Overview

overview

7

Static

static

3

Transcripts.exe

windows11-21h2-x64

7

Resubmissions

16/05/2026, 09:06

260516-k2ts4sft4n7

16/05/2026, 09:00

260516-kyn4fsft3m7

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    16/05/2026, 09:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Transcripts.exe
  • Size 56.8MB
  • Sample260516-kyn4fsft3m
  • SHA256 ec42699286186e724c7d30991b28522f04b7eef8d5e21a95cb947abe1be88d5d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryransomware

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 64 IoCs
  • Badlisted process makes network request 6 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Transcripts.exe
    "C:\Users\Admin\AppData\Local\Temp\Transcripts.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2888
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7zS84BEDAB8\0.78.1-build.46770.msi" ID=c89c42fa-89c6-43e6-b120-af27c3e47f7b KEY=oNohwWRH86obdEDTVJj4eW2MMCCiRkj/ccIdvX+Xc0o= ADDR=https://linkmgmt.immy.bot/plugins/api/v1/1
      2⤵
      • Badlisted process makes network request
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:3276
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:764
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:5480
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding E34CF69E4B27BA5D52FCAE23CCB80D1C
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2860
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI4869.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240732390 2 WixSharp!WixSharp.ManagedProjectActions.WixSharp_InitRuntime_Action
          3⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:1488
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI4A9D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240732843 11 WixSharp!WixSharp.ManagedProjectActions.WixSharp_Load_Action
          3⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:5880
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI4D1F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240733484 17 WixSharp!WixSharp.ManagedProjectActions.WixSharp_BeforeInstall_Action
          3⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:2440
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 9BB2829703A9685451416942753EAC5F E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2108
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI50AC.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240734453 32 WixSharp!WixSharp.ManagedProjectActions.WixSharp_AfterInstall_Action
          3⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4008
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:4020
    • C:\Program Files (x86)\ImmyBot\Immybot.Agent.exe
      "C:\Program Files (x86)\ImmyBot\Immybot.Agent.exe" service run
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • System policy modification
      PID:5624

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e594628.rbs
          • Path C:\Config.Msi\e594628.rbs
          • Size 242KB
          • SHA256 14fd2a10bb7e688feda5653c2755a55aea67d307eec7ac736234a7b9119edb35
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          329B6147266C1E26CD774EA22B79EC2E
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\329B6147266C1E26CD774EA22B79EC2E
          • Size 168KB
          • SHA256 0589c4bdf236008ac02f29e311ed286338ce5741c727a89675ff395bc4bc687d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          329B6147266C1E26CD774EA22B79EC2E
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\329B6147266C1E26CD774EA22B79EC2E
          • Size 306B
          • SHA256 8735775af7174e1d1d7b60822c62a08272952ef89b8d5056bb3a9dc6843e02ec
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          rundll32.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
          • Size 651B
          • SHA256 3c801df6bf214e7b7b80514241c3f6d0d250ddbefd8c3dcffc7402c2e755f970
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSI4869.tmp
          • Path C:\Windows\Installer\MSI4869.tmp
          • Size 778KB
          • SHA256 2a9d21b4f47ff9dd6e1cd42a3db4bfdcfb3d3041c8e12ea94f1a1df830af18e2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Deployment.WindowsInstaller.dll
          • Path C:\Windows\Installer\MSI4869.tmp-0\Microsoft.Deployment.WindowsInstaller.dll
          • Size 183KB
          • SHA256 791da16b0df6956e88b04dab8b543b99dc2abd9af24aa25208fe5a0981e811b3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WixSharp.dll
          • Path C:\Windows\Installer\MSI4869.tmp-0\WixSharp.dll
          • Size 445KB
          • SHA256 36cbe48899ef8e8eb622a1f92c8ec30cac2c5038328105b2473be66321231f8b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CustomAction.config
          • Path C:\Windows\Installer\MSI4A9D.tmp-0\CustomAction.config
          • Size 980B
          • SHA256 1a67f60962ca1cbf19873b62a8518efe8c701a09cd609af4c50ecc7f0b468bb8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          WixSharpSetup.exe
          • Path C:\Windows\Installer\MSI4A9D.tmp-0\WixSharpSetup.exe
          • Size 27KB
          • SHA256 74ab11ac1e791c0231013529377d56c2ab3400329d24af6b61e5467a35280887
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Newtonsoft.Json.dll
          • Path C:\Windows\Installer\MSI4D1F.tmp-0\Newtonsoft.Json.dll
          • Size 695KB
          • SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI4FDF.tmp
          • Path C:\Windows\Installer\MSI4FDF.tmp
          • Size 234KB
          • SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Immense.RemoteControl.Desktop.Shared.dll
          • Path C:\Windows\SystemTemp\.net\Immybot.Agent\2-oP2I1RTWH5\Immense.RemoteControl.Desktop.Shared.dll
          • Size 276KB
          • SHA256 93fa84ad9c7444de5114baad55d75bcfbe4f34273d8a24b4af4a430bd38ebbab
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Immybot.Agent.Startup.dll
          • Path C:\Windows\SystemTemp\.net\Immybot.Agent\2-oP2I1RTWH5\Immybot.Agent.Startup.dll
          • Size 41KB
          • SHA256 ada9a2313b0b5020d7820f3bd832cbf2e28c46ac32c30430f6e40ad1f964bc9d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Immybot.Agent.dll
          • Path C:\Windows\SystemTemp\.net\Immybot.Agent\2-oP2I1RTWH5\Immybot.Agent.dll
          • Size 262KB
          • SHA256 5cf608530cac1612db5607deef55e0a8e633ed166d0e7c8191cafc51289b443b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Serilog.dll
          • Path C:\Windows\SystemTemp\.net\Immybot.Agent\2-oP2I1RTWH5\Serilog.dll
          • Size 169KB
          • SHA256 040aa6f5de878a0ff06b522d9ba394ef4286169a6dc2c2aa7525cb15b04dcfac
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Collections.dll
          • Path C:\Windows\SystemTemp\.net\Immybot.Agent\2-oP2I1RTWH5\System.Collections.dll
          • Size 274KB
          • SHA256 8936e76fc0e394c8e3b36df14256865d13159c66c108a1640812970ba6f1c901
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.CommandLine.NamingConventionBinder.dll
          • Path C:\Windows\SystemTemp\.net\Immybot.Agent\2-oP2I1RTWH5\System.CommandLine.NamingConventionBinder.dll
          • Size 50KB
          • SHA256 04069e8d5f3ecb66a17d579c6bcea26372ceb9b6dee7bcd8bdf5d315ba394732
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.CommandLine.dll
          • Path C:\Windows\SystemTemp\.net\Immybot.Agent\2-oP2I1RTWH5\System.CommandLine.dll
          • Size 200KB
          • SHA256 2158cfc2c484ebdec95fd9959c7eecaebe44657e1e1dee5abb78fc971276829f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Private.CoreLib.dll
          • Path C:\Windows\SystemTemp\.net\Immybot.Agent\2-oP2I1RTWH5\System.Private.CoreLib.dll
          • Size 14.8MB
          • SHA256 551d4dfa1a38a55d24e680667bf3586e3556bcd6774efd27886aa02a9670c905
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Private.Uri.dll
          • Path C:\Windows\SystemTemp\.net\Immybot.Agent\2-oP2I1RTWH5\System.Private.Uri.dll
          • Size 238KB
          • SHA256 689d7ccb9ce413e12f65ce1f8c0c1bf05f694214e36a4594f89ede08eee89993
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Runtime.dll
          • Path C:\Windows\SystemTemp\.net\Immybot.Agent\2-oP2I1RTWH5\System.Runtime.dll
          • Size 44KB
          • SHA256 314e93eb4230acb7ae227c00d120bb86c19cac6e45f1a256fafca090ffcff3e2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          netstandard.dll
          • Path C:\Windows\SystemTemp\.net\Immybot.Agent\2-oP2I1RTWH5\netstandard.dll
          • Size 98KB
          • SHA256 5019cfff88b1117fb4b139de05f7ef9ad1f44002d9156c1007efa78731dae063
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1488-43-0x00000000055B0000-0x0000000005626000-memory.dmp
          Download

          memory/1488-39-0x0000000003140000-0x000000000316E000-memory.dmp
          Download

          memory/2440-111-0x0000000004D50000-0x0000000004D72000-memory.dmp
          Download

          memory/2440-108-0x0000000004E10000-0x0000000004EC2000-memory.dmp
          Download

          memory/2440-112-0x0000000004ED0000-0x0000000005227000-memory.dmp
          Download

          memory/5880-74-0x0000000002AE0000-0x0000000002AEA000-memory.dmp
          Download