a553f04b83a9ad7ea6260d894d9a26665f6e0e4fe75038700b7e66ea694232be

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a553f04b83a9ad7ea6260d894d9a26665f6e0e4fe75038700b7e66ea694232be.exe
Size 316KB
Sample260601-22wfdagy4x
SHA256 a553f04b83a9ad7ea6260d894d9a26665f6e0e4fe75038700b7e66ea694232be
MD5 80f1dcee7774d8700a7ce3cea797dfbe
SHA1 60f0f67f58c980147d6f1f836fef2025ef4f7a7f
SHA512 4cc521ff4b25e1b82347af096ddeb9f67179aa447635772a5e37b46e9bb2016ba4db6c058aebb7c822c55a28f3ce02a77fea0ccf80899faa3d5d6c5c1e3feb92
SSDEEP 6144:wQ8OyYvc36AVuc7DQd/5zlgBR4JD8yembS51rxS:wj16Qu15yBRCDPa1rxS
TLSH
T152648D5AF3A904F9F977923CC8529607E772BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3456	apprt4c74.exe
1256	apprt4c74.exe
4272	svc4c74.exe
4688	svc4c74.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppSvc4c74 = "C:\\Users\\Admin\\AppData\\Local\\Programs\\4c74\\svc4c74.exe"	apprt4c74.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppRt4c74 = "C:\\Users\\Admin\\AppData\\Local\\AppRt4c74\\apprt4c74.exe"	a553f04b83a9ad7ea6260d894d9a26665f6e0e4fe75038700b7e66ea694232be.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5072	a553f04b83a9ad7ea6260d894d9a26665f6e0e4fe75038700b7e66ea694232be.exe
5072	a553f04b83a9ad7ea6260d894d9a26665f6e0e4fe75038700b7e66ea694232be.exe
3456	apprt4c74.exe
3456	apprt4c74.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 3456	5072	a553f04b83a9ad7ea6260d894d9a26665f6e0e4fe75038700b7e66ea694232be.exe	80
PID 3456 wrote to memory of 4272	3456	apprt4c74.exe	83

C:\Users\Admin\AppData\Local\Temp\a553f04b83a9ad7ea6260d894d9a26665f6e0e4fe75038700b7e66ea694232be.exe
"C:\Users\Admin\AppData\Local\Temp\a553f04b83a9ad7ea6260d894d9a26665f6e0e4fe75038700b7e66ea694232be.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Users\Admin\AppData\Local\AppRt4c74\apprt4c74.exe
  "C:\Users\Admin\AppData\Local\AppRt4c74\apprt4c74.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Users\Admin\AppData\Local\Programs\4c74\svc4c74.exe
    "C:\Users\Admin\AppData\Local\Programs\4c74\svc4c74.exe"
    3⤵
    - Executes dropped EXE
    PID:4272

C:\Users\Admin\AppData\Local\AppRt4c74\apprt4c74.exe
C:\Users\Admin\AppData\Local\AppRt4c74\apprt4c74.exe
1⤵
- Executes dropped EXE
PID:1256

C:\Users\Admin\AppData\Local\Programs\4c74\svc4c74.exe
C:\Users\Admin\AppData\Local\Programs\4c74\svc4c74.exe
1⤵
- Executes dropped EXE
PID:4688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprt4c74.exe

Path C:\Users\Admin\AppData\Local\AppRt4c74\apprt4c74.exe
Size 317KB
SHA256 fc440dbfb72182b4ad5cfdda568a04bae7edd28d9b649ded9243a2eea66cc515
MD5 3d75c9f3ca4be523aa40e2ccca7611de
SHA1 7d6f21083ee006be63889130b4967332b9ea35a7
SHA512 04d733c57e59799728da9e83959f32c8d44c75d4de1d63b575ffb8a36156e13277a5454955d0088afb1b0996d6818824ff974e27508135a0d688472f3085bf1f
SSDEEP 6144:sQ8OyYvc36AVuc7DQd/5zlgBR4JDvyeLbSn1r/V:sj16Qu15yBRCD6/1r/V
TLSH
T109648D5AF3A814F9F977923CC8529607E772BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc4c74.exe

Path C:\Users\Admin\AppData\Local\Programs\4c74\svc4c74.exe
Size 317KB
SHA256 b1d9a70fd72a4512e586a770fde34df5c66566ec66420cb187718271e15d72d0
MD5 743ad9c6cd1b197e92ca798e868d318f
SHA1 a4eafb33ba678575b7e2db600ab8e05a46a5b05c
SHA512 f555ce7b02584c28c4fb7df8e2c4fd508ffaa0882f836dcf601b5be56cf0ce64aa3c248a2e78a8c82a9c68c9caaeab597be5b084580868e35375969be974819b
SSDEEP 6144:5Q8OyYvc36AVuc7DQd/5zlgBR4JDHyeHbSD/rP+:5j16Qu15yBRCDSD/rP+
TLSH
T11E648D5AF3A814F9F977923CC8529607E772BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download