c4e4085c85a398ae4b50c00ea3d6d71786c36ab090e011e5a012a117dab71662

Analysis

max time kernel
150s
max time network
157s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
client.exe
Size 19.6MB
Sample260706-pgr61aaz2j
SHA256 c4e4085c85a398ae4b50c00ea3d6d71786c36ab090e011e5a012a117dab71662
MD5 470cc9779de50270141386f8e5883512
SHA1 595db26502b13b099ef68f61b6f4de28c1b9baff
SHA512 32230bc59677bde0217e30493b946b38ab7108723c65a34115cb2a3f2926a69ae5fa1043e24600e22a763944dea17df43bea206399a9ad5b1f6db7e051ef541e
SSDEEP 196608:ajR+60waMUmSIKBUVke0UJB0HXZM3Au+1ZezOf7rBpz+b85FkjIVO:ajR+6WM3mpe0SH3AuYEOfnB9tF7O
TLSH
T1AF279D47E8A541E4C0AAD135CA669257BA717C894F3163C73F90F7282F36BE0AE79710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3708	powershell.exe
2200	powershell.exe

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3200	netsh.exe
2784	netsh.exe
296	netsh.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSystemComponent.lnk	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
4972	client.exe
1960	client.exe
5632	client.exe
3636	client.exe
2204	client.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\client.exe"	client.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Windows\CurrentVersion\Run\RemoteX = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\client.exe"	client.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RemoteX = "C:\\ProgramData\\Microsoft\\Windows\\client.exe"	client.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

GoLang User-Agent 26 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	5	Go-http-client/1.1
HTTP User-Agent header	13	Go-http-client/1.1
HTTP User-Agent header	16	Go-http-client/1.1
HTTP User-Agent header	18	Go-http-client/1.1
HTTP User-Agent header	20	Go-http-client/1.1
HTTP User-Agent header	21	Go-http-client/1.1
HTTP User-Agent header	24	Go-http-client/1.1
HTTP User-Agent header	4	Go-http-client/1.1
HTTP User-Agent header	6	Go-http-client/1.1
HTTP User-Agent header	8	Go-http-client/1.1
HTTP User-Agent header	9	Go-http-client/1.1
HTTP User-Agent header	10	Go-http-client/1.1
HTTP User-Agent header	11	Go-http-client/1.1
HTTP User-Agent header	17	Go-http-client/1.1
HTTP User-Agent header	19	Go-http-client/1.1
HTTP User-Agent header	7	Go-http-client/1.1
HTTP User-Agent header	15	Go-http-client/1.1
HTTP User-Agent header	23	Go-http-client/1.1
HTTP User-Agent header	27	Go-http-client/1.1
HTTP User-Agent header	28	Go-http-client/1.1
HTTP User-Agent header	14	Go-http-client/1.1
HTTP User-Agent header	3	Go-http-client/1.1
HTTP User-Agent header	12	Go-http-client/1.1
HTTP User-Agent header	22	Go-http-client/1.1
HTTP User-Agent header	26	Go-http-client/1.1
HTTP User-Agent header	1	Go-http-client/1.1

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1760	schtasks.exe
6128	schtasks.exe
1588	schtasks.exe
4276	schtasks.exe
5676	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
6012	client.exe
3708	powershell.exe
3708	powershell.exe
2200	powershell.exe
2200	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3708	powershell.exe
Token: SeDebugPrivilege	2200	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6012	client.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 6012 wrote to memory of 3708	6012	client.exe	89
PID 6012 wrote to memory of 1760	6012	client.exe	91
PID 6012 wrote to memory of 1588	6012	client.exe	93
PID 6012 wrote to memory of 6128	6012	client.exe	95
PID 6012 wrote to memory of 3200	6012	client.exe	97
PID 6012 wrote to memory of 2200	6012	client.exe	100
PID 6012 wrote to memory of 2784	6012	client.exe	104
PID 6012 wrote to memory of 4276	6012	client.exe	107
PID 6012 wrote to memory of 296	6012	client.exe	109
PID 6012 wrote to memory of 5676	6012	client.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\client.exe
"C:\Users\Admin\AppData\Local\Temp\client.exe"
1⤵
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NonInteractive -WindowStyle Hidden -NoProfile -Command "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSystemComponent.lnk');$s.TargetPath='C:\Users\Admin\AppData\Local\Microsoft\Windows\client.exe';$s.WindowStyle=7;$s.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3708
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftWindowsManagementClient /tr \"C:\Users\Admin\AppData\Local\Microsoft\Windows\client.exe\" /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1760
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftWindowsManagementClientBoot /tr \"C:\Users\Admin\AppData\Local\Microsoft\Windows\client.exe\" /sc ONSTART /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1588
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftWindowsManagementClientPerf /tr \"C:\Users\Admin\AppData\Local\Microsoft\Windows\client.exe\" /sc MINUTE /mo 5 /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6128
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall delete rule "name=RemoteX Client"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NonInteractive -WindowStyle Hidden -NoProfile -Command "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\WindowsSystemComponent.lnk');$s.TargetPath='C:\ProgramData\Microsoft\Windows\client.exe';$s.WindowStyle=7;$s.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2200
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule "name=RemoteX Client" dir=out action=allow program=C:\Users\Admin\AppData\Local\Temp\client.exe
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2784
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftWindowsManagementClientSystem /tr \"C:\ProgramData\Microsoft\Windows\client.exe\" /sc ONLOGON /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4276
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule "name=RemoteX Client In" dir=in action=allow program=C:\Users\Admin\AppData\Local\Temp\client.exe
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:296
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftWindowsManagementClientSystemBoot /tr \"C:\ProgramData\Microsoft\Windows\client.exe\" /sc ONSTART /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5676

C:\Users\Admin\AppData\Local\Microsoft\Windows\client.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\client.exe
1⤵
- Executes dropped EXE
PID:4972

C:\Users\Admin\AppData\Local\Microsoft\Windows\client.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\client.exe"
1⤵
- Executes dropped EXE
PID:1960

C:\ProgramData\Microsoft\Windows\client.exe
C:\ProgramData\Microsoft\Windows\client.exe
1⤵
- Executes dropped EXE
PID:5632

C:\ProgramData\Microsoft\Windows\client.exe
"C:\ProgramData\Microsoft\Windows\client.exe"
1⤵
- Executes dropped EXE
PID:3636

C:\PROGRA~3\MICROS~1\Windows\client.exe
C:\PROGRA~3\MICROS~1\Windows\client.exe
1⤵
- Executes dropped EXE
PID:2204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 813b2605a55834cb21e5e2529ee19879ba9a0e90766b6685700ae07f07a80ecf
MD5 16d3ff75d3fbe2307d11785068c45de2
SHA1 205fd1becf838eb47906498e2b4dc9ccc1f78018
SHA512 531de39d3a4eb7a11376512d54fd8d9e6b90e1fbff5b202cd3f675e5ce0db69165b816ca93301a9b8a4c59f0e794831e3a2638c0dacef6766ed6067dbb78ca17
TLSH
T103117A33F3CC8664C89A413650CEAC1536B6C7DB40DEDEABBB84D548B42F289CF61160
MD5 SHA1 SHA512 TLSH

Submit Download

client.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\client.exe
Size 19.6MB
SHA256 c4e4085c85a398ae4b50c00ea3d6d71786c36ab090e011e5a012a117dab71662
MD5 470cc9779de50270141386f8e5883512
SHA1 595db26502b13b099ef68f61b6f4de28c1b9baff
SHA512 32230bc59677bde0217e30493b946b38ab7108723c65a34115cb2a3f2926a69ae5fa1043e24600e22a763944dea17df43bea206399a9ad5b1f6db7e051ef541e
SSDEEP 196608:ajR+60waMUmSIKBUVke0UJB0HXZM3Au+1ZezOf7rBpz+b85FkjIVO:ajR+6WM3mpe0SH3AuYEOfnB9tF7O
TLSH
T1AF279D47E8A541E4C0AAD135CA669257BA717C894F3163C73F90F7282F36BE0AE79710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3708-12-0x00007FFAB7BC0000-0x00007FFAB8564000-memory.dmp

Download

memory/3708-13-0x00007FFAB7BC0000-0x00007FFAB8564000-memory.dmp

Download

memory/3708-8-0x000001765B870000-0x000001765B892000-memory.dmp

Download

memory/3708-10-0x00007FFAB7BC0000-0x00007FFAB8564000-memory.dmp

Download

memory/3708-9-0x00007FFAB7BC0000-0x00007FFAB8564000-memory.dmp

Download

memory/3708-11-0x00007FFAB7BC0000-0x00007FFAB8564000-memory.dmp

Download

memory/3708-4-0x00007FFAB7BC0000-0x00007FFAB8564000-memory.dmp

Download

memory/3708-7-0x00007FFAB7BC0000-0x00007FFAB8564000-memory.dmp

Download

memory/3708-14-0x00007FFAB7BC0000-0x00007FFAB8564000-memory.dmp

Download

memory/3708-15-0x00007FFAB7BC0000-0x00007FFAB8564000-memory.dmp

Download

memory/3708-16-0x00007FFAB7BC0000-0x00007FFAB8564000-memory.dmp

Download

memory/3708-17-0x00007FFAB7BC0000-0x00007FFAB8564000-memory.dmp

Download

memory/3708-18-0x00007FFAB7BC0000-0x00007FFAB8564000-memory.dmp

Download

memory/3708-21-0x00007FFAB7BC0000-0x00007FFAB8564000-memory.dmp

Download

memory/3708-3-0x00007FFAB7D4F000-0x00007FFAB7D50000-memory.dmp

Download