2c238e1f54ad71c89472ffe35a331e910909355069d1db02ce15ccc313372605

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2c238e1f54ad71c89472ffe35a331e910909355069d1db02ce15ccc313372605.exe
Size 383KB
Sample260709-pflb3aa14x
SHA256 2c238e1f54ad71c89472ffe35a331e910909355069d1db02ce15ccc313372605
MD5 026fdf247ec955b054e6e89e01cf17fb
SHA1 87ea1696ec629db44620455af2d0399bfd1fef9c
SHA512 ebbeae36942317bd072dc74dce6f2b4c030c48ac84dfbbe45ce4ba8b936d3605f1ac37fad9a1d1b5975c9607fbf4a0a7f7ad362ab31d3575634a5846df912223
SSDEEP 6144:vdFkbJ9If+N3rFe/D4hEyYs5OkxyWo2SkVzsS2gCo0oiXSyCMIr9FnD:orf3rFe/Tyj5OkOyh0oiXSky
TLSH
T1D184AE5673A40CF8EC7B823DC9928906E772B8260770DBDF17A042661F236E19D7EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
20	2800	2c238e1f54ad71c89472ffe35a331e910909355069d1db02ce15ccc313372605.exe

Executes dropped EXE 1 IoCs

pid	Process
4076	chart.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\chart\chart.exe	2c238e1f54ad71c89472ffe35a331e910909355069d1db02ce15ccc313372605.exe
File created	C:\Program Files\chart\config.dat	2c238e1f54ad71c89472ffe35a331e910909355069d1db02ce15ccc313372605.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chart.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	chart.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
2800	2c238e1f54ad71c89472ffe35a331e910909355069d1db02ce15ccc313372605.exe
2800	2c238e1f54ad71c89472ffe35a331e910909355069d1db02ce15ccc313372605.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe
4076	chart.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4076	chart.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4076	chart.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2c238e1f54ad71c89472ffe35a331e910909355069d1db02ce15ccc313372605.exe
"C:\Users\Admin\AppData\Local\Temp\2c238e1f54ad71c89472ffe35a331e910909355069d1db02ce15ccc313372605.exe"
1⤵
- Downloads MZ/PE file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:2800

C:\Program Files\chart\chart.exe
"C:\Program Files\chart\chart.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chart.exe

Path C:\Program Files\chart\chart.exe
Size 451KB
SHA256 34af4e893055d100e90d657ffc39ba0a9f3531e9ddf1f35269e5f8fcd08129e4
MD5 1e7be155513ba6fb317b0b746ab7ead4
SHA1 f7a9d23b8081da78c4203eb92e4bad039441803b
SHA512 4595e8510b2fefd513e4aac513e00a55b263e26c8c4db00deb75848046863a374023c4289811cc6cd936dba2d0952786c8b9a574f6da17e6a19784d51b04496e
SSDEEP 6144:9dFkbJ9If+WrFe/D4hEyUjvs5OkxyWo2OVz1/:Sr0rFe/TyUQ5Ok4Z
TLSH
T160A419053247C8B5E82A6D3CAAA348F2D3B57D15575CD28B1360B63F4E771A88D3B6E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.dat

Path C:\Program Files\chart\config.dat
Size 1.7MB
SHA256 cb4b0dd4aaa0f1024ed3575ef96b9ce4e499c648aa661cfd9cddc2a246cb4c0e
MD5 da0174bc875ade5b65d98e1b365935c8
SHA1 acc683c6a32b5d6fe473358bc2efa728b94d3863
SHA512 cb5b395f77bb4ff77a075367d3be6b4a2bb8411521a29af38545aa46889f0ef63c43f63d12f9b95a524f51c854fc530d79aad00c0d3354086dec6ebc8ebcc947
SSDEEP 24576:y+IS1VtKxBrQV/1iydhzE+N+8za4iUrGSaQaHrD1OHpY14Rwa+LT1A5vnQFZLI:y+j1VtRAUhNRaJQanGY14RPSpwvAI
TLSH
T1F2853338C18315806D884132EBF9BF59D9F5D3A4AA2ADFC1B713DC40E2E61C8A539F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2800-0-0x000001ECB4100000-0x000001ECB4120000-memory.dmp

Download

memory/2800-1-0x000001ECB4120000-0x000001ECB4146000-memory.dmp

Download

memory/4076-31-0x0000014C0B650000-0x0000014C0B7F8000-memory.dmp

Download

memory/4076-33-0x0000014C0BE20000-0x0000014C0C223000-memory.dmp

Download

memory/4076-32-0x0000014C0BB10000-0x0000014C0BE12000-memory.dmp

Download

memory/4076-25-0x0000014C09BE0000-0x0000014C09BE1000-memory.dmp

Download

memory/4076-26-0x0000014C09BD0000-0x0000014C09BD4000-memory.dmp

Download