Overview
overview
7Static
static
3AtomX-Manager.exe
windows10-2004-x64
7AtomX-Manager.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows11-21h2-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows11-21h2-x64
3AtomX-Manager.exe
windows10-2004-x64
7AtomX-Manager.exe
windows11-21h2-x64
4LICENSES.c...m.html
windows10-2004-x64
4LICENSES.c...m.html
windows11-21h2-x64
4d3dcompiler_47.dll
windows10-2004-x64
1dxcompiler.dll
windows10-2004-x64
1dxcompiler.dll
windows11-21h2-x64
1dxil.dll
windows10-2004-x64
1ffmpeg.dll
windows10-2004-x64
1ffmpeg.dll
windows11-21h2-x64
1libEGL.dll
windows10-2004-x64
1libEGL.dll
windows11-21h2-x64
1libGLESv2.dll
windows10-2004-x64
1libGLESv2.dll
windows11-21h2-x64
1resources/elevate.exe
windows10-2004-x64
3resources/elevate.exe
windows11-21h2-x64
3vk_swiftshader.dll
windows10-2004-x64
1vk_swiftshader.dll
windows11-21h2-x64
1vulkan-1.dll
windows10-2004-x64
1vulkan-1.dll
windows11-21h2-x64
1$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
158s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
24/05/2026, 17:13
Static task
static1
Behavioral task
behavioral1
Sample
AtomX-Manager.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
AtomX-Manager.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UAC.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
AtomX-Manager.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
AtomX-Manager.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
LICENSES.chromium.html
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
LICENSES.chromium.html
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
d3dcompiler_47.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
dxcompiler.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
dxcompiler.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral18
Sample
dxil.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
ffmpeg.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
ffmpeg.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
libEGL.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
libEGL.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
libGLESv2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
libGLESv2.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
resources/elevate.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
resources/elevate.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
vk_swiftshader.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
vk_swiftshader.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
vulkan-1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
vulkan-1.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20260513-en
windows11-21h2-x64
General
- Target AtomX-Manager.exe
- Size 168.6MB
- Sample260524-vrf5daft7z
- SHA256 37e70eeaa870672004395f62d69b1ca90aec9c545de51f6985cbb159a45e01fa
- MD5 87853ac3a81e4f29ec3345f484233e58
- SHA1 0887908cef321ef308c6a2db7b64fc0ddf7d7098
- SHA512 9d5d91f17823b6c9ee4fc7b25f5a561c9cdda639699cd866aeefa146b345e374a21855322c0fa8ab745a8a63b12b1c859a6420906fc4619541de155909737d85
- SSDEEP 1572864:Ygk56JPNp4z8eaOa4d/wuHxBV6KLmdef6kQ79ZWCQQ4pn4L/Xf2sPDzT9bqahMWJ:jqpxXhqxZ13
- TLSH T10C887C13F29641D9F05DD1B18B978236EE72B8850728A6DF2754072A2F77FE02B39B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp AtomX-Manager.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3748 AtomX-Manager.exe 3748 AtomX-Manager.exe 3748 AtomX-Manager.exe 3748 AtomX-Manager.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1760 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 1760 AtomX-Manager.exe Token: SeShutdownPrivilege 1760 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 1760 AtomX-Manager.exe Token: SeShutdownPrivilege 1760 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 1760 AtomX-Manager.exe Token: SeShutdownPrivilege 1760 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 1760 AtomX-Manager.exe Token: SeShutdownPrivilege 1760 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 1760 AtomX-Manager.exe Token: SeShutdownPrivilege 1760 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 1760 AtomX-Manager.exe Token: SeShutdownPrivilege 1760 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 1760 AtomX-Manager.exe Token: SeShutdownPrivilege 1760 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 1760 AtomX-Manager.exe Token: SeShutdownPrivilege 1760 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 1760 AtomX-Manager.exe Token: SeShutdownPrivilege 1760 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 1760 AtomX-Manager.exe Token: SeShutdownPrivilege 1760 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 1760 AtomX-Manager.exe Token: SeShutdownPrivilege 1760 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 1760 AtomX-Manager.exe Token: SeShutdownPrivilege 1760 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 1760 AtomX-Manager.exe Token: SeShutdownPrivilege 1760 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 1760 AtomX-Manager.exe Token: SeShutdownPrivilege 1760 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 1760 AtomX-Manager.exe Token: SeShutdownPrivilege 1760 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 1760 AtomX-Manager.exe Token: SeShutdownPrivilege 1760 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 1760 AtomX-Manager.exe Token: SeShutdownPrivilege 1760 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 1760 AtomX-Manager.exe Token: SeShutdownPrivilege 1760 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 1760 AtomX-Manager.exe Token: SeShutdownPrivilege 1760 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 1760 AtomX-Manager.exe Token: SeShutdownPrivilege 1760 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 1760 AtomX-Manager.exe Token: SeShutdownPrivilege 1760 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 1760 AtomX-Manager.exe Token: SeShutdownPrivilege 1760 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 1760 AtomX-Manager.exe Token: SeShutdownPrivilege 1760 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 1760 AtomX-Manager.exe Token: SeShutdownPrivilege 1760 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 1760 AtomX-Manager.exe Token: SeShutdownPrivilege 1760 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 1760 AtomX-Manager.exe Token: SeShutdownPrivilege 1760 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 1760 AtomX-Manager.exe Token: SeShutdownPrivilege 1760 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 1760 AtomX-Manager.exe Token: SeShutdownPrivilege 1760 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 1760 AtomX-Manager.exe Token: SeShutdownPrivilege 1760 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 1760 AtomX-Manager.exe Token: SeShutdownPrivilege 1760 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 1760 AtomX-Manager.exe Token: SeShutdownPrivilege 1760 AtomX-Manager.exe Token: SeCreatePagefilePrivilege 1760 AtomX-Manager.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1760 wrote to memory of 6048 1760 AtomX-Manager.exe 80 PID 1760 wrote to memory of 6048 1760 AtomX-Manager.exe 80 PID 1760 wrote to memory of 4640 1760 AtomX-Manager.exe 81 PID 1760 wrote to memory of 4016 1760 AtomX-Manager.exe 82 PID 1760 wrote to memory of 3748 1760 AtomX-Manager.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\AtomX-Manager.exe"C:\Users\Admin\AppData\Local\Temp\AtomX-Manager.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\AtomX-Manager.exe"C:\Users\Admin\AppData\Local\Temp\AtomX-Manager.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\AtomX Manager" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1664 --field-trial-handle=1668,i,15631268347493230146,9221601842172118695,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:22⤵PID:6048
-
-
C:\Users\Admin\AppData\Local\Temp\AtomX-Manager.exe"C:\Users\Admin\AppData\Local\Temp\AtomX-Manager.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\AtomX Manager" --mojo-platform-channel-handle=2112 --field-trial-handle=1668,i,15631268347493230146,9221601842172118695,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:82⤵PID:4640
-
-
C:\Users\Admin\AppData\Local\Temp\AtomX-Manager.exe"C:\Users\Admin\AppData\Local\Temp\AtomX-Manager.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\AtomX Manager" --app-user-model-id=com.electron --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2260 --field-trial-handle=1668,i,15631268347493230146,9221601842172118695,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:12⤵PID:4016
-
-
C:\Users\Admin\AppData\Local\Temp\AtomX-Manager.exe"C:\Users\Admin\AppData\Local\Temp\AtomX-Manager.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\AtomX Manager" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2268 --field-trial-handle=1668,i,15631268347493230146,9221601842172118695,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3748
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\AtomX Manager\Partitions\app\Network\Network Persistent State~RFe592d30.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\AtomX Manager\Partitions\app\Network\dfbd6ee3-19ca-43ec-9a9d-5893f2304ef2.tmp
- Size 300B
- SHA256 a4ef733ab7cb54e4b1c51b631dc691741a5e6d7ff9e78042dcda5d58c4ae1925
- MD5 2f5bcedc006cbf7ad544010203bf4c62
- SHA1 2b359223bcfa561374c2a3a7620f87ed952af7b0
- SHA512 b1eea5f66e710c9bfe25cc1ba261fbe8b066a12fca1d9e16b8bc8d0e8d3fd956493736a3f41d6fdf4f59b498914f01032c2a1c4abbdaf4740c13180e151a29a9
- TLSH T18EE07293C3D84CBE4A8283F02A246913C2BE080952182E06D9E8BB0E43A28B8480044B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512