Analysis
- max time kernel
200s - max time network
202s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/06/2026, 17:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
RadmirVPN.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
10 signatures
900 seconds
Behavioral task
behavioral2
Sample
RadmirVPN.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
900 seconds
Behavioral task
behavioral3
Sample
RadmirVPN.exe
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
900 seconds
Errors
Reason
Machine shutdown
General
- Target RadmirVPN.exe
- Size 101KB
- Sample260620-wgbbtags9p
- SHA256 f3df4849a5192348c1de5915498cbbd07bfddf6a491fd77ec8ef7eb67c6abae1
- MD5 dc90caac1fa96455e091d8d37dd17e92
- SHA1 acf59ea21a533fe453c4a755c7adf67afcbd82e0
- SHA512 2641ba7d73971e61d417a722f3be636484bf8af9c05618a663356bc535f3e2dfb9c755725b86738ad03ee2ad910e3725c2e36925a80c71ea192464f4ce7d6c3d
- SSDEEP 1536:DyU9N2jogIvPTr3t3wYujhlht9gOmUrabXYNBalr0y2uCZct9baoSg4J:u7NeN3w/jhlhE1Z8Nig9b29ba7
- TLSH T14FA3BF5173C29191F6BE1DF49AD2998953BCD693B603C70E1CFBA0D412A63C4C632EE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation RadmirVPN.exe - Loads dropped DLL 10 IoCs
pid Process 4868 Process not Found 3156 Process not Found 1604 WmiApSrv.exe 1556 Process not Found 3680 Process not Found 212 Process not Found 2524 Process not Found 4196 shutdown.exe 4840 LogonUI.exe 4176 Process not Found - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\xdwd.dll RadmirVPN.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "64" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe 3940 RadmirVPN.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3940 RadmirVPN.exe Token: SeShutdownPrivilege 4196 shutdown.exe Token: SeRemoteShutdownPrivilege 4196 shutdown.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4840 LogonUI.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3940 wrote to memory of 2140 3940 RadmirVPN.exe 103 PID 2140 wrote to memory of 4196 2140 cmd.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\RadmirVPN.exe"C:\Users\Admin\AppData\Local\Temp\RadmirVPN.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c Shutdown /s /f /t 002⤵
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\system32\shutdown.exeShutdown /s /f /t 003⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4196
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Loads dropped DLL
PID:1604
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3940855 /state1:0x41c64e6d1⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4840
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\xdwd.dll
- Size 136KB
- SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
- MD5 16e5a492c9c6ae34c59683be9c51fa31
- SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
- SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
- SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
- TLSH T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
- MD5 SHA1 SHA512 SSDEEP TLSH