ced1e49aab29de3911f9e7d945a1f175dd624e37d316ecf8539742e622ba07df

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 13:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.6MB
Sample260423-qamtdaet2x
SHA256 ced1e49aab29de3911f9e7d945a1f175dd624e37d316ecf8539742e622ba07df
MD5 154e1a702dd011065a8e45db78ff6a85
SHA1 34abc701a388bc0471f34d695ebb6203fd5c6eab
SHA512 76455b1d6c122e0ac8db4d981ca56979e0226ab93bd62cbffe8f3e2e51ee6dc908732e67f5449974c20af783519a31009b03eb639c4f7688bcaefde08e188aad
SSDEEP 49152:G5L+ozwvutk3fp1SazD41PDuav+vDFeYw9z74lj:bosvJ41tcDoglj
TLSH
T1AE75D005E3E416B4E63BD278CBA64233E6B6B8450760AEDF0369D5152F33ED06B3A315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
1	ip-api.com
2	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3944 set thread context of 5484	3944	file.exe	79

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ServiceModelReg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ServiceModelReg.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 5484	3944	file.exe	79
PID 3944 wrote to memory of 5484	3944	file.exe	79
PID 3944 wrote to memory of 5484	3944	file.exe	79
PID 5484 wrote to memory of 3872	5484	ServiceModelReg.exe	80
PID 5484 wrote to memory of 3872	5484	ServiceModelReg.exe	80
PID 5484 wrote to memory of 4848	5484	ServiceModelReg.exe	82
PID 5484 wrote to memory of 4848	5484	ServiceModelReg.exe	82
PID 5484 wrote to memory of 4344	5484	ServiceModelReg.exe	84
PID 5484 wrote to memory of 4344	5484	ServiceModelReg.exe	84
PID 5484 wrote to memory of 5180	5484	ServiceModelReg.exe	86
PID 5484 wrote to memory of 5180	5484	ServiceModelReg.exe	86

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:5484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:3872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:5180

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4716

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3408-26-0x0000020CBABE0000-0x0000020CBAC3D000-memory.dmp

Download

memory/3944-0-0x00000245C4890000-0x00000245C4891000-memory.dmp

Download

memory/4716-25-0x000001F3A9A90000-0x000001F3A9AED000-memory.dmp

Download

memory/5484-11-0x00007FF6E0370000-0x00007FF6E044F000-memory.dmp

Download

memory/5484-10-0x00007FF6E0370000-0x00007FF6E044F000-memory.dmp

Download

memory/5484-17-0x00007FF6E0370000-0x00007FF6E044F000-memory.dmp

Download

memory/5484-15-0x00007FF6E0370000-0x00007FF6E044F000-memory.dmp

Download

memory/5484-16-0x00007FF6E0370000-0x00007FF6E044F000-memory.dmp

Download

memory/5484-13-0x00007FF6E0370000-0x00007FF6E044F000-memory.dmp

Download

memory/5484-14-0x00007FF6E0370000-0x00007FF6E044F000-memory.dmp

Download

memory/5484-19-0x00007FF6E0370000-0x00007FF6E044F000-memory.dmp

Download

memory/5484-12-0x00007FF6E0370000-0x00007FF6E044F000-memory.dmp

Download

memory/5484-18-0x00007FF6E0370000-0x00007FF6E044F000-memory.dmp

Download

memory/5484-9-0x00007FF6E0370000-0x00007FF6E044F000-memory.dmp

Download

memory/5484-7-0x000002192F040000-0x000002192F041000-memory.dmp

Download

memory/5484-20-0x00007FF6E0370000-0x00007FF6E044F000-memory.dmp

Download

memory/5484-1-0x00007FF6E0370000-0x00007FF6E044F000-memory.dmp

Download

memory/5484-21-0x00007FF6E0370000-0x00007FF6E044F000-memory.dmp

Download

memory/5484-22-0x00007FF6E0370000-0x00007FF6E044F000-memory.dmp

Download

memory/5484-115-0x00007FF6E0370000-0x00007FF6E044F000-memory.dmp

Download

memory/5484-118-0x0000021930EA0000-0x0000021930EFD000-memory.dmp

Download

memory/5484-117-0x0000021930E80000-0x0000021930E8C000-memory.dmp

Download

memory/5484-114-0x00007FF6E0370000-0x00007FF6E044F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads