56ed8056cedd5be0ff805d20eec3b965dbf12b4302c5494e7f9870a3f11a053d

Analysis

max time kernel
150s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 13:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
56ed8056cedd5be0ff805d20eec3b965dbf12b4302c5494e7f9870a3f11a053d.exe
Size 316KB
Sample260601-qfgvbafs7l
SHA256 56ed8056cedd5be0ff805d20eec3b965dbf12b4302c5494e7f9870a3f11a053d
MD5 b461b25177986a6d4911e9bbcd2bc350
SHA1 ba4e47f240bd49cb6f2848bc8bb27e7bef849606
SHA512 a4d57252ab157c203347b409deff5eb54744de5d187bd0f5176df95a7049a20cf47029b6e02cc7849dd43e1ae566259fcbf8a99b503d6812f53b1b0c6e90b580
SSDEEP 6144:BQ8OyYvc36AVuc7DQd/5zlgBR4JDuyeMbS+orv:Bj16Qu15yBRCDdvorv
TLSH
T1D9648D5AF3A904F9F977923CC8529507E772BC160760D78F27A0466A3F236A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3252	apprt6933.exe
4400	apprt6933.exe
4536	svc6933.exe
4756	svc6933.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppRt6933 = "C:\\Users\\Admin\\AppData\\Local\\AppRt6933\\apprt6933.exe"	56ed8056cedd5be0ff805d20eec3b965dbf12b4302c5494e7f9870a3f11a053d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppSvc6933 = "C:\\Users\\Admin\\AppData\\Local\\Programs\\6933\\svc6933.exe"	apprt6933.exe

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
11	api.ipify.org
20	checkip.amazonaws.com
23	checkip.amazonaws.com
3	checkip.amazonaws.com
3	api.ipify.org
3	ip-api.com
4	checkip.amazonaws.com

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	apprt6933.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	apprt6933.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svc6933.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svc6933.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	56ed8056cedd5be0ff805d20eec3b965dbf12b4302c5494e7f9870a3f11a053d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	56ed8056cedd5be0ff805d20eec3b965dbf12b4302c5494e7f9870a3f11a053d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	apprt6933.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	apprt6933.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svc6933.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svc6933.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
548	56ed8056cedd5be0ff805d20eec3b965dbf12b4302c5494e7f9870a3f11a053d.exe
548	56ed8056cedd5be0ff805d20eec3b965dbf12b4302c5494e7f9870a3f11a053d.exe
548	56ed8056cedd5be0ff805d20eec3b965dbf12b4302c5494e7f9870a3f11a053d.exe
548	56ed8056cedd5be0ff805d20eec3b965dbf12b4302c5494e7f9870a3f11a053d.exe
3252	apprt6933.exe
3252	apprt6933.exe
548	56ed8056cedd5be0ff805d20eec3b965dbf12b4302c5494e7f9870a3f11a053d.exe
548	56ed8056cedd5be0ff805d20eec3b965dbf12b4302c5494e7f9870a3f11a053d.exe
3252	apprt6933.exe
3252	apprt6933.exe
4400	apprt6933.exe
4400	apprt6933.exe
4756	svc6933.exe
4756	svc6933.exe
4536	svc6933.exe
4536	svc6933.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 3252	548	56ed8056cedd5be0ff805d20eec3b965dbf12b4302c5494e7f9870a3f11a053d.exe	83
PID 3252 wrote to memory of 4536	3252	apprt6933.exe	86

C:\Users\Admin\AppData\Local\Temp\56ed8056cedd5be0ff805d20eec3b965dbf12b4302c5494e7f9870a3f11a053d.exe
"C:\Users\Admin\AppData\Local\Temp\56ed8056cedd5be0ff805d20eec3b965dbf12b4302c5494e7f9870a3f11a053d.exe"
1⤵
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:548
- C:\Users\Admin\AppData\Local\AppRt6933\apprt6933.exe
  "C:\Users\Admin\AppData\Local\AppRt6933\apprt6933.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Users\Admin\AppData\Local\Programs\6933\svc6933.exe
    "C:\Users\Admin\AppData\Local\Programs\6933\svc6933.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4536

C:\Users\Admin\AppData\Local\AppRt6933\apprt6933.exe
C:\Users\Admin\AppData\Local\AppRt6933\apprt6933.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4400

C:\Users\Admin\AppData\Local\Programs\6933\svc6933.exe
C:\Users\Admin\AppData\Local\Programs\6933\svc6933.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8
Size 1KB
SHA256 5bbba0743bf4bde90bfe92656b3f406fd2732bb9a0f97cb7685d7f33ea1599d5
MD5 31cc71263ec9ffbe06270e7163d7a544
SHA1 a914922b23031ebc9cd6dc04e7d1e3367542d218
SHA512 fe5f0badb9e58d1dacc497c798765e1314f3af7b701da072f5bf01f1c7957308faa2c33fde77c443b08a8f34f844dbc0120ce65d6e1721bd794cb134d674ab33
TLSH
T14E21A4F60FA869A4DDEE3E8D54E8D6367C30B2ED7AC15923983A88921840373070809E
MD5 SHA1 SHA512 TLSH

Submit Download

BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
Size 1KB
SHA256 0f5358a353258c2233f010af6a3f9b984b62ca6efbab18c9dc3de81b5da27ed4
MD5 32f2490396ad8f7659a75cdbbff9a0bd
SHA1 b8387e0dfe19b5cdc8d00ef33b92906041375c1f
SHA512 4eca9a736a85455163b67ffb678c9113eb296a2ff1b61da11976c278a0cabaaaaff41f489e257e3ec7f3c22d731397f1a1ba30d6cdec086f6fce9d97d9fbd537
TLSH
T10C31BAFE4E159C15AF89FE4C9B85F33E1C7516E468950C26F928C08194C47FA6A4802E
MD5 SHA1 SHA512 TLSH

Submit Download

D03E46CD585BBE111C712E6577BC5F07_D57CE96919754E8BF5FC12F0FA7A1698

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D03E46CD585BBE111C712E6577BC5F07_D57CE96919754E8BF5FC12F0FA7A1698
Size 471B
SHA256 db29ae12905c9420ecfe02b5c5fab741565bf887179488e5cd51c07fd7f8bd2e
MD5 393f8529710d7224518949571c5c6b40
SHA1 7b4eb66dd4cdf60b20bd6e2bc2cb73dc6ac98065
SHA512 66829555143cd2bb628ca6678ecee68bee0b343849ebb352101b399b602b26572bfcc6a6f8c4e3d12dddba9215c2386894c6c790ba13d962a145d49c4ca496e9
TLSH
T108F0DC2A2C24ED0107255F268EA882743886E3061AF698D33438F26A285E7BC6B1F034
MD5 SHA1 SHA512 TLSH

Submit Download

75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8
Size 438B
SHA256 80d85ea25e366d4a32d5fd9337e7a7eb2633b45134001b25ab21f187beab75b5
MD5 f758de6c617f76f7b32fffdfd61b08c5
SHA1 1a632e51ef97b6c2c6a8801a4021bed77aa96298
SHA512 bcad4ea8f8ea59277e4593fc3cfc171cc3000e03be4ce65f74e1f971cc4704e86ad40245d46655d1e8f980cdcd6488e2ec13c60d314c0c8ed7acd90e81dce441
TLSH
T13CF02228A6FF821DF177ED7906DE6B70C462F032181293B512E262486312E409C72A12
MD5 SHA1 SHA512 TLSH

Submit Download

BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
Size 432B
SHA256 a94f57503f7397ed5f28d7413b04ed52b10fb9d3e34df6b1c5f1c2ba4bdce51e
MD5 b22c30d7cc6dc8c3e1307ca922b7201b
SHA1 9e338e61bffc8a5dea60e461d481c1da596cb248
SHA512 1fb2915d58ad4bfbb1ac590e5f3f281c761c3ebe0bd2038cbb907ab520c70f4f06a4ea09573b37920ca5e04522dc0c3e73b84bd9726909e1eb1e3d43651efaed
TLSH
T144E0686126BF470DF1F0EB790ACA7C12C43BF62320597BA221D05B2879058400E35A36
MD5 SHA1 SHA512 TLSH

Submit Download

D03E46CD585BBE111C712E6577BC5F07_D57CE96919754E8BF5FC12F0FA7A1698

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D03E46CD585BBE111C712E6577BC5F07_D57CE96919754E8BF5FC12F0FA7A1698
Size 418B
SHA256 db88184c957e8858f5eaf0e777c2f538a38508fedc5d96d5f9284de28eff6de9
MD5 b392a0714df2658882b084c45855addc
SHA1 517629ec4516dda0284e47a9ef1ef453812ad868
SHA512 e5858043dac4337db4fde8bd9a9cdd9c61975de029a2da45cd3e1304372f1e74185f84a0d779261ac8b0ec5b9326168f71dbea39b150d704ef5028f7337e774e
TLSH
T173E0680402F9421EE362DAB40ADAE416C815F113E814BBB20263030CA602901DC29474
MD5 SHA1 SHA512 TLSH

Submit Download

apprt6933.exe

Path C:\Users\Admin\AppData\Local\AppRt6933\apprt6933.exe
Size 317KB
SHA256 05db72ab49a601038772190af295b331b6363dbf1cd6ee15229398846e896f60
MD5 eeffe54da615b5c0be4eae0160e9e7b2
SHA1 7fcb2614f98ed157ed6a319356bdb5a1d8c98bd5
SHA512 cc96009e8e5303e823c367b42b7ff3618c59d082aa617b97345b891418128fb410e4552239318a7c043d7ced49a8d1fdffd0f8376c274a6f446c68585ba1810c
SSDEEP 6144:7Q8OyYvc36AVuc7DQd/5zlgBR4JDYhyeKbSQXrOw:7j16Qu15yBRCDY4bXrOw
TLSH
T105648D5AF3A814F9F977923CC8529507E772BC160760D78F27A0466A3F236A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc6933.exe

Path C:\Users\Admin\AppData\Local\Programs\6933\svc6933.exe
Size 317KB
SHA256 e80da714ae2691aa5b9c69a623b5152ac86ff0ddbf2f11f0bc3f6e8c10dc7fc9
MD5 96e43b9587f6af40f3b4fb7985c6440a
SHA1 8288e48c51f5f1a36ea4476d22a210b59ecb3173
SHA512 a3b3efdb4017c341acb4533f0113925cb4b596b1aeb0c3dae9974b3a8937bb7a1c2c45f2f0655dd20ed18b58016b2c38533841a854e9616c342c64da25c07f39
SSDEEP 6144:bQ8OyYvc36AVuc7DQd/5zlgBR4JDlyeKbS1frW:bj16Qu15yBRCDMyfrW
TLSH
T1D0648D5AF3A804F9F977923CC9529507E772BC160760D78F27A0466A3F236A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_2026-06_4400.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-06_4400.txt
Size 657B
SHA256 6bedceb4d65e7636710a0ec0585d89779f93238724b227ef4f1851914ab4e18d
MD5 835cbfa5697086587d08f0a2f3699d5a
SHA1 4d3ef04634de035fc163c483387938101afa966a
SHA512 520778fc9e0636a2aa7d9b26f5f9d7aa102df5cbf7f493125782a28ce20855b56888d7862675ad2f5a0d909f8e310f00f442ab0b8b438ed52a13c272628d7cf6
TLSH
T1E201C351715B346F35A29FC2F1D07F291080328FAE437A057D9033ECB1679456F8A158
MD5 SHA1 SHA512 TLSH

Submit Download

log_2026-06_4536.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-06_4536.txt
Size 463B
SHA256 9e52f3ff6fe58daff32b0fb0e93838998ba77966558a59905b2e20f0fc482386
MD5 e17e9da22d7ef65bcc9e6b38ed74c99d
SHA1 a146dd2b8e5da6424134072d668efcb872b8ccd5
SHA512 e6a1bbfe819ea35430d540e92a5fa60fc884b1d2ac9f4ae36aed1229b51e04a8a104edff5fd0c00cc0e9d40da7f38f84b4d6a048a2dbda1dc0f9ff5299d17c74
TLSH
T17FF0A782B35B3C7935E0AE86E1F5FA162450338BDD83AA1CF49011DF946550B6BCF25C
MD5 SHA1 SHA512 TLSH

Submit Download

log_2026-06_4756.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-06_4756.txt
Size 463B
SHA256 a07d1f30bf7d397a87fcbbdf5d670360c0508b487a3665490d4d2a0a934fe403
MD5 eacb717b4dd8052a1fa034a607995a88
SHA1 03da7fc4be68d2113597bffccb46133dbd434392
SHA512 25c492c011acccd03f2f7ab05bfbc2abf2e7ff891ed717dd72fc25ead6051d75f33287f31834a9456d391b946e43b20b3edb87ab6822c7794480cc52d3767e7a
TLSH
T13BF05C42B39B345F36F1AE89E1F17B063050334F9DC3AE2CB4C050DD90610095B8E148
MD5 SHA1 SHA512 TLSH

Submit Download

log_2026-06_548.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-06_548.txt
Size 837B
SHA256 b96d569ea6dc6df82cbe5108564f98c3ef32cd786427212f6866ebdb9ff01c39
MD5 c0937280f575ac1ba499cfa9fbb168c6
SHA1 7e6cea1726e2e0e32d3c097d2bbf154a10a50659
SHA512 81ef5c9a2bb5f0afc5e9ae947dfebc0f3660f0a4471aaa79c323073655eb59f3f4674333e2b48156ae9ca6e706039ae6f21de74845398ea4d638a05376f1cd81
TLSH
T16501A1D5F25A349D11E89A83F2947D162040A24FDB431D85B5D0B2ECB077A8A7F8B19A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/548-0-0x0000000180000000-0x0000000180197000-memory.dmp

Download