Overview
overview
7Static
static
3AtomX-Manager.exe
windows10-2004-x64
7AtomX-Manager.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows11-21h2-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows11-21h2-x64
3AtomX-Manager.exe
windows10-2004-x64
7AtomX-Manager.exe
windows11-21h2-x64
4LICENSES.c...m.html
windows10-2004-x64
4LICENSES.c...m.html
windows11-21h2-x64
4d3dcompiler_47.dll
windows10-2004-x64
1dxcompiler.dll
windows10-2004-x64
1dxcompiler.dll
windows11-21h2-x64
1dxil.dll
windows10-2004-x64
1ffmpeg.dll
windows10-2004-x64
1ffmpeg.dll
windows11-21h2-x64
1libEGL.dll
windows10-2004-x64
1libEGL.dll
windows11-21h2-x64
1libGLESv2.dll
windows10-2004-x64
1libGLESv2.dll
windows11-21h2-x64
1resources/elevate.exe
windows10-2004-x64
3resources/elevate.exe
windows11-21h2-x64
3vk_swiftshader.dll
windows10-2004-x64
1vk_swiftshader.dll
windows11-21h2-x64
1vulkan-1.dll
windows10-2004-x64
1vulkan-1.dll
windows11-21h2-x64
1$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/05/2026, 17:13
Static task
static1
Behavioral task
behavioral1
Sample
AtomX-Manager.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
AtomX-Manager.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UAC.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
AtomX-Manager.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
AtomX-Manager.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
LICENSES.chromium.html
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
LICENSES.chromium.html
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
d3dcompiler_47.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
dxcompiler.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
dxcompiler.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral18
Sample
dxil.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
ffmpeg.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
ffmpeg.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
libEGL.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
libEGL.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
libGLESv2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
libGLESv2.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
resources/elevate.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
resources/elevate.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
vk_swiftshader.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
vk_swiftshader.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
vulkan-1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
vulkan-1.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20260513-en
windows11-21h2-x64
General
- Target AtomX-Manager.exe
- Size 168.6MB
- Sample260524-vrf5daft7z
- SHA256 37e70eeaa870672004395f62d69b1ca90aec9c545de51f6985cbb159a45e01fa
- MD5 87853ac3a81e4f29ec3345f484233e58
- SHA1 0887908cef321ef308c6a2db7b64fc0ddf7d7098
- SHA512 9d5d91f17823b6c9ee4fc7b25f5a561c9cdda639699cd866aeefa146b345e374a21855322c0fa8ab745a8a63b12b1c859a6420906fc4619541de155909737d85
- SSDEEP 1572864:Ygk56JPNp4z8eaOa4d/wuHxBV6KLmdef6kQ79ZWCQQ4pn4L/Xf2sPDzT9bqahMWJ:jqpxXhqxZ13
- TLSH T10C887C13F29641D9F05DD1B18B978236EE72B8850728A6DF2754072A2F77FE02B39B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation AtomX-Manager.exe Key value queried \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation AtomX-Manager.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4104 AtomX-Manager.exe 4104 AtomX-Manager.exe 4104 AtomX-Manager.exe 4104 AtomX-Manager.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3796 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 3796 AtomX-Manager.exe Token: SeShutdownPrivilege 3796 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 3796 AtomX-Manager.exe Token: SeShutdownPrivilege 3796 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 3796 AtomX-Manager.exe Token: SeShutdownPrivilege 3796 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 3796 AtomX-Manager.exe Token: SeShutdownPrivilege 3796 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 3796 AtomX-Manager.exe Token: SeShutdownPrivilege 3796 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 3796 AtomX-Manager.exe Token: SeShutdownPrivilege 3796 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 3796 AtomX-Manager.exe Token: SeShutdownPrivilege 3796 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 3796 AtomX-Manager.exe Token: SeShutdownPrivilege 3796 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 3796 AtomX-Manager.exe Token: SeShutdownPrivilege 3796 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 3796 AtomX-Manager.exe Token: SeShutdownPrivilege 3796 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 3796 AtomX-Manager.exe Token: SeShutdownPrivilege 3796 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 3796 AtomX-Manager.exe Token: SeShutdownPrivilege 3796 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 3796 AtomX-Manager.exe Token: SeShutdownPrivilege 3796 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 3796 AtomX-Manager.exe Token: SeShutdownPrivilege 3796 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 3796 AtomX-Manager.exe Token: SeShutdownPrivilege 3796 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 3796 AtomX-Manager.exe Token: SeShutdownPrivilege 3796 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 3796 AtomX-Manager.exe Token: SeShutdownPrivilege 3796 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 3796 AtomX-Manager.exe Token: SeShutdownPrivilege 3796 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 3796 AtomX-Manager.exe Token: SeShutdownPrivilege 3796 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 3796 AtomX-Manager.exe Token: SeShutdownPrivilege 3796 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 3796 AtomX-Manager.exe Token: SeShutdownPrivilege 3796 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 3796 AtomX-Manager.exe Token: SeShutdownPrivilege 3796 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 3796 AtomX-Manager.exe Token: SeShutdownPrivilege 3796 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 3796 AtomX-Manager.exe Token: SeShutdownPrivilege 3796 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 3796 AtomX-Manager.exe Token: SeShutdownPrivilege 3796 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 3796 AtomX-Manager.exe Token: SeShutdownPrivilege 3796 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 3796 AtomX-Manager.exe Token: SeShutdownPrivilege 3796 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 3796 AtomX-Manager.exe Token: SeShutdownPrivilege 3796 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 3796 AtomX-Manager.exe Token: SeShutdownPrivilege 3796 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 3796 AtomX-Manager.exe Token: SeShutdownPrivilege 3796 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 3796 AtomX-Manager.exe Token: SeShutdownPrivilege 3796 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 3796 AtomX-Manager.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3796 wrote to memory of 3188 3796 AtomX-Manager.exe 84 PID 3796 wrote to memory of 3188 3796 AtomX-Manager.exe 84 PID 3796 wrote to memory of 4712 3796 AtomX-Manager.exe 85 PID 3796 wrote to memory of 4872 3796 AtomX-Manager.exe 86 PID 3796 wrote to memory of 4104 3796 AtomX-Manager.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\AtomX-Manager.exe"C:\Users\Admin\AppData\Local\Temp\AtomX-Manager.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\AtomX-Manager.exe"C:\Users\Admin\AppData\Local\Temp\AtomX-Manager.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\AtomX Manager" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1704 --field-trial-handle=1708,i,16103500070679299525,16250992426306006768,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:22⤵PID:3188
-
-
C:\Users\Admin\AppData\Local\Temp\AtomX-Manager.exe"C:\Users\Admin\AppData\Local\Temp\AtomX-Manager.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\AtomX Manager" --mojo-platform-channel-handle=2128 --field-trial-handle=1708,i,16103500070679299525,16250992426306006768,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:82⤵PID:4712
-
-
C:\Users\Admin\AppData\Local\Temp\AtomX-Manager.exe"C:\Users\Admin\AppData\Local\Temp\AtomX-Manager.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\AtomX Manager" --app-user-model-id=com.electron --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2284 --field-trial-handle=1708,i,16103500070679299525,16250992426306006768,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:12⤵
- Checks computer location settings
PID:4872
-
-
C:\Users\Admin\AppData\Local\Temp\AtomX-Manager.exe"C:\Users\Admin\AppData\Local\Temp\AtomX-Manager.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\AtomX Manager" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2332 --field-trial-handle=1708,i,16103500070679299525,16250992426306006768,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4104
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\AtomX Manager\Partitions\app\Network\Network Persistent State
- Size 300B
- SHA256 f762707ab32d510dee627cc7b93085762a0bdbedcb49095e2bc943feeb20ed58
- MD5 ac64ab4ed8745fe12f46a3f8c0a86f35
- SHA1 cfcafb93084d8a1d8ba327c19f2428845665e13c
- SHA512 daf8800402045b29cb13ff4e881376d6138a78f842a138255ac4f878b3ba52640ca06dd42a3993ffec87a60b70663473218fa4c55b8e28e4d8b2df06bcf727d6
- TLSH T17DE0C2A7C2D85DBE4A9553F42A256953C2FA0C59521C2E06DAE8AB1E43A18B8591084F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\AtomX Manager\Partitions\app\Network\Network Persistent State~RFe5984f5.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512