e958365a6a12f383addcd39820cc08c9df543960a06abfd71f162e2a97e57abb

Analysis

user interaction
yes
max time kernel
36s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CloudRedirect.exe
Size 9.5MB
Sample260620-e14c9sc18n
SHA256 e958365a6a12f383addcd39820cc08c9df543960a06abfd71f162e2a97e57abb
MD5 4c383a312c5eec7329c1403caef4c6f2
SHA1 a2d9ca39237c591c00f40dbf93311768d51bed0d
SHA512 eec6f00c4b7640a7ebb5a20e4c032835910cdf37e62d1dc3ccceecc4040084b1d25ebbada3a1eed607042ccd570786553419ba4842ca0d4db22facdf8a3e1941
SSDEEP 98304:6LikBk+KpQDeYGA9xe/+FOvSmaRf+UcDN9NppBLxAHDfyLrZlp:6pBk+RX9xz8N9NppD
TLSH
T111A69F2E17DD0D35C3B7837D8EA0B7235A7928161342AB974F4B9B2D086A2C4CEF5257
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	CloudRedirect.exe

Executes dropped EXE 1 IoCs

pid	Process
1608	CloudRedirect.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2432	CloudRedirect.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2432	CloudRedirect.exe
Token: SeDebugPrivilege	1608	CloudRedirect.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2432	CloudRedirect.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 1608	2432	CloudRedirect.exe	97

C:\Users\Admin\AppData\Local\Temp\CloudRedirect.exe
"C:\Users\Admin\AppData\Local\Temp\CloudRedirect.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Users\Admin\AppData\Local\Temp\CloudRedirect.exe
  "C:\Users\Admin\AppData\Local\Temp\CloudRedirect.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CloudRedirect.exe

Path C:\Users\Admin\AppData\Local\Temp\CloudRedirect.exe
Size 14.9MB
SHA256 926db44f7fe1b5c0bb8d32c5ba44e4d61e04afc2e5e7c890c7207360a7a28a9f
MD5 e392aee5c7375703636652d6f6e5214f
SHA1 423a42ce842abbcc43552b29f1f3ecf11c664963
SHA512 51ff2a42c3da4d8a108d3c007d9fb6219e3139bbd095150c1194f0428ba632fe3cd9da3f5fdde033dc7b4b4d15519344d160aeda971622d2c1c69caa089f214c
SSDEEP 393216:uLh1nLh1nLh1nLh1nLh1nLh1Z9xzANppj:u91n91n91n91n91n91ZbAXpj
TLSH
T181F6C02E13DD0D35C3B7C37D8EA0B7235A7928161342AB974F4B9A5D086A2C4CEF525B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2432-9-0x00007FF61DFA0000-0x00007FF61DFD8000-memory.dmp

Download