2603c2c4d4538e50d637cecf8c7faaeb84a73bc6d2a58fc37aa6054f44263186

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RedButton.exe
Size 1.1MB
Sample260710-pcfbmsa17q
SHA256 2603c2c4d4538e50d637cecf8c7faaeb84a73bc6d2a58fc37aa6054f44263186
MD5 895f0cfb0263b15d73f0ca7e1206835a
SHA1 4279be03d5f8133793e77d62560c2190baeda207
SHA512 bf77c4b96778d6a7a420511b664ad034b857f8c457625d86e694c2185ecf5d40ed5312c13a3bb221a288fb136aae3650caedc4398642218dab4269adb1e8a1b8
SSDEEP 24576:nnwPI4H0qM7c49oyIreZl+b+bdh0KgaNStdCdUdjtFh9SzQ3j:nCNHRM739oil+wg/trZZpj
TLSH
T1D4352385B6A8E4C6E3B40273BD9250B92D412C6EE3D4562F3F69FFAD71B0251A00E53D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
1340	RedButton.exe
1340	RedButton.exe
1340	RedButton.exe
1340	RedButton.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Pothos\RedButton\Russian.lng	RedButton.exe
File created	C:\Program Files (x86)\Pothos\RedButton\license_eng.txt	RedButton.exe
File created	C:\Program Files (x86)\Pothos\RedButton\license_rus.txt	RedButton.exe
File created	C:\Program Files (x86)\Pothos\RedButton\Uninstall.exe	RedButton.exe
File created	C:\Program Files (x86)\Pothos\RedButton\redbutton.exe	RedButton.exe
File created	C:\Program Files (x86)\Pothos\RedButton\English.lng	RedButton.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RedButton.exe

C:\Users\Admin\AppData\Local\Temp\RedButton.exe
"C:\Users\Admin\AppData\Local\Temp\RedButton.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

redbutton.exe

Path C:\Program Files (x86)\Pothos\RedButton\redbutton.exe
Size 2.5MB
SHA256 176f28605f148650f5ce34a465eed8e3c74111c9579aab9cda31ed1290ac951c
MD5 cd46b91de08f035a2f22a27d5c7a7d76
SHA1 0a91010f86f73f1fb8649eb13714a342f728ec62
SHA512 c83236a4e21b6c0077aa6cd6723d5ffca2b5979429d86752e8c272459de839cb07b645cb5d284524591a9b0baac1b5bcdcb9f6a9db9e765798acd109317c5484
SSDEEP 49152:x44yhkA5vjEbnsAQ0nOShw9woEEZrKTAzSVoWYswkQdtcgs4ENdcP:xHyensAdnOShwnOiSaiw
TLSH
T1F8C5495063F4A125E3B72EB13E79E6944AB3BD694F39DA4F2240751E2936E50DC30B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INetC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqB9A8.tmp\INetC.dll
Size 21KB
SHA256 2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
MD5 2b342079303895c50af8040a91f30f71
SHA1 b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA512 550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
SSDEEP 384:KOoVVefeWsI7rsIquPLNN546o0Ac9khYLMkIX0+Gzyekv:4VVaeE7wIqyJN5i
TLSH
T158A22B5353A01FFEF3E7153878B27B3745A99A6450938A9F07B32D8D2566282BD32342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqB9A8.tmp\InstallOptions.dll
Size 14KB
SHA256 0e014352b64abc431d97460d79757cbafbf6ba997c08b608c294e1f582af269a
MD5 20f3184efe7edddfef3325efc25d12a5
SHA1 8db4c500d73f9525a7e9834df6caea2e70189939
SHA512 433188957a4603c9c61ec698a720021aacf61f46ccc32d5a11bcb6f2d0b1f01e5680635707d8a0ec7a9ef2aa2a85d6dec07ded452e4cb9e280062c0bed555c1a
SSDEEP 192:v4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjWK72dwF7dBOne:wn3T5KdHCMRD/R1cOnrjW+BO
TLSH
T1A4622B55738488F3DBE2043E785237079B995565B4929ED2CA275FC66C3B08D7EB2303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqB9A8.tmp\LangDLL.dll
Size 5KB
SHA256 4e72c8b4d36f128b25281440e59e39af7ec2080d02e024f35ac413d769d91f39
MD5 ea60c7bd5edd6048601729bd31362c16
SHA1 6e6919d969eb61a141595014395b6c3f44139073
SHA512 f9dc35220697153bb06e3a06caf645079881cb75aed008dbe5381ecaf3442d5be03500b36bbca8b3d114845fac3d667ddf4063c16bc35d29bbea862930939993
SSDEEP 48:im1nEhqneMPUptuMMNvimk2BAZuMTRCpYEvJdUJvR0J6of5dwe:F1jpl9NLBAZuYtR0xd
TLSH
T1DDC17537B3C105F5E6954633265363C36713A9747766804FCB6712BA1A208B7DD2EB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsqB9A8.tmp\ioSpecial.ini
Size 681B
SHA256 d31b45fb54aeffb718e188fe25c6917575d95b777edbfc433960dc5d6ab4f437
MD5 11aeb5e673e2da7007ced075ee9527bb
SHA1 a7ed17edab7ca5d2487f1c8b3be42b6527e6ad40
SHA512 1d512a39e9e6c27cbc5a9e7603a5f541f278045cd2040819890b561da750eb85f08e1ed0c3e1f43d94d901e47096fdfeedc41538619770ac42fc23d1d0d15810
TLSH
T17A017B89441FA2684420219668FA37A697E01D3C4B513CF2A0528CC6578C9D78AA99D3
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads