Analysis
- max time kernel
149s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
02/07/2026, 11:39
General
- Target 2026-07-02_55117e578c705e7678ae477aab99f529_hive.exe
- Size 4.5MB
- Sample260702-nslypag17t
- SHA256 b69b6de0f8ebfc6233eefd8c2b98debeee196048aacbfda345cef00d915005fd
Malware Config
Signatures
- UPX dump on OEP (original entry point) 12 IoCs
- Executes dropped EXE 1 IoCs
- UPX packed file 12 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- Modifies system certificate store 2 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_55117e578c705e7678ae477aab99f529_hive.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_55117e578c705e7678ae477aab99f529_hive.exe"1⤵
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /End /TN NekroneAgent2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /TN NekroneAgent /XML C:\Users\Admin\AppData\Local\Temp\zc-task-1782992385911108500.xml /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\ProgramData\Nekrone\zc-agent.exeC:\ProgramData\Nekrone\zc-agent.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
zc-agent.exe
zc-task-1782992385911108500.xml
memory/4672-14-0x00007FF7EB410000-0x00007FF7EE42A000-memory.dmp
memory/4672-0-0x00007FF7EB410000-0x00007FF7EE42A000-memory.dmp
memory/4672-8-0x00007FF7EB410000-0x00007FF7EE42A000-memory.dmp
memory/4672-24-0x00007FF7EB410000-0x00007FF7EE42A000-memory.dmp
memory/4672-10-0x00007FF7EB410000-0x00007FF7EE42A000-memory.dmp
memory/4672-12-0x00007FF7EB410000-0x00007FF7EE42A000-memory.dmp
memory/6104-7-0x00007FF734C80000-0x00007FF737C9A000-memory.dmp
memory/6104-15-0x00007FF734C80000-0x00007FF737C9A000-memory.dmp
memory/6104-21-0x00007FF734C80000-0x00007FF737C9A000-memory.dmp
memory/6104-9-0x00007FF734C80000-0x00007FF737C9A000-memory.dmp
memory/6104-27-0x00007FF734C80000-0x00007FF737C9A000-memory.dmp