Resubmissions
08/07/2026, 02:24
260708-cv66vsat7n708/07/2026, 02:19
260708-csbxyaat3q708/06/2026, 00:15
260608-ajzljacy2l7Analysis
- user interaction
yes - max time kernel
149s - max time network
150s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
08/07/2026, 02:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
365vpnx2.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
365vpnx2.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
365vpnx2.exe
Resource
win11-20260513-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target 365vpnx2.exe
- Size 299KB
- Sample260708-cv66vsat7n
- SHA256 79180bfa934ec632e18239bea8f672f584e52d51732ba22746a46dc36cda46fc
- MD5 5fd2a9bee8b02482730057599e1311cf
- SHA1 a78ce9d81f8318310d6e766644e7499de7779c0c
- SHA512 8b11e25309bf8243ccc1dd38e957d43430bd2500f654ebe0183f23e1f8fd64c15e527a1c59eae53e99a24e71e21ab243464921d9336903ad2ba770064d62ec6a
- SSDEEP 6144:1z7yp0yN90QE9ZPZE+z9YUaBew+4XY1OMMaX:hXy901Pa+zeob4XyO0X
- TLSH T12764F182B6C000E6D87983B599E303476B71BC956BA603DF2394E61E5E336C8B637347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3556 cmstp.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 365vpnx2.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies data under HKEY_USERS 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client" svchost.exe - Suspicious behavior: LoadsDriver 64 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 680 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4256 wrote to memory of 3556 4256 365vpnx2.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\365vpnx2.exe"C:\Users\Admin\AppData\Local\Temp\365vpnx2.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cmstp.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\.\cmstp.exe 365vpnx2.inf2⤵
- Executes dropped EXE
PID:3556
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵
- Modifies data under HKEY_USERS
PID:2760
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\365vpnx2.cmp
- Size 84B
- SHA256 ef2ed8c29138c2d65131fe793df2db94698ee10b6aaed71e13046536804b4ca0
- MD5 32d6f6437c5b307b062606710cca8553
- SHA1 5a22e8b7f5b77880c980c454a2176df254053381
- SHA512 0a3e62b4e9e1a978c717ec8bd573c52b417ea625d3ab9f728630085d1f6ce63d806e3bbf06ffd85eb87e16f2a0842b22cd33125e0e05feec5ad84c6cba4b1efb
- TLSH T1AFA01203026C700D007B4843381400B061E806F000400117206150287D2A82813D55D9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\365vpnx2.inf
- Size 10KB
- SHA256 912bb337f552018490692e04539e763fa0e700a0ada0a4fbb97b56d62247a295
- MD5 37183afad6a36e535e36b26619998e13
- SHA1 2702ff818d4bff528bc6cc6b081fb4232aa5e2d9
- SHA512 89138c9d84dbfc8f0e3c14fb5bf7a608ec1806e91a02c30dc9ffc9da793068918c2705f8a66c5cbb49604a88a8c26343dae4b13deab9e000528f4b26b5309884
- SSDEEP 192:ExQ/TvQ/8bWQgLcic9jKRF+4FO6kORzAHwpXZO:E2rYUaMjKRF+4FO6ewpXZO
- TLSH T1AB2253852D6A913169D5E332A60B8147EFEA3F449C801A0B79F67C406D6E74D01BE4FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cmstp.exe
- Size 96KB
- SHA256 84757d6325662746651b40c3f14d65792ca9f5351c9963502e60ce25149d790d
- MD5 350eae0019abc92ac9a4bcbe139f38a2
- SHA1 b02e086d555f5bc8265d00d88b591ed81dee9a75
- SHA512 53ffe5bada8c9b8cb174a0b946fef1d025c11dfeb0d4bf6b5a5a38e533aab0b4a15d31c149e4396e7cb11ed604531b86c12549b21f7ed20c1cde132851c459fe
- SSDEEP 1536:Co87JMerBb2x4GFBFr0cNywYzy7+IzjChzg7nAIMUe+KXNHCAvT2z9rxOJTn:C/7JMerBy20BFtYofOg7hW+ENiALYrxm
- TLSH T18EA3090227E901A8E1B69B75D9B64612EBB778602B31CBDF4710C44E2F72EE1DD38716
- MD5 SHA1 SHA512 SSDEEP TLSH