8bb0dd3cbfc70e655a4378c70a92c14635c3244491533a2a3d024e5cf488e31d

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 21:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8bb0dd3cbfc70e655a4378c70a92c14635c3244491533a2a3d024e5cf488e31d.exe
Size 316KB
Sample260529-1etslaez2w
SHA256 8bb0dd3cbfc70e655a4378c70a92c14635c3244491533a2a3d024e5cf488e31d
MD5 9e36028dacdf7d676c4f89d168330e16
SHA1 5e70d31778d743038a04cab4b9614cc65e5e41e2
SHA512 80779a5741dcab4b3192ed7eb57726570b806176adf5c5b5d13f6f8f7eccc7063fd0fda40047f1dd55dbe2d36ca99f611264ad284942dd36a66dc4050d3a1d36
SSDEEP 6144:zQ8OyYvc36AVuc7DQd/5zlgBR4JDcyewbSoXrMh:zj16Qu15yBRCDvJXrMh
TLSH
T151648D5AF3A814F9F977923CC8529607E7B2BC160760D78F27A046663F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
720	apprt4c74.exe
3268	apprt4c74.exe
5472	svc4c74.exe
3968	svc4c74.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppRt4c74 = "C:\\Users\\Admin\\AppData\\Local\\AppRt4c74\\apprt4c74.exe"	8bb0dd3cbfc70e655a4378c70a92c14635c3244491533a2a3d024e5cf488e31d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppSvc4c74 = "C:\\Users\\Admin\\AppData\\Local\\Programs\\4c74\\svc4c74.exe"	apprt4c74.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1912	8bb0dd3cbfc70e655a4378c70a92c14635c3244491533a2a3d024e5cf488e31d.exe
1912	8bb0dd3cbfc70e655a4378c70a92c14635c3244491533a2a3d024e5cf488e31d.exe
720	apprt4c74.exe
720	apprt4c74.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 720	1912	8bb0dd3cbfc70e655a4378c70a92c14635c3244491533a2a3d024e5cf488e31d.exe	80
PID 720 wrote to memory of 5472	720	apprt4c74.exe	83

C:\Users\Admin\AppData\Local\Temp\8bb0dd3cbfc70e655a4378c70a92c14635c3244491533a2a3d024e5cf488e31d.exe
"C:\Users\Admin\AppData\Local\Temp\8bb0dd3cbfc70e655a4378c70a92c14635c3244491533a2a3d024e5cf488e31d.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Users\Admin\AppData\Local\AppRt4c74\apprt4c74.exe
  "C:\Users\Admin\AppData\Local\AppRt4c74\apprt4c74.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:720
- - C:\Users\Admin\AppData\Local\Programs\4c74\svc4c74.exe
    "C:\Users\Admin\AppData\Local\Programs\4c74\svc4c74.exe"
    3⤵
    - Executes dropped EXE
    PID:5472

C:\Users\Admin\AppData\Local\AppRt4c74\apprt4c74.exe
C:\Users\Admin\AppData\Local\AppRt4c74\apprt4c74.exe
1⤵
- Executes dropped EXE
PID:3268

C:\Users\Admin\AppData\Local\Programs\4c74\svc4c74.exe
C:\Users\Admin\AppData\Local\Programs\4c74\svc4c74.exe
1⤵
- Executes dropped EXE
PID:3968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprt4c74.exe

Path C:\Users\Admin\AppData\Local\AppRt4c74\apprt4c74.exe
Size 316KB
SHA256 4e2349fba9ce2f4ea98ebd9fb476bf191b7664624cc3d363a472ccefefde82d9
MD5 38a2df5d0cbd868573cfdc778f45de0c
SHA1 68f9628889a3e8625b03f4e39e0c20a1b63a90a1
SHA512 e89f0fad3d667a0eb2b4dcec5bbc7385af77551239e51df17fc908a405b00d751566f74822027d0f20c8ff3178357e91b54c1851fec9988690be7623067f284d
SSDEEP 6144:1Q8OyYvc36AVuc7DQd/5zlgBR4JDDyeWbSKLr4Y6:1j16Qu15yBRCDu9Lr4Y6
TLSH
T18E648D5AF3A814F9F977923CC8529607E772BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc4c74.exe

Path C:\Users\Admin\AppData\Local\Programs\4c74\svc4c74.exe
Size 317KB
SHA256 75ef503bd93a5a5cf861d3d0d44792f9a02263d386d4d33a8cabecf44aa928b1
MD5 6d54a8c2cc9563254376b42ca64dc646
SHA1 3558d8d55b4f1253894bd7a4b7ee63e55ec2f1e7
SHA512 fa3ca91a07bb9310723b2890e30370ebc8f0794667ef3b48a892cbef1c7a0c703ffdaf1e9e125ec5e90d6a15961d36b97142f84d0309069ea0ea7e716faefa73
SSDEEP 6144:nQ8OyYvc36AVuc7DQd/5zlgBR4JDQyeVbSTHrh2:nj16Qu15yBRCDDlHrh2
TLSH
T12A648D5AF3A814F9F977923CC8529607E772BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download