cc8378d957f4eea972fe0e249c53dcc27bbb26ca3d89bff43109cc0cd19e8a33

Analysis

max time kernel
599s
max time network
463s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x29s_core.exe
Size 1.0MB
Sample260620-dgfbnacy6p
SHA256 cc8378d957f4eea972fe0e249c53dcc27bbb26ca3d89bff43109cc0cd19e8a33
MD5 acacc1be5e4d9f2db208dafcce521ba2
SHA1 64a367e05e922b75437810f8ec3fa0d9c5269de3
SHA512 4854f17411bbfaa2b8517bbe31e6b82ef9c497de74c1a453c114517da9c1baff236556f3acc2c1a27718880ce3b41c8399a0ae36f092f515050384bcc5f70ad4
SSDEEP 24576:Fo8MWz0gPWU70LzN5e0wjvrjPD1M3WfUwxCZ6SI/wxq:Fdz0gPWU70LzN5lerram8wmVI
TLSH
T1A0353A57F2A344E8C52FC07487639773BA70B46906387E6E5E94D7322E21E605B2EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5664	x29s_core.exe
5664	x29s_core.exe
5664	x29s_core.exe
5664	x29s_core.exe
5664	x29s_core.exe
5664	x29s_core.exe
5664	x29s_core.exe
5664	x29s_core.exe
3420	x29s_core.exe
3420	x29s_core.exe
3420	x29s_core.exe
3420	x29s_core.exe
3420	x29s_core.exe
3420	x29s_core.exe
3420	x29s_core.exe
3420	x29s_core.exe
1152	x29s_core.exe
1152	x29s_core.exe
1152	x29s_core.exe
1152	x29s_core.exe
1152	x29s_core.exe
1152	x29s_core.exe
1152	x29s_core.exe
1152	x29s_core.exe
3076	x29s_core.exe
3076	x29s_core.exe
3076	x29s_core.exe
3076	x29s_core.exe
3076	x29s_core.exe
3076	x29s_core.exe
3076	x29s_core.exe
3076	x29s_core.exe
2624	x29s_core.exe
2624	x29s_core.exe
2624	x29s_core.exe
2624	x29s_core.exe
2624	x29s_core.exe
2624	x29s_core.exe
2624	x29s_core.exe
2624	x29s_core.exe
3316	x29s_core.exe
3316	x29s_core.exe
3316	x29s_core.exe
3316	x29s_core.exe
3316	x29s_core.exe
3316	x29s_core.exe
3316	x29s_core.exe
3316	x29s_core.exe
5468	x29s_core.exe
5468	x29s_core.exe
5468	x29s_core.exe
5468	x29s_core.exe
5468	x29s_core.exe
5468	x29s_core.exe
5468	x29s_core.exe
5468	x29s_core.exe
6120	x29s_core.exe
6120	x29s_core.exe
6120	x29s_core.exe
6120	x29s_core.exe
6120	x29s_core.exe
6120	x29s_core.exe
6120	x29s_core.exe
6120	x29s_core.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 5664 wrote to memory of 4976	5664	x29s_core.exe	89
PID 4976 wrote to memory of 2536	4976	cmd.exe	90
PID 3420 wrote to memory of 5288	3420	x29s_core.exe	94
PID 5288 wrote to memory of 2880	5288	cmd.exe	95
PID 1152 wrote to memory of 4152	1152	x29s_core.exe	98
PID 4152 wrote to memory of 5580	4152	cmd.exe	99
PID 3076 wrote to memory of 1016	3076	x29s_core.exe	102
PID 1016 wrote to memory of 3124	1016	cmd.exe	103
PID 2624 wrote to memory of 5292	2624	x29s_core.exe	106
PID 5292 wrote to memory of 4088	5292	cmd.exe	107
PID 3316 wrote to memory of 2072	3316	x29s_core.exe	110
PID 2072 wrote to memory of 1568	2072	cmd.exe	111
PID 5468 wrote to memory of 3324	5468	x29s_core.exe	114
PID 3324 wrote to memory of 5912	3324	cmd.exe	115
PID 6120 wrote to memory of 1704	6120	x29s_core.exe	118
PID 1704 wrote to memory of 5472	1704	cmd.exe	119
PID 4528 wrote to memory of 1964	4528	x29s_core.exe	122
PID 1964 wrote to memory of 1848	1964	cmd.exe	123
PID 2148 wrote to memory of 2292	2148	x29s_core.exe	126
PID 2292 wrote to memory of 3496	2292	cmd.exe	127

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
"C:\Users\Admin\AppData\Local\Temp\x29s_core.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\system32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:2536

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5288
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:2880

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:5580

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:3124

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5292
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:4088

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:1568

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:5912

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:5472

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:1848

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:3496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x29s.vbs

Path C:\Windows\Temp\x29s.vbs
Size 336B
SHA256 f4c3c4f9b161c816ebc85a727724d4057ccb590c5b5b99d0448121bb99fc1b6a
MD5 e859ad339a00acd7fca5a38da936246f
SHA1 9b1b11d0545e18a12358d1e189afe1953bad922a
SHA512 b036dde2fa6d8d06ed1e7206bd7af4c4f6cb321bfde5df35d0daafffa5bb15e3539966e79a251cb05b99b85880a290f934323bc0eeb96406b51238062e96449e
TLSH
T15FE026520D67889788AF370375E223435ED0921C7AB7363A9964DC0C5F9889E8089092
MD5 SHA1 SHA512 TLSH

Submit Download

debug_c2.txt

Path C:\debug_c2.txt
Size 32B
SHA256 30a9803c288926f349739b306655e9281387dfad6c941b84abc41b126608c400
MD5 60d8f89335bd03ecf096523d3d690809
SHA1 99da757e5ff5415a5714d09de3954f5987586e14
SHA512 10f2bb3135ed581f4181764f0c01f40d9c56a5856bbe4f28b57d90b88a51c8cbf1a86ebdfa5339d5ccd1b16d28704707d7066da93662ecdce2b1906c2d2b0ea7
MD5 SHA1 SHA512

Submit Download

debug_evasion.txt

Path C:\debug_evasion.txt
Size 26B
SHA256 39fc8b44e5ba898f9e6979505b5026a0a98f64a62651efc700f5f959f45b41b7
MD5 f8424e43d03cf24c6052d383c8e17dd6
SHA1 6ecd8703f814631f761a3b9a4c762ddf41049f10
SHA512 f02049bc21a1b9957bec944e35b7a84c83e510eea7bd890d3bcf4eeb75fd15d031c479ae0415e68950e85963dcf85ad1346d25faca0a667ca6869c47eff93545
MD5 SHA1 SHA512

Submit Download

debug_load.txt

Path C:\debug_load.txt
Size 21B
SHA256 7a7747c63cdcd7b378d4bb65daeeee5cf701b573029c8f8fa97bb2430aa9b03a
MD5 f9ad507f79b4230f7ce655d09abdbc7a
SHA1 fbed4f288a54999d108e92b6ea0e191621eaed55
SHA512 c7f7b77505461e6db7fdaa430a6829882858641444df4f35055b6150fdb8ca9e6ac6c534b157cdf9c902eda39cd83ce22f61761c9155e8e0678fde7c93e50690
MD5 SHA1 SHA512

Submit Download

debug_loaded.txt

Path C:\debug_loaded.txt
Size 40B
SHA256 7ce4bb478be10f6af96b366a1e3b02e46acd46264000536412492663fbbe3e3f
MD5 25f48643b395f53e0f2d9d98522aef19
SHA1 452baeaa3ed394b9ef80026dfecc311eca3eadf3
SHA512 d8c10428b18952e64d38214323759b208465f5658ae8705c3e4f449f115a22af51c01773c98ee52ef06d676e93e3ee674a2e0d2c23c0b25d8b519fe7118a43eb
MD5 SHA1 SHA512

Submit Download

debug_main.txt

Path C:\debug_main.txt
Size 16B
SHA256 b2ee13dcebf250e402f7a667b61528cb3f4a22a16aa66331dc2b7c41d98df13e
MD5 76b96be130bb2b941c690b3193ee3e46
SHA1 babaeee95f2464116ed19688c61bbf9cc2f72351
SHA512 0c04b0cd2108beceaf7cb53bd10a80cced43bacceb8917e4e405d391a0b029b0469f3d5346c2db18235655a0f48b5cc9ac3ccf48600a0138279596a600acd64d
MD5 SHA1 SHA512

Submit Download

debug_run.txt

Path C:\debug_run.txt
Size 49B
SHA256 c88bc63a120c932cab8cc50ec18c1aeeff1509e8155d6aaf98566e55add70a79
MD5 7de5cd463a4d155b788f4028a8e943b0
SHA1 4a744f77a69fa45b8950b9f9ebdf0ddbf64aed70
SHA512 8c91152b7ee4692d00b254b5099d7ab45974eaa05fad01bc090309647cd5c5ec43bbfe0f8219217bb2f7f84afddcd87fd33aa3bb2ec55d8c1d1efd80606a5993
MD5 SHA1 SHA512

Submit Download

memory/1152-48-0x00007FF752F90000-0x00007FF75309B000-memory.dmp

Download

memory/2148-163-0x00007FF752F90000-0x00007FF75309B000-memory.dmp

Download

memory/2624-78-0x00007FF752F90000-0x00007FF75309B000-memory.dmp

Download

memory/3076-63-0x00007FF752F90000-0x00007FF75309B000-memory.dmp

Download

memory/3316-101-0x00007FF752F90000-0x00007FF75309B000-memory.dmp

Download

memory/3420-32-0x00007FF752F90000-0x00007FF75309B000-memory.dmp

Download

memory/4528-153-0x00007FF752F90000-0x00007FF75309B000-memory.dmp

Download

memory/5468-112-0x00007FF752F90000-0x00007FF75309B000-memory.dmp

Download

memory/5664-10-0x00007FF752F90000-0x00007FF75309B000-memory.dmp

Download

memory/6120-129-0x00007FF752F90000-0x00007FF75309B000-memory.dmp

Download