0d72b3c57b70e68cdbf0c94b2a443df48d946ed6ca41c8867d2279d447fe105f

Analysis

max time kernel
149s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 19:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AXO-X.exe
Size 11.3MB
Sample260511-yay6eahs3v
SHA256 0d72b3c57b70e68cdbf0c94b2a443df48d946ed6ca41c8867d2279d447fe105f
MD5 f7833afb60938cde9bb4089823e66312
SHA1 d8a69900cfac0b9261eba05ca132b433e8e59274
SHA512 9f7bf1435e2251d2b1e2aeafd506d38e707e01a67f42059b2bb2238b1d5802239c76983bad764f874b5943988cfe2c97efd562776cd31259aac8f6629f1541d4
SSDEEP 196608:lwqv9i/NNyWlki6rxJrDrBX3FooRZRVqFEJDTifZGeLTPAkUoVi9x:lhV6WWCpr3BX5RvGGDkZGATPQ
TLSH
T110C623BA62A43758C40AC9B89433BD4AB2F5511B0BF9B6BE75CF36C0779F500D602B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery vmprotect

Malware Config

Signatures

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/3316-7-0x00007FF74EF80000-0x00007FF7504CE000-memory.dmp	vmprotect
behavioral2/memory/3316-18-0x00007FF74EF80000-0x00007FF7504CE000-memory.dmp	vmprotect
behavioral2/memory/3316-24-0x00007FF74EF80000-0x00007FF7504CE000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3316	AXO-X.exe

System Time Discovery 1 TTPs 6 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3924	cmd.exe
1996	net.exe
5640	net1.exe
4712	cmd.exe
5064	net.exe
1068	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3316	AXO-X.exe
3316	AXO-X.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 5084	3316	AXO-X.exe	81
PID 5084 wrote to memory of 5088	5084	cmd.exe	82
PID 3316 wrote to memory of 2912	3316	AXO-X.exe	83
PID 2912 wrote to memory of 5092	2912	cmd.exe	84
PID 3316 wrote to memory of 3924	3316	AXO-X.exe	85
PID 3924 wrote to memory of 1996	3924	cmd.exe	86
PID 1996 wrote to memory of 5640	1996	net.exe	87
PID 3316 wrote to memory of 4712	3316	AXO-X.exe	88
PID 4712 wrote to memory of 5064	4712	cmd.exe	89
PID 5064 wrote to memory of 1068	5064	net.exe	90
PID 3316 wrote to memory of 3032	3316	AXO-X.exe	91
PID 3032 wrote to memory of 3736	3032	cmd.exe	92
PID 3316 wrote to memory of 5648	3316	AXO-X.exe	93
PID 5648 wrote to memory of 2328	5648	cmd.exe	94
PID 5648 wrote to memory of 2972	5648	cmd.exe	95
PID 5648 wrote to memory of 5164	5648	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\AXO-X.exe
"C:\Users\Admin\AppData\Local\Temp\AXO-X.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c w32tm /config /update >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Windows\system32\w32tm.exe
    w32tm /config /update
    3⤵
    PID:5088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c w32tm /resync /force >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\system32\w32tm.exe
    w32tm /resync /force
    3⤵
    PID:5092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop w32time >nul 2>&1
  2⤵
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Windows\system32\net.exe
    net stop w32time
    3⤵
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:1996
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop w32time
      4⤵
      System Time Discovery
      PID:5640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net start w32time >nul 2>&1
  2⤵
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Windows\system32\net.exe
    net start w32time
    3⤵
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:5064
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start w32time
      4⤵
      System Time Discovery
      PID:1068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c w32tm /resync /nowait >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\system32\w32tm.exe
    w32tm /resync /nowait
    3⤵
    PID:3736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\AXO-X.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5648
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\AXO-X.exe" MD5
    3⤵
    PID:2328
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:2972
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:5164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3316-0-0x00007FF74F09D000-0x00007FF74F983000-memory.dmp

Download

memory/3316-1-0x00007FFD73550000-0x00007FFD73552000-memory.dmp

Download

memory/3316-2-0x00007FFD73560000-0x00007FFD73562000-memory.dmp

Download

memory/3316-7-0x00007FF74EF80000-0x00007FF7504CE000-memory.dmp

Download

memory/3316-16-0x000002E3E46E0000-0x000002E3E47CA000-memory.dmp

Download

memory/3316-17-0x00007FF74F09D000-0x00007FF74F983000-memory.dmp

Download

memory/3316-18-0x00007FF74EF80000-0x00007FF7504CE000-memory.dmp

Download

memory/3316-23-0x000002E3E46E0000-0x000002E3E47CA000-memory.dmp

Download

memory/3316-24-0x00007FF74EF80000-0x00007FF7504CE000-memory.dmp

Download