b2b1e66cd3faf42b2f322a162a6588595082b03c6b28aa36cdaf5596a3bbcef0

Analysis

max time kernel
599s
max time network
475s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 01:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x29s_core.exe
Size 1.0MB
Sample260620-bym2qady81
SHA256 b2b1e66cd3faf42b2f322a162a6588595082b03c6b28aa36cdaf5596a3bbcef0
MD5 7bba84dd0d6a647ab03e5af3806f4697
SHA1 22b4fa576ca1e1508e52cd6d20ce74c5a5557b67
SHA512 49edf98fe4e34536d7147ebbf6aa1202356a9122db3bc0e6e14d24393f1c42bf32d635f58334239d8700e4baf2e08330048b91aa92dbb785e7053f89e93ba9d0
SSDEEP 24576:oy+uprKOZfaVNmF5nasVgtDBuwPU+nxgroQrtpwZqh:okprKOZfaVNmPzVY4QJnaoQrtp
TLSH
T14F353B57E6A344E8C52FC07487A39772BA30B46946347E2E1ED5D7322E20E605F6EB34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4672	x29s_core.exe
4672	x29s_core.exe
4672	x29s_core.exe
4672	x29s_core.exe
4672	x29s_core.exe
4672	x29s_core.exe
4672	x29s_core.exe
4672	x29s_core.exe
4408	x29s_core.exe
4408	x29s_core.exe
4408	x29s_core.exe
4408	x29s_core.exe
4408	x29s_core.exe
4408	x29s_core.exe
4408	x29s_core.exe
4408	x29s_core.exe
3584	x29s_core.exe
3584	x29s_core.exe
3584	x29s_core.exe
3584	x29s_core.exe
3584	x29s_core.exe
3584	x29s_core.exe
3584	x29s_core.exe
3584	x29s_core.exe
1936	x29s_core.exe
1936	x29s_core.exe
1936	x29s_core.exe
1936	x29s_core.exe
1936	x29s_core.exe
1936	x29s_core.exe
1936	x29s_core.exe
1936	x29s_core.exe
1816	x29s_core.exe
1816	x29s_core.exe
1816	x29s_core.exe
1816	x29s_core.exe
1816	x29s_core.exe
1816	x29s_core.exe
1816	x29s_core.exe
1816	x29s_core.exe
1464	x29s_core.exe
1464	x29s_core.exe
1464	x29s_core.exe
1464	x29s_core.exe
1464	x29s_core.exe
1464	x29s_core.exe
1464	x29s_core.exe
1464	x29s_core.exe
4536	x29s_core.exe
4536	x29s_core.exe
4536	x29s_core.exe
4536	x29s_core.exe
4536	x29s_core.exe
4536	x29s_core.exe
4536	x29s_core.exe
4536	x29s_core.exe
3408	x29s_core.exe
3408	x29s_core.exe
3408	x29s_core.exe
3408	x29s_core.exe
3408	x29s_core.exe
3408	x29s_core.exe
3408	x29s_core.exe
3408	x29s_core.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 6056	4672	x29s_core.exe	89
PID 6056 wrote to memory of 6104	6056	cmd.exe	90
PID 4408 wrote to memory of 1984	4408	x29s_core.exe	94
PID 1984 wrote to memory of 5020	1984	cmd.exe	95
PID 3584 wrote to memory of 4480	3584	x29s_core.exe	99
PID 4480 wrote to memory of 5524	4480	cmd.exe	100
PID 1936 wrote to memory of 5492	1936	x29s_core.exe	103
PID 5492 wrote to memory of 5552	5492	cmd.exe	104
PID 1816 wrote to memory of 3532	1816	x29s_core.exe	107
PID 3532 wrote to memory of 1532	3532	cmd.exe	108
PID 1464 wrote to memory of 4496	1464	x29s_core.exe	111
PID 4496 wrote to memory of 2152	4496	cmd.exe	112
PID 4536 wrote to memory of 1000	4536	x29s_core.exe	115
PID 1000 wrote to memory of 3632	1000	cmd.exe	116
PID 3408 wrote to memory of 4412	3408	x29s_core.exe	119
PID 4412 wrote to memory of 4284	4412	cmd.exe	120
PID 1320 wrote to memory of 3204	1320	x29s_core.exe	123
PID 3204 wrote to memory of 1084	3204	cmd.exe	124
PID 5916 wrote to memory of 4912	5916	x29s_core.exe	127
PID 4912 wrote to memory of 2712	4912	cmd.exe	128
PID 3084 wrote to memory of 3276	3084	x29s_core.exe	131
PID 3276 wrote to memory of 5928	3276	cmd.exe	132

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
"C:\Users\Admin\AppData\Local\Temp\x29s_core.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6056
- - C:\Windows\system32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:6104

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:5020

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:5524

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5492
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:5552

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:1532

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:2152

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1000
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:3632

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:4284

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:1084

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:2712

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:5928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x29s.vbs

Path C:\Windows\Temp\x29s.vbs
Size 336B
SHA256 f4c3c4f9b161c816ebc85a727724d4057ccb590c5b5b99d0448121bb99fc1b6a
MD5 e859ad339a00acd7fca5a38da936246f
SHA1 9b1b11d0545e18a12358d1e189afe1953bad922a
SHA512 b036dde2fa6d8d06ed1e7206bd7af4c4f6cb321bfde5df35d0daafffa5bb15e3539966e79a251cb05b99b85880a290f934323bc0eeb96406b51238062e96449e
TLSH
T15FE026520D67889788AF370375E223435ED0921C7AB7363A9964DC0C5F9889E8089092
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1320-26-0x00007FF79AC70000-0x00007FF79AD7A000-memory.dmp

Download

memory/1464-17-0x00007FF79AC70000-0x00007FF79AD7A000-memory.dmp

Download

memory/1816-14-0x00007FF79AC70000-0x00007FF79AD7A000-memory.dmp

Download

memory/1936-11-0x00007FF79AC70000-0x00007FF79AD7A000-memory.dmp

Download

memory/3084-32-0x00007FF79AC70000-0x00007FF79AD7A000-memory.dmp

Download

memory/3408-23-0x00007FF79AC70000-0x00007FF79AD7A000-memory.dmp

Download

memory/3584-8-0x00007FF79AC70000-0x00007FF79AD7A000-memory.dmp

Download

memory/4408-5-0x00007FF79AC70000-0x00007FF79AD7A000-memory.dmp

Download

memory/4536-20-0x00007FF79AC70000-0x00007FF79AD7A000-memory.dmp

Download

memory/4672-2-0x00007FF79AC70000-0x00007FF79AD7A000-memory.dmp

Download

memory/5916-31-0x00007FF79AC70000-0x00007FF79AD7A000-memory.dmp

Download