3130e3749ee3e604a84685e5f5e40d327cd61a185f7bdc43672e0a8f13a6b5b6

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AXO-X.exe
Size 12.2MB
Sample260601-rtkc2aht5p
SHA256 3130e3749ee3e604a84685e5f5e40d327cd61a185f7bdc43672e0a8f13a6b5b6
MD5 012542ee1bfa585f10a94e6aa15dcb2f
SHA1 77e145c217084dd201e113f9b64a3cfc3de53119
SHA512 89537a9fb7f6022e1de8803dde9cc839172a23ca53921c781feba712fb8680b926ef64d5efb74385a45dcdf09adcccab5e844021355f21533ad8f9d0656e3b70
SSDEEP 393216:Z24s/7//wWNUTmVINnsaX72ZtH1afgYn2:A4sj//wiDyVsar2ZtHQfXn2
TLSH
T1FFD623F66184374CC42A8831D427FC29B1B2642D0AEBD9A979CBBFE07F6B031D516B45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery vmprotect

Malware Config

Signatures

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/2792-3-0x00007FF60C5F0000-0x00007FF60DD0F000-memory.dmp	vmprotect
behavioral2/memory/2792-8-0x00007FF60C5F0000-0x00007FF60DD0F000-memory.dmp	vmprotect
behavioral2/memory/2792-15-0x00007FF60C5F0000-0x00007FF60DD0F000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2792	AXO-X.exe

System Time Discovery 1 TTPs 6 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5144	net1.exe
656	cmd.exe
836	net.exe
2024	net1.exe
4964	cmd.exe
4848	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2792	AXO-X.exe
2792	AXO-X.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 3992	2792	AXO-X.exe	84
PID 3992 wrote to memory of 3980	3992	cmd.exe	85
PID 2792 wrote to memory of 3768	2792	AXO-X.exe	86
PID 3768 wrote to memory of 3856	3768	cmd.exe	87
PID 2792 wrote to memory of 4964	2792	AXO-X.exe	88
PID 4964 wrote to memory of 4848	4964	cmd.exe	89
PID 4848 wrote to memory of 5144	4848	net.exe	90
PID 2792 wrote to memory of 656	2792	AXO-X.exe	91
PID 656 wrote to memory of 836	656	cmd.exe	92
PID 836 wrote to memory of 2024	836	net.exe	93
PID 2792 wrote to memory of 4760	2792	AXO-X.exe	94
PID 4760 wrote to memory of 780	4760	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\AXO-X.exe
"C:\Users\Admin\AppData\Local\Temp\AXO-X.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c w32tm /config /update >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3992
- - C:\Windows\system32\w32tm.exe
    w32tm /config /update
    3⤵
    PID:3980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c w32tm /resync /force >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Windows\system32\w32tm.exe
    w32tm /resync /force
    3⤵
    PID:3856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop w32time >nul 2>&1
  2⤵
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\system32\net.exe
    net stop w32time
    3⤵
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:4848
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop w32time
      4⤵
      System Time Discovery
      PID:5144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net start w32time >nul 2>&1
  2⤵
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:656
- - C:\Windows\system32\net.exe
    net start w32time
    3⤵
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:836
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start w32time
      4⤵
      System Time Discovery
      PID:2024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c w32tm /resync /nowait >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Windows\system32\w32tm.exe
    w32tm /resync /nowait
    3⤵
    PID:780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2792-0-0x00007FF60C723000-0x00007FF60D0E5000-memory.dmp

Download

memory/2792-3-0x00007FF60C5F0000-0x00007FF60DD0F000-memory.dmp

Download

memory/2792-2-0x00007FFD1D160000-0x00007FFD1D162000-memory.dmp

Download

memory/2792-1-0x00007FFD1D150000-0x00007FFD1D152000-memory.dmp

Download

memory/2792-7-0x00007FF60C723000-0x00007FF60D0E5000-memory.dmp

Download

memory/2792-8-0x00007FF60C5F0000-0x00007FF60DD0F000-memory.dmp

Download

memory/2792-14-0x00007FF60C723000-0x00007FF60D0E5000-memory.dmp

Download

memory/2792-15-0x00007FF60C5F0000-0x00007FF60DD0F000-memory.dmp

Download