c5513b120c6d13967cebb30e4e6241a240a4ba5e56ef5e33766bc5b4f0b79a59

General

Target
c5513b120c6d13967cebb30e4e6241a240a4ba5e56ef5e33766bc5b4f0b79a59.exe
Size 315KB
Sample260529-jdkd4ae17s
SHA256 c5513b120c6d13967cebb30e4e6241a240a4ba5e56ef5e33766bc5b4f0b79a59
MD5 67d479454e56989893525151d3b3b90e
SHA1 a45326656c4a2febf8ef99c4a904cc5df665dfc0
SHA512 fb189efc49f77a306f2edd26b13201ecfcdc9b1c4c6ce4531e4ec7aa10c0f377d1bd5b902c9b1a3d5fe8715c0dad56ddb1aa7ae169c139728026317a7e9b717e
SSDEEP 6144:SQ8OyYvc36AVuc7DQd/5zlgBR4JDHye6bSpGrc:Sj16Qu15yBRCDSKGrc
TLSH
T116648D5AF3A814F9F977923CC8529507E772BC160760D78F27A0466A3F236A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
240	apprt528a.exe
3336	apprt528a.exe
1516	svc528a.exe
1424	svc528a.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppSvc528a = "C:\\Users\\Admin\\AppData\\Local\\Programs\\528a\\svc528a.exe"	apprt528a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppRt528a = "C:\\Users\\Admin\\AppData\\Local\\AppRt528a\\apprt528a.exe"	c5513b120c6d13967cebb30e4e6241a240a4ba5e56ef5e33766bc5b4f0b79a59.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	checkip.amazonaws.com
3	ip-api.com
4	checkip.amazonaws.com

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	apprt528a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	apprt528a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	apprt528a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	apprt528a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svc528a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svc528a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	c5513b120c6d13967cebb30e4e6241a240a4ba5e56ef5e33766bc5b4f0b79a59.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svc528a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svc528a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	c5513b120c6d13967cebb30e4e6241a240a4ba5e56ef5e33766bc5b4f0b79a59.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1308	c5513b120c6d13967cebb30e4e6241a240a4ba5e56ef5e33766bc5b4f0b79a59.exe
1308	c5513b120c6d13967cebb30e4e6241a240a4ba5e56ef5e33766bc5b4f0b79a59.exe
1308	c5513b120c6d13967cebb30e4e6241a240a4ba5e56ef5e33766bc5b4f0b79a59.exe
1308	c5513b120c6d13967cebb30e4e6241a240a4ba5e56ef5e33766bc5b4f0b79a59.exe
240	apprt528a.exe
240	apprt528a.exe
1308	c5513b120c6d13967cebb30e4e6241a240a4ba5e56ef5e33766bc5b4f0b79a59.exe
1308	c5513b120c6d13967cebb30e4e6241a240a4ba5e56ef5e33766bc5b4f0b79a59.exe
240	apprt528a.exe
240	apprt528a.exe
3336	apprt528a.exe
3336	apprt528a.exe
1516	svc528a.exe
1516	svc528a.exe
1424	svc528a.exe
1424	svc528a.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 240	1308	c5513b120c6d13967cebb30e4e6241a240a4ba5e56ef5e33766bc5b4f0b79a59.exe	84
PID 240 wrote to memory of 1516	240	apprt528a.exe	87

C:\Users\Admin\AppData\Local\Temp\c5513b120c6d13967cebb30e4e6241a240a4ba5e56ef5e33766bc5b4f0b79a59.exe
"C:\Users\Admin\AppData\Local\Temp\c5513b120c6d13967cebb30e4e6241a240a4ba5e56ef5e33766bc5b4f0b79a59.exe"
1⤵
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Users\Admin\AppData\Local\AppRt528a\apprt528a.exe
  "C:\Users\Admin\AppData\Local\AppRt528a\apprt528a.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:240
- - C:\Users\Admin\AppData\Local\Programs\528a\svc528a.exe
    "C:\Users\Admin\AppData\Local\Programs\528a\svc528a.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:1516

C:\Users\Admin\AppData\Local\AppRt528a\apprt528a.exe
C:\Users\Admin\AppData\Local\AppRt528a\apprt528a.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3336

C:\Users\Admin\AppData\Local\Programs\528a\svc528a.exe
C:\Users\Admin\AppData\Local\Programs\528a\svc528a.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprt528a.exe

Path C:\Users\Admin\AppData\Local\AppRt528a\apprt528a.exe
Size 315KB
SHA256 6287146ac89d97cef9163e13ee90d97ce9b2ec2353afe23e0e83271f4e69273e
MD5 f005c73d281a55664786ca9b9c973893
SHA1 cc43473f94591cfa8c6ee758da56ae45b5027702
SHA512 6be44cc4ff71cd119e5a12030cd65e81e2de5d38ab918656b9011fe8dc5230331cf18f6cefb411ea63310ed5daf8f8771f14c6c9ee096b4cdd8c7c2ba9189538
SSDEEP 6144:eQ8OyYvc36AVuc7DQd/5zlgBR4JDcyepbS54rY:ej16Qu15yBRCDvb4rY
TLSH
T183648D5AF3A814F9F977923CC8529507E772BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc528a.exe

Path C:\Users\Admin\AppData\Local\Programs\528a\svc528a.exe
Size 316KB
SHA256 8a5e37fc74a011acf5abf14c619a4e9e37e9a83f4f649f0217f51d0fe32c0806
MD5 411537ae1d93f48b0eacb9133cdba613
SHA1 2de352545949ae327ecbf915379cd00ca5738596
SHA512 c7c0f17e36ae27797dac2a34e094c8c9e9ab40ca2ce9f9584025b5676657aff6424c9063c70bf9144e727568904dd4f1b4181533ed3e617049db731f630e803b
SSDEEP 6144:NQ8OyYvc36AVuc7DQd/5zlgBR4JD0ye6bSPqrf:Nj16Qu15yBRCDHcqrf
TLSH
T1BF648D5AF3A814F9F977923CC8529507E772BC160760D78F27A0466A3F236A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_2026-05_1308.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-05_1308.txt
Size 657B
SHA256 8577f081f845eabd59f49eaf5946cb3ffb6a837d8935adb316f66e21fdae8a35
MD5 30806995faaa56023535740557531240
SHA1 65a4f28f73b7be1ecd26bf96c83eface9e7bd979
SHA512 7cbde39282e8592bfaf9ca42d086b162683e35c54b7868e7b759f2f5cd132cf1d17da08034fc5c3524757effe13acfb101d75dde25b644757ec4a76dee8b48d8
TLSH
T11601DB5AF3F9386E01A3E562D3B57D861C48333F96D5B8197090511C5165AC15BC8399
MD5 SHA1 SHA512 TLSH

Submit Download

log_2026-05_1424.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-05_1424.txt
Size 657B
SHA256 830d630de221a6d6f0293d395a1f4c5e944367d9866e6d84f0d4b7bf7c7173d6
MD5 dcca752d54846fe8ceacbc990a96ad24
SHA1 05645a3e75654fc179b0b1f12f5a1e32e44e5283
SHA512 15aff27b9c6e4b19a77ac1eb36f020e678ab60d4aa863cc870a78ab377f7994dd6ae74f7c5297dafe5be17fef3d4372eac04d83bd94fb3f616a844c610956007
TLSH
T11F01DB56B1FDBC6E01B2E947D7D95D81144433379EC9EE0D70A0529D51645415FC83DC
MD5 SHA1 SHA512 TLSH

Submit Download

log_2026-05_1516.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-05_1516.txt
Size 657B
SHA256 f08e58d8da71c5ddb6dca57e250f8cab73a38e24ec4bda0a63a910c5ef096df5
MD5 2085b05c777d07cc40b55c8db227e6ed
SHA1 01caf4fd4140ca5672762d078e62612b81a01f6b
SHA512 5827548421456fc34bfdf0f539bb719fe3b89d19a2d22e60860aed8f462d22553b235e6c0190e58f8f59704c9c91ae4231b3cfe295c9782e4862fac6bac2fb5d
TLSH
T139012BD671F97C6E11E7E543F7F95E81144033778EC56E0D7004515D9664C415BC8398
MD5 SHA1 SHA512 TLSH

Submit Download

log_2026-05_1516.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-05_1516.txt
Size 1KB
SHA256 001c11a0cf1fb7fcee589af4ef76fba7d8af2b69ec8c525e3f24140cffdc16cc
MD5 2753dfee57873f4c7b0c6c38e7b01107
SHA1 a75e27ebfaa8f84aa7021383fb9d4630f90aca9a
SHA512 1f022d18db4a5403cee6ec56a22279fd81163468e1456e5aa96578f4a3644ccf2592d6696e9c6331d4b8d4da386bb17210e53223c888351fc5c4f05ffb8d09ee
TLSH
T103210AC661FA7C6E20ABF523F7ED5EC11444327B8A89EE0D7204815E9A94D912FCC798
MD5 SHA1 SHA512 TLSH

Submit Download

log_2026-05_240.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-05_240.txt
Size 650B
SHA256 262522b89521df3532eb1f81311e0a65c974661c665c22135802ff193bdf3c40
MD5 65eff681f6a837aee361ed006b60e803
SHA1 b53be7e5a63acd429464f4d89b8a30f9b333a2af
SHA512 0982b711ca224f070dcb6632db1eff56f0d69a1a91079a6f07449cf7f365c2bacc72fba7fa712e5faba14684199cb3c5859f86f690917035c1b50dbaa63dee9e
TLSH
T18CF0A2A661F97C6F32F2DE47E794AE811880332797C55445A210523C63E65C16FCA3DC
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1308-0-0x0000000180000000-0x000000018048B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads