e3ad451c9352e4994802c02dae4b3066c6df790119664b5385ce205ec0457277

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e3ad451c9352e4994802c02dae4b3066c6df790119664b5385ce205ec0457277.exe
Size 316KB
Sample260601-2k8dlsgv2v
SHA256 e3ad451c9352e4994802c02dae4b3066c6df790119664b5385ce205ec0457277
MD5 2b26e360691ae0c56a7c3460ebc15347
SHA1 6a13d7a734fe1c72952568b546b8954ac21f963e
SHA512 5ac1de896e85038a17df38b3acdeaba4959acf935e78c6a248384a5263d616cc93ec8d183bfb868a7911bdd8bc61974e6ebe928fee0b7f9de2906aae1b3fdb4e
SSDEEP 6144:QQ8OyYvc36AVuc7DQd/5zlgBR4JD1yeobS6tr/:Qj16Qu15yBRCDcntr/
TLSH
T15B648D5AF3A814F9F977923CC8529507E772BC160760D78F27A0466A3F236A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3056	apprt2e95.exe
4928	apprt2e95.exe
4964	svc2e95.exe
2280	svc2e95.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppRt2e95 = "C:\\Users\\Admin\\AppData\\Local\\AppRt2e95\\apprt2e95.exe"	e3ad451c9352e4994802c02dae4b3066c6df790119664b5385ce205ec0457277.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppSvc2e95 = "C:\\Users\\Admin\\AppData\\Local\\Programs\\2e95\\svc2e95.exe"	apprt2e95.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3200	e3ad451c9352e4994802c02dae4b3066c6df790119664b5385ce205ec0457277.exe
3200	e3ad451c9352e4994802c02dae4b3066c6df790119664b5385ce205ec0457277.exe
3056	apprt2e95.exe
3056	apprt2e95.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 3056	3200	e3ad451c9352e4994802c02dae4b3066c6df790119664b5385ce205ec0457277.exe	80
PID 3056 wrote to memory of 4964	3056	apprt2e95.exe	83

C:\Users\Admin\AppData\Local\Temp\e3ad451c9352e4994802c02dae4b3066c6df790119664b5385ce205ec0457277.exe
"C:\Users\Admin\AppData\Local\Temp\e3ad451c9352e4994802c02dae4b3066c6df790119664b5385ce205ec0457277.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Users\Admin\AppData\Local\AppRt2e95\apprt2e95.exe
  "C:\Users\Admin\AppData\Local\AppRt2e95\apprt2e95.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Users\Admin\AppData\Local\Programs\2e95\svc2e95.exe
    "C:\Users\Admin\AppData\Local\Programs\2e95\svc2e95.exe"
    3⤵
    - Executes dropped EXE
    PID:4964

C:\Users\Admin\AppData\Local\AppRt2e95\apprt2e95.exe
C:\Users\Admin\AppData\Local\AppRt2e95\apprt2e95.exe
1⤵
- Executes dropped EXE
PID:4928

C:\Users\Admin\AppData\Local\Programs\2e95\svc2e95.exe
C:\Users\Admin\AppData\Local\Programs\2e95\svc2e95.exe
1⤵
- Executes dropped EXE
PID:2280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprt2e95.exe

Path C:\Users\Admin\AppData\Local\AppRt2e95\apprt2e95.exe
Size 316KB
SHA256 4ab9b9d0d506d94c85dbbb8e9be124bc58b024cf719b99683ac2b9e998b23c80
MD5 bc709aa48cb40ed2643caf6ed140600b
SHA1 1c3297a46b246b986417a1722f0e04d7742e0e8c
SHA512 d14046ecaf473e52675817db1113b39bfa4ae200da54f0b083e84a6592ac26b5ef4f03b142af1e507624e93473a791ffb65960945c7addc282f0208807424787
SSDEEP 6144:uQ8OyYvc36AVuc7DQd/5zlgBR4JD7yelvbSmoryJ:uj16Qu15yBRCDGuVoryJ
TLSH
T1DF648D5AF3A814F9F977923CC8529507E772BC160760D78F27A0466A3F236A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc2e95.exe

Path C:\Users\Admin\AppData\Local\Programs\2e95\svc2e95.exe
Size 317KB
SHA256 09dd339836701582473109e92c8ede40f289818da1178a4862d24db7162dde9a
MD5 9e73b5561b505d439aff1b1cdf512539
SHA1 30eb5f567eb563beb37206d17e1d836889623945
SHA512 5f72eaceb35045d3e569d8146ee9efe77bd5a8b1a4f5a06920304d56ab11f8f8cdb1c6b7b287a6ac72ec0994411314acfa3afd033adfed0c02e9a918b7b16f6e
SSDEEP 6144:NQ8OyYvc36AVuc7DQd/5zlgBR4JDwye8bSg4ry7:Nj16Qu15yBRCDjh4ry7
TLSH
T168648D5AF3A814F9F977923CC8529507E772BC160760D78F27A0466A3F236A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download