fce9cba921dfdd06e8a2c5a2e203da276dac16c8421f8fc3d78b52b631225412

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/06/2026, 17:18

Target
fce9cba921dfdd06e8a2c5a2e203da276dac16c8421f8fc3d78b52b631225412.exe
Size 13.5MB
Sample260619-vvm24aa18s
SHA256 fce9cba921dfdd06e8a2c5a2e203da276dac16c8421f8fc3d78b52b631225412
MD5 28d64c1a98b367518e69db911c4e8c76
SHA1 d5d168d6fa631f06f1a819786e8ce270a5ef76ac
SHA512 1dcdd796f9a96d39fa7d35403e17466264bb88e4b2c70367642328168273308ec65142b818b1e3b2fc23b7382e32657023dfcd18f4ae168233a9c0c7e3a03b71
SSDEEP 196608:XeNSE051muG/uNUJB0HXZ2ZX/vxYfRZ3us8+XkN+R7AI0fhZMhI:XeNSr1gySVJ5zs8u8i74fUhI
TLSH
T18BE6BF07EC9515E9C4AED234CA229253BA717C496B3173D72B90FB282F77BD06A79700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

Disable or Modify System Firewall

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000\Software\Microsoft\Windows\CurrentVersion\Run\RemoteX = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fce9cba921dfdd06e8a2c5a2e203da276dac16c8421f8fc3d78b52b631225412.exe"	fce9cba921dfdd06e8a2c5a2e203da276dac16c8421f8fc3d78b52b631225412.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

GoLang User-Agent 15 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2848	fce9cba921dfdd06e8a2c5a2e203da276dac16c8421f8fc3d78b52b631225412.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2848	fce9cba921dfdd06e8a2c5a2e203da276dac16c8421f8fc3d78b52b631225412.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 3664	2848	fce9cba921dfdd06e8a2c5a2e203da276dac16c8421f8fc3d78b52b631225412.exe	89
PID 2848 wrote to memory of 5328	2848	fce9cba921dfdd06e8a2c5a2e203da276dac16c8421f8fc3d78b52b631225412.exe	91
PID 2848 wrote to memory of 1960	2848	fce9cba921dfdd06e8a2c5a2e203da276dac16c8421f8fc3d78b52b631225412.exe	93

C:\Users\Admin\AppData\Local\Temp\fce9cba921dfdd06e8a2c5a2e203da276dac16c8421f8fc3d78b52b631225412.exe
C:\Users\Admin\AppData\Local\Temp\fce9cba921dfdd06e8a2c5a2e203da276dac16c8421f8fc3d78b52b631225412.exe
1⤵
PID:4760