0d72b3c57b70e68cdbf0c94b2a443df48d946ed6ca41c8867d2279d447fe105f

Analysis

user interaction
yes
max time kernel
80s
max time network
80s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 19:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AXO-X.exe
Size 11.3MB
Sample260511-yay6eahs3v
SHA256 0d72b3c57b70e68cdbf0c94b2a443df48d946ed6ca41c8867d2279d447fe105f
MD5 f7833afb60938cde9bb4089823e66312
SHA1 d8a69900cfac0b9261eba05ca132b433e8e59274
SHA512 9f7bf1435e2251d2b1e2aeafd506d38e707e01a67f42059b2bb2238b1d5802239c76983bad764f874b5943988cfe2c97efd562776cd31259aac8f6629f1541d4
SSDEEP 196608:lwqv9i/NNyWlki6rxJrDrBX3FooRZRVqFEJDTifZGeLTPAkUoVi9x:lhV6WWCpr3BX5RvGGDkZGATPQ
TLSH
T110C623BA62A43758C40AC9B89433BD4AB2F5511B0BF9B6BE75CF36C0779F500D602B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery vmprotect

Malware Config

Signatures

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/4468-3-0x00007FF71DBF0000-0x00007FF71F13E000-memory.dmp	vmprotect
behavioral1/memory/4468-9-0x00007FF71DBF0000-0x00007FF71F13E000-memory.dmp	vmprotect
behavioral1/memory/4468-14-0x00007FF71DBF0000-0x00007FF71F13E000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4468	AXO-X.exe

System Time Discovery 1 TTPs 6 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4912	cmd.exe
4916	net.exe
4816	net1.exe
4240	cmd.exe
3908	net.exe
840	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4468	AXO-X.exe
4468	AXO-X.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 4732	4468	AXO-X.exe	85
PID 4732 wrote to memory of 4724	4732	cmd.exe	86
PID 4468 wrote to memory of 3260	4468	AXO-X.exe	87
PID 3260 wrote to memory of 4688	3260	cmd.exe	88
PID 4468 wrote to memory of 4912	4468	AXO-X.exe	89
PID 4912 wrote to memory of 4916	4912	cmd.exe	90
PID 4916 wrote to memory of 4816	4916	net.exe	91
PID 4468 wrote to memory of 4240	4468	AXO-X.exe	92
PID 4240 wrote to memory of 3908	4240	cmd.exe	93
PID 3908 wrote to memory of 840	3908	net.exe	94
PID 4468 wrote to memory of 5900	4468	AXO-X.exe	95
PID 5900 wrote to memory of 6016	5900	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\AXO-X.exe
"C:\Users\Admin\AppData\Local\Temp\AXO-X.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c w32tm /config /update >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Windows\system32\w32tm.exe
    w32tm /config /update
    3⤵
    PID:4724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c w32tm /resync /force >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3260
- - C:\Windows\system32\w32tm.exe
    w32tm /resync /force
    3⤵
    PID:4688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop w32time >nul 2>&1
  2⤵
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Windows\system32\net.exe
    net stop w32time
    3⤵
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:4916
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop w32time
      4⤵
      System Time Discovery
      PID:4816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net start w32time >nul 2>&1
  2⤵
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Windows\system32\net.exe
    net start w32time
    3⤵
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:3908
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start w32time
      4⤵
      System Time Discovery
      PID:840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c w32tm /resync /nowait >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5900
- - C:\Windows\system32\w32tm.exe
    w32tm /resync /nowait
    3⤵
    PID:6016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4468-0-0x00007FF71DD0D000-0x00007FF71E5F3000-memory.dmp

Download

memory/4468-1-0x00007FFFDA710000-0x00007FFFDA712000-memory.dmp

Download

memory/4468-2-0x00007FFFDA720000-0x00007FFFDA722000-memory.dmp

Download

memory/4468-3-0x00007FF71DBF0000-0x00007FF71F13E000-memory.dmp

Download

memory/4468-7-0x000001BEAB010000-0x000001BEAB13A000-memory.dmp

Download

memory/4468-8-0x00007FF71DD0D000-0x00007FF71E5F3000-memory.dmp

Download

memory/4468-9-0x00007FF71DBF0000-0x00007FF71F13E000-memory.dmp

Download

memory/4468-11-0x000001BEAB010000-0x000001BEAB13A000-memory.dmp

Download

memory/4468-12-0x000001BEAB010000-0x000001BEAB13A000-memory.dmp

Download

memory/4468-13-0x00007FF71DD0D000-0x00007FF71E5F3000-memory.dmp

Download

memory/4468-14-0x00007FF71DBF0000-0x00007FF71F13E000-memory.dmp

Download