a51ee2c54393b60bc20c520f9906945ae8187f5997e12325391d9c09a411c520

Analysis

max time kernel
599s
max time network
421s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x29s_core.exe
Size 1.0MB
Sample260620-cbdp7scx9k
SHA256 a51ee2c54393b60bc20c520f9906945ae8187f5997e12325391d9c09a411c520
MD5 cfdb77dc33c24c0c8a6f898ef3a01f7b
SHA1 368fe1371e2a37066847a7badbe9eb25cf6c850c
SHA512 99a72d0c117ae62914a7ddbbf33676fd7137b61a3c0de5f32903941552aa1e0380dc2c82632e404b41b208fd9dddb5339c4101d0b791d70632d2bc87d2cdb3b6
SSDEEP 24576:6ouRqcuT5FfZNDnbug+nJdDueaJUzkvAcIKvmwZqK:6pqcuT5FfZNDbUnfB4QknIM
TLSH
T12A352B57F2A345E8C52FC0748B639772BA70B46946347E2E1E94D7322E20E605F2EB35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1188	x29s_core.exe
1188	x29s_core.exe
1188	x29s_core.exe
1188	x29s_core.exe
1188	x29s_core.exe
1188	x29s_core.exe
1188	x29s_core.exe
1188	x29s_core.exe
5956	x29s_core.exe
5956	x29s_core.exe
5956	x29s_core.exe
5956	x29s_core.exe
5956	x29s_core.exe
5956	x29s_core.exe
5956	x29s_core.exe
5956	x29s_core.exe
5896	x29s_core.exe
5896	x29s_core.exe
5896	x29s_core.exe
5896	x29s_core.exe
5896	x29s_core.exe
5896	x29s_core.exe
5896	x29s_core.exe
5896	x29s_core.exe
5496	x29s_core.exe
5496	x29s_core.exe
5496	x29s_core.exe
5496	x29s_core.exe
5496	x29s_core.exe
5496	x29s_core.exe
5496	x29s_core.exe
5496	x29s_core.exe
2104	x29s_core.exe
2104	x29s_core.exe
2104	x29s_core.exe
2104	x29s_core.exe
2104	x29s_core.exe
2104	x29s_core.exe
2104	x29s_core.exe
2104	x29s_core.exe
1792	x29s_core.exe
1792	x29s_core.exe
1792	x29s_core.exe
1792	x29s_core.exe
1792	x29s_core.exe
1792	x29s_core.exe
1792	x29s_core.exe
1792	x29s_core.exe
5976	x29s_core.exe
5976	x29s_core.exe
5976	x29s_core.exe
5976	x29s_core.exe
5976	x29s_core.exe
5976	x29s_core.exe
5976	x29s_core.exe
5976	x29s_core.exe
4688	x29s_core.exe
4688	x29s_core.exe
4688	x29s_core.exe
4688	x29s_core.exe
4688	x29s_core.exe
4688	x29s_core.exe
4688	x29s_core.exe
4688	x29s_core.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 2008	1188	x29s_core.exe	89
PID 2008 wrote to memory of 4336	2008	cmd.exe	90
PID 5956 wrote to memory of 3200	5956	x29s_core.exe	94
PID 3200 wrote to memory of 5436	3200	cmd.exe	95
PID 5896 wrote to memory of 1972	5896	x29s_core.exe	99
PID 1972 wrote to memory of 4944	1972	cmd.exe	100
PID 5496 wrote to memory of 5760	5496	x29s_core.exe	103
PID 5760 wrote to memory of 3020	5760	cmd.exe	104
PID 2104 wrote to memory of 2584	2104	x29s_core.exe	107
PID 2584 wrote to memory of 6004	2584	cmd.exe	108
PID 1792 wrote to memory of 1964	1792	x29s_core.exe	111
PID 1964 wrote to memory of 4880	1964	cmd.exe	112
PID 5976 wrote to memory of 2992	5976	x29s_core.exe	115
PID 2992 wrote to memory of 4912	2992	cmd.exe	116
PID 4688 wrote to memory of 3796	4688	x29s_core.exe	119
PID 3796 wrote to memory of 2572	3796	cmd.exe	120
PID 1412 wrote to memory of 6028	1412	x29s_core.exe	123
PID 6028 wrote to memory of 4540	6028	cmd.exe	124
PID 6052 wrote to memory of 3084	6052	x29s_core.exe	127
PID 3084 wrote to memory of 1844	3084	cmd.exe	128

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
"C:\Users\Admin\AppData\Local\Temp\x29s_core.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\system32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:4336

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:5436

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:4944

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5760
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:3020

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:6004

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:4880

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:4912

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:2572

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6028
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:4540

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:6052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3084
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:1844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x29s.vbs

Path C:\Windows\Temp\x29s.vbs
Size 336B
SHA256 f4c3c4f9b161c816ebc85a727724d4057ccb590c5b5b99d0448121bb99fc1b6a
MD5 e859ad339a00acd7fca5a38da936246f
SHA1 9b1b11d0545e18a12358d1e189afe1953bad922a
SHA512 b036dde2fa6d8d06ed1e7206bd7af4c4f6cb321bfde5df35d0daafffa5bb15e3539966e79a251cb05b99b85880a290f934323bc0eeb96406b51238062e96449e
TLSH
T15FE026520D67889788AF370375E223435ED0921C7AB7363A9964DC0C5F9889E8089092
MD5 SHA1 SHA512 TLSH

Submit Download

debug_c2.txt

Path C:\debug_c2.txt
Size 32B
SHA256 30a9803c288926f349739b306655e9281387dfad6c941b84abc41b126608c400
MD5 60d8f89335bd03ecf096523d3d690809
SHA1 99da757e5ff5415a5714d09de3954f5987586e14
SHA512 10f2bb3135ed581f4181764f0c01f40d9c56a5856bbe4f28b57d90b88a51c8cbf1a86ebdfa5339d5ccd1b16d28704707d7066da93662ecdce2b1906c2d2b0ea7
MD5 SHA1 SHA512

Submit Download

debug_load.txt

Path C:\debug_load.txt
Size 21B
SHA256 7a7747c63cdcd7b378d4bb65daeeee5cf701b573029c8f8fa97bb2430aa9b03a
MD5 f9ad507f79b4230f7ce655d09abdbc7a
SHA1 fbed4f288a54999d108e92b6ea0e191621eaed55
SHA512 c7f7b77505461e6db7fdaa430a6829882858641444df4f35055b6150fdb8ca9e6ac6c534b157cdf9c902eda39cd83ce22f61761c9155e8e0678fde7c93e50690
MD5 SHA1 SHA512

Submit Download

debug_loaded.txt

Path C:\debug_loaded.txt
Size 40B
SHA256 7ce4bb478be10f6af96b366a1e3b02e46acd46264000536412492663fbbe3e3f
MD5 25f48643b395f53e0f2d9d98522aef19
SHA1 452baeaa3ed394b9ef80026dfecc311eca3eadf3
SHA512 d8c10428b18952e64d38214323759b208465f5658ae8705c3e4f449f115a22af51c01773c98ee52ef06d676e93e3ee674a2e0d2c23c0b25d8b519fe7118a43eb
MD5 SHA1 SHA512

Submit Download

debug_main.txt

Path C:\debug_main.txt
Size 16B
SHA256 b2ee13dcebf250e402f7a667b61528cb3f4a22a16aa66331dc2b7c41d98df13e
MD5 76b96be130bb2b941c690b3193ee3e46
SHA1 babaeee95f2464116ed19688c61bbf9cc2f72351
SHA512 0c04b0cd2108beceaf7cb53bd10a80cced43bacceb8917e4e405d391a0b029b0469f3d5346c2db18235655a0f48b5cc9ac3ccf48600a0138279596a600acd64d
MD5 SHA1 SHA512

Submit Download

memory/1188-6-0x00007FF7022A0000-0x00007FF7023AA000-memory.dmp

Download

memory/1412-98-0x00007FF7022A0000-0x00007FF7023AA000-memory.dmp

Download

memory/1792-61-0x00007FF7022A0000-0x00007FF7023AA000-memory.dmp

Download

memory/2104-52-0x00007FF7022A0000-0x00007FF7023AA000-memory.dmp

Download

memory/4688-86-0x00007FF7022A0000-0x00007FF7023AA000-memory.dmp

Download

memory/5496-41-0x00007FF7022A0000-0x00007FF7023AA000-memory.dmp

Download

memory/5896-31-0x00007FF7022A0000-0x00007FF7023AA000-memory.dmp

Download

memory/5956-17-0x00007FF7022A0000-0x00007FF7023AA000-memory.dmp

Download

memory/5976-72-0x00007FF7022A0000-0x00007FF7023AA000-memory.dmp

Download

memory/6052-105-0x00007FF7022A0000-0x00007FF7023AA000-memory.dmp

Download