4faecfa9156e7e98d33b5dad4bd6f4c40504ced7b032c8fed223b81f056654a75c66a8326c51b28fef102ad55d5b224722f90c778b6ed98
- SSDEEP 3072:8seo6JpGytgViPIny4auTsQy2XQDIefsnnSRfERwpZRVDNtflhzKysdD4hqa1bYG:gTGgqaB2LAXNWTjNul
- TLSH T1AA052D60A7FA5209F6F73F64A8B915654E6B7D96EC39C21C0250009E1DB2F94CDB8B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\perfh010.dat
- Size 772KB
- SHA256 c70b892d93e93c37c826ba97459e8fb724e6c5cf6dc2288613430fc59c0c1eb0
- MD5 a583c28c05f94a635bd67fee2d905a27
- SHA1 a4af858c69297cb8a59cade7da6e5a36b43e7548
- SHA512 06626f291b69e044e8e44fa46576c0287e4df434cd07b0bdb1b162fed25ddef652e5ad8d08d984f2d7d4c027c8ee032eef485f7269f0a83e11c1fa61f80a5d67
- SSDEEP 3072:g+8gxXowjkUXx5E8d8tj/v9GLcr+cu8ov+pmPxIpzRa/rpdYm3ZBAdczUkhUCq7p:rYj/v9GLBopzgMdczU+qTMwH+jNV7K
- TLSH T14BF44462A7FD5608F2F77F54A97816654E7ABEA6AC39D21C0260009E0D72F54CCB0B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\perfh011.dat
- Size 468KB
- SHA256 73174de99ccd45c2a8d818742ed313a55321186162005c0f2567e162954943a5
- MD5 33cbb4d0e471fd527da2ded235fe9636
- SHA1 aa9d9b062511eb38a1faf9a740f8fb709b02a7dd
- SHA512 a4c17182347bc3c5cce76562f26b27ac62e84c8589dd91d2840a452b6c593656f3d3a2fd5b7f207f32be0f5a0494bc44987fb70e6e8f3a756a0703df20baa93f
- SSDEEP 3072:ZZg3ID5H7gVmRw4T0z+3dczXEeYm3xBsah25o8/v/BLiaj01s3jxrfBY4ftu9Oaz:Tg33mRwZz+3dRy4jNWBb1
- TLSH T107A4B88836EC060DF2F77F64A5B520A02E6EFD65AD7AC56C1550408F0972E58CEB4B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\Performance\WmiApRpl.h
- Size 3KB
- SHA256 ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15
- MD5 b133a676d139032a27de3d9619e70091
- SHA1 1248aa89938a13640252a79113930ede2f26f1fa
- SHA512 c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5
- TLSH T17561011D8E8A416EDA7E36A95C2C192419B5FE770AC058EF317DBCDF0D4A80A24D352F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\wbem\Performance\WmiApRpl.ini
- Size 29KB
- SHA256 c20b11dff802aa472265f4e9f330244ec4aca81b0009f6efcb2cf8a36086f390
- MD5 ffdeea82ba4a5a65585103dd2a922dfe
- SHA1 094c3794503245cc7dfa9e222d3504f449a5400b
- SHA512 7570527fdae4818f0fc780f9f141ab6a2d313cc6b3fdb1f7d7ff05d994ad77d3f8d168b1d77c2555d25dc487d24c18f2cc0eab505d1dd758d709f2576aac1a8a
- SSDEEP 384:eso3V1/z21+byTLVh4+rCop/g4kg4491T91XFrw4G4xvrtZ9dyu+2V0DrtcYkcTu:esoW/g4kg4oG4J
- TLSH T1F3D2201267F94158F2F66F98AAF594775A73BEE66D38D1AC01A0031E09E1E40CDB13B3
- MD5 SHA1 SHA512 SSDEEP TLSH