Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/07/2026, 12:15
Behavioral task
behavioral1
Sample
123.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
123.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target 123.exe
- Size 584KB
- Sample260705-pezhasf14n
- SHA256 f65a25e37c7abc88d641e13004c4e5523502b4568cfcf6713f4f50e34f23e770
- MD5 b2f641209efa51dda327fb48bafd0986
- SHA1 0b5439d135dc4d685e3fa346ac56dc89713b1a86
- SHA512 2681fc2bf6854c7b688e28ab2253253a6d1087fceee5e3a84023bb14c5757fb856ebb1c87dcd5c33e6e619277aa9c50c9065e54208adf86d88e30a636d4bfbdf
- SSDEEP 6144:VmPgvqJJWgEmEizgdS7Mm3o0wmjrdABecyw:VmUCJktEMm3WmmBiw
- TLSH T197D4F21DEF2EBCE4F91E53BE3530482A3F519926B8BE586D61526626CC34343409BDCB
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
redosdru
C2
-
http://www.tgzh.club/NetSyst96.dll
Signatures
- Family: Redosdru
Redosdru is a loader/downloader written in C++.
- Gh0st RAT payload 12 IoCs
resource yara_rule behavioral2/memory/1904-9-0x0000000010000000-0x000000001034B000-memory.dmp family_gh0strat behavioral2/memory/1904-7-0x0000000010000000-0x000000001034B000-memory.dmp family_gh0strat behavioral2/memory/1904-8-0x0000000010000000-0x000000001034B000-memory.dmp family_gh0strat behavioral2/memory/2456-15-0x0000000010000000-0x000000001034B000-memory.dmp family_gh0strat behavioral2/memory/2456-16-0x0000000010000000-0x000000001034B000-memory.dmp family_gh0strat behavioral2/memory/2456-18-0x0000000010000000-0x000000001034B000-memory.dmp family_gh0strat behavioral2/memory/2456-20-0x0000000010000000-0x000000001034B000-memory.dmp family_gh0strat behavioral2/memory/2452-28-0x0000000010001000-0x000000001030F000-memory.dmp family_gh0strat behavioral2/memory/2452-27-0x0000000010000000-0x000000001034B000-memory.dmp family_gh0strat behavioral2/memory/2452-25-0x0000000010000000-0x000000001034B000-memory.dmp family_gh0strat behavioral2/memory/2452-26-0x0000000010000000-0x000000001034B000-memory.dmp family_gh0strat behavioral2/memory/2456-29-0x0000000010000000-0x000000001034B000-memory.dmp family_gh0strat - Executes dropped EXE 2 IoCs
pid Process 2456 Tlwguwa.exe 2452 Tlwguwa.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Wsmwac gzemfhny = "C:\\Program Files (x86)\\Microsoft Owhrfh\\Tlwguwa.exe" Tlwguwa.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: Tlwguwa.exe File opened (read-only) \??\V: Tlwguwa.exe File opened (read-only) \??\Q: Tlwguwa.exe File opened (read-only) \??\D: Tlwguwa.exe File opened (read-only) \??\G: Tlwguwa.exe File opened (read-only) \??\I: Tlwguwa.exe File opened (read-only) \??\J: Tlwguwa.exe File opened (read-only) \??\L: Tlwguwa.exe File opened (read-only) \??\H: Tlwguwa.exe File opened (read-only) \??\K: Tlwguwa.exe File opened (read-only) \??\P: Tlwguwa.exe File opened (read-only) \??\R: Tlwguwa.exe File opened (read-only) \??\U: Tlwguwa.exe File opened (read-only) \??\X: Tlwguwa.exe File opened (read-only) \??\Z: Tlwguwa.exe File opened (read-only) \??\B: Tlwguwa.exe File opened (read-only) \??\M: Tlwguwa.exe File opened (read-only) \??\O: Tlwguwa.exe File opened (read-only) \??\W: Tlwguwa.exe File opened (read-only) \??\Y: Tlwguwa.exe File opened (read-only) \??\N: Tlwguwa.exe File opened (read-only) \??\S: Tlwguwa.exe -
resource yara_rule behavioral2/memory/1904-4-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/memory/1904-9-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/memory/1904-7-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/memory/1904-8-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/memory/2456-12-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/memory/2456-15-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/memory/2456-16-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/memory/2456-18-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/memory/2456-20-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/memory/2452-22-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/memory/2452-28-0x0000000010001000-0x000000001030F000-memory.dmp upx behavioral2/memory/2452-27-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/memory/2452-25-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/memory/2452-26-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/memory/2456-29-0x0000000010000000-0x000000001034B000-memory.dmp upx - Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\AppPatch\NetSyst96.dll 123.exe File opened for modification C:\Program Files\AppPatch\NetSyst96.dll 123.exe File created C:\Program Files (x86)\Microsoft Owhrfh\Tlwguwa.exe 123.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Tlwguwa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 123.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Tlwguwa.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Tlwguwa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Tlwguwa.exe - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe 2456 Tlwguwa.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1904 123.exe Token: SeDebugPrivilege 2456 Tlwguwa.exe Token: SeDebugPrivilege 2456 Tlwguwa.exe Token: SeDebugPrivilege 2452 Tlwguwa.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1904 wrote to memory of 2456 1904 123.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\123.exe"C:\Users\Admin\AppData\Local\Temp\123.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Program Files (x86)\Microsoft Owhrfh\Tlwguwa.exe"C:\Program Files (x86)\Microsoft Owhrfh\Tlwguwa.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2456
-
-
C:\Program Files (x86)\Microsoft Owhrfh\Tlwguwa.exe"C:\Program Files (x86)\Microsoft Owhrfh\Tlwguwa.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2452
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft Owhrfh\Tlwguwa.exe
- Size 584KB
- SHA256 f65a25e37c7abc88d641e13004c4e5523502b4568cfcf6713f4f50e34f23e770
- MD5 b2f641209efa51dda327fb48bafd0986
- SHA1 0b5439d135dc4d685e3fa346ac56dc89713b1a86
- SHA512 2681fc2bf6854c7b688e28ab2253253a6d1087fceee5e3a84023bb14c5757fb856ebb1c87dcd5c33e6e619277aa9c50c9065e54208adf86d88e30a636d4bfbdf
- SSDEEP 6144:VmPgvqJJWgEmEizgdS7Mm3o0wmjrdABecyw:VmUCJktEMm3WmmBiw
- TLSH T197D4F21DEF2EBCE4F91E53BE3530482A3F519926B8BE586D61526626CC34343409BDCB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\AppPatch\NetSyst96.dll
- Size 239KB
- SHA256 7baee22c9834bef64f0c1b7f5988d9717855942d87c82f019606d07589bc51a9
- MD5 8c19d83ff359a1b77cb06939c2e5f0cb
- SHA1 a01a199e6f6f3e84cef5c7e6251a2b1291217885
- SHA512 b241c7b0f6372483faf4630e82d7f609e8450bac17cedaeb8fc7db8157ec5363e153f5cab5188eee6d8b27b366656877d4421122c8e26a0a739b6c5308bde381
- SSDEEP 6144:HmbyEr/rerH3HOkzOBhVKaWcu4iXZrOBV:HEyEA+kzIKiu4w
- TLSH T13934235DA581D8B764A934534CAFAC473935D76E1B02A3F364B0207C2F8CBD5EB6A01B
- MD5 SHA1 SHA512 SSDEEP TLSH