d0fb41eca75d8db888aaddc5d9d5b1717a9604e76abb53308a6f816685c0e293

Analysis

user interaction
yes
max time kernel
299s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x29s_core.exe
Size 1.0MB
Sample260620-bc2b8acw8k
SHA256 d0fb41eca75d8db888aaddc5d9d5b1717a9604e76abb53308a6f816685c0e293
MD5 0ca6fe33606c26a7c2283867ccde9357
SHA1 590258da3c746a20fdd6ee0eb12c635c84169634
SHA512 afcb160a4245ba6f4753620f596be295db92b8edea3d7d8056d598c4c65767208bc343fdcd35f86bba1cc6e85118e73008e4fcd3b9d0bc1220f193c2f44e3bbf
SSDEEP 24576:3g9lo8ShDeGNZdJ8v+wADbTHXemAuV5owt6ZMImpDqK/:elo8ShDeGNZe+1j3bAuAwt6Sj
TLSH
T112352B57E6A344E8C92FC07487679772BA70B46946347E3E1E98D7312E31E605B2EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5128	x29s_core.exe
5128	x29s_core.exe
5128	x29s_core.exe
5128	x29s_core.exe
5128	x29s_core.exe
5128	x29s_core.exe
5128	x29s_core.exe
5128	x29s_core.exe
5160	x29s_core.exe
5160	x29s_core.exe
5160	x29s_core.exe
5160	x29s_core.exe
5160	x29s_core.exe
5160	x29s_core.exe
5160	x29s_core.exe
5160	x29s_core.exe
4388	x29s_core.exe
4388	x29s_core.exe
4388	x29s_core.exe
4388	x29s_core.exe
4388	x29s_core.exe
4388	x29s_core.exe
4388	x29s_core.exe
4388	x29s_core.exe
1740	x29s_core.exe
1740	x29s_core.exe
1740	x29s_core.exe
1740	x29s_core.exe
1740	x29s_core.exe
1740	x29s_core.exe
1740	x29s_core.exe
1740	x29s_core.exe
6600	x29s_core.exe
6600	x29s_core.exe
6600	x29s_core.exe
6600	x29s_core.exe
6600	x29s_core.exe
6600	x29s_core.exe
6600	x29s_core.exe
6600	x29s_core.exe
6960	x29s_core.exe
6960	x29s_core.exe
6960	x29s_core.exe
6960	x29s_core.exe
6960	x29s_core.exe
6960	x29s_core.exe
6960	x29s_core.exe
6960	x29s_core.exe
4708	x29s_core.exe
4708	x29s_core.exe
4708	x29s_core.exe
4708	x29s_core.exe
4708	x29s_core.exe
4708	x29s_core.exe
4708	x29s_core.exe
4708	x29s_core.exe
6536	x29s_core.exe
6536	x29s_core.exe
6536	x29s_core.exe
6536	x29s_core.exe
6536	x29s_core.exe
6536	x29s_core.exe
6536	x29s_core.exe
6536	x29s_core.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 5128 wrote to memory of 2044	5128	x29s_core.exe	90
PID 2044 wrote to memory of 1892	2044	cmd.exe	91
PID 5160 wrote to memory of 6984	5160	x29s_core.exe	95
PID 6984 wrote to memory of 5448	6984	cmd.exe	96
PID 4388 wrote to memory of 4588	4388	x29s_core.exe	99
PID 4588 wrote to memory of 5092	4588	cmd.exe	100
PID 1740 wrote to memory of 4404	1740	x29s_core.exe	103
PID 4404 wrote to memory of 6564	4404	cmd.exe	104
PID 6600 wrote to memory of 6532	6600	x29s_core.exe	107
PID 6532 wrote to memory of 6568	6532	cmd.exe	108
PID 6960 wrote to memory of 6396	6960	x29s_core.exe	111
PID 6396 wrote to memory of 6320	6396	cmd.exe	112
PID 4708 wrote to memory of 2492	4708	x29s_core.exe	115
PID 2492 wrote to memory of 5368	2492	cmd.exe	116
PID 6536 wrote to memory of 6368	6536	x29s_core.exe	119
PID 6368 wrote to memory of 2920	6368	cmd.exe	120
PID 5072 wrote to memory of 4132	5072	x29s_core.exe	123
PID 4132 wrote to memory of 3856	4132	cmd.exe	124
PID 6020 wrote to memory of 3884	6020	x29s_core.exe	127
PID 3884 wrote to memory of 4172	3884	cmd.exe	128
PID 4384 wrote to memory of 2148	4384	x29s_core.exe	131
PID 2148 wrote to memory of 2372	2148	cmd.exe	132
PID 6684 wrote to memory of 4204	6684	x29s_core.exe	135
PID 4204 wrote to memory of 3724	4204	cmd.exe	136

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
"C:\Users\Admin\AppData\Local\Temp\x29s_core.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Windows\system32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:1892

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6984
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:5448

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:5092

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:6564

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6532
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:6568

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6396
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:6320

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:5368

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6368
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:2920

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:3856

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:6020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:4172

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:2372

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:6684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:3724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x29s.vbs

Path C:\Windows\Temp\x29s.vbs
Size 336B
SHA256 f4c3c4f9b161c816ebc85a727724d4057ccb590c5b5b99d0448121bb99fc1b6a
MD5 e859ad339a00acd7fca5a38da936246f
SHA1 9b1b11d0545e18a12358d1e189afe1953bad922a
SHA512 b036dde2fa6d8d06ed1e7206bd7af4c4f6cb321bfde5df35d0daafffa5bb15e3539966e79a251cb05b99b85880a290f934323bc0eeb96406b51238062e96449e
TLSH
T15FE026520D67889788AF370375E223435ED0921C7AB7363A9964DC0C5F9889E8089092
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1740-11-0x00007FF7EF990000-0x00007FF7EFA99000-memory.dmp

Download

memory/4384-34-0x00007FF7EF990000-0x00007FF7EFA99000-memory.dmp

Download

memory/4388-8-0x00007FF7EF990000-0x00007FF7EFA99000-memory.dmp

Download

memory/4708-21-0x00007FF7EF990000-0x00007FF7EFA99000-memory.dmp

Download

memory/5072-26-0x00007FF7EF990000-0x00007FF7EFA99000-memory.dmp

Download

memory/5128-2-0x00007FF7EF990000-0x00007FF7EFA99000-memory.dmp

Download

memory/5160-5-0x00007FF7EF990000-0x00007FF7EFA99000-memory.dmp

Download

memory/6020-29-0x00007FF7EF990000-0x00007FF7EFA99000-memory.dmp

Download

memory/6536-23-0x00007FF7EF990000-0x00007FF7EFA99000-memory.dmp

Download

memory/6600-15-0x00007FF7EF990000-0x00007FF7EFA99000-memory.dmp

Download

memory/6684-35-0x00007FF7EF990000-0x00007FF7EFA99000-memory.dmp

Download

memory/6960-17-0x00007FF7EF990000-0x00007FF7EFA99000-memory.dmp

Download