2603c2c4d4538e50d637cecf8c7faaeb84a73bc6d2a58fc37aa6054f44263186

Analysis

max time kernel
148s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RedButton.exe
Size 1.1MB
Sample260710-pcqsdacv6t
SHA256 2603c2c4d4538e50d637cecf8c7faaeb84a73bc6d2a58fc37aa6054f44263186
MD5 895f0cfb0263b15d73f0ca7e1206835a
SHA1 4279be03d5f8133793e77d62560c2190baeda207
SHA512 bf77c4b96778d6a7a420511b664ad034b857f8c457625d86e694c2185ecf5d40ed5312c13a3bb221a288fb136aae3650caedc4398642218dab4269adb1e8a1b8
SSDEEP 24576:nnwPI4H0qM7c49oyIreZl+b+bdh0KgaNStdCdUdjtFh9SzQ3j:nCNHRM739oil+wg/trZZpj
TLSH
T1D4352385B6A8E4C6E3B40273BD9250B92D412C6EE3D4562F3F69FFAD71B0251A00E53D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
2012	RedButton.exe
2012	RedButton.exe
2012	RedButton.exe
2012	RedButton.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Pothos\RedButton\Uninstall.exe	RedButton.exe
File created	C:\Program Files (x86)\Pothos\RedButton\redbutton.exe	RedButton.exe
File created	C:\Program Files (x86)\Pothos\RedButton\English.lng	RedButton.exe
File created	C:\Program Files (x86)\Pothos\RedButton\Russian.lng	RedButton.exe
File created	C:\Program Files (x86)\Pothos\RedButton\license_eng.txt	RedButton.exe
File created	C:\Program Files (x86)\Pothos\RedButton\license_rus.txt	RedButton.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RedButton.exe

C:\Users\Admin\AppData\Local\Temp\RedButton.exe
"C:\Users\Admin\AppData\Local\Temp\RedButton.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

redbutton.exe

Path C:\Program Files (x86)\Pothos\RedButton\redbutton.exe
Size 2.5MB
SHA256 176f28605f148650f5ce34a465eed8e3c74111c9579aab9cda31ed1290ac951c
MD5 cd46b91de08f035a2f22a27d5c7a7d76
SHA1 0a91010f86f73f1fb8649eb13714a342f728ec62
SHA512 c83236a4e21b6c0077aa6cd6723d5ffca2b5979429d86752e8c272459de839cb07b645cb5d284524591a9b0baac1b5bcdcb9f6a9db9e765798acd109317c5484
SSDEEP 49152:x44yhkA5vjEbnsAQ0nOShw9woEEZrKTAzSVoWYswkQdtcgs4ENdcP:xHyensAdnOShwnOiSaiw
TLSH
T1F8C5495063F4A125E3B72EB13E79E6944AB3BD694F39DA4F2240751E2936E50DC30B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INetC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw79BC.tmp\INetC.dll
Size 21KB
SHA256 2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
MD5 2b342079303895c50af8040a91f30f71
SHA1 b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA512 550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
SSDEEP 384:KOoVVefeWsI7rsIquPLNN546o0Ac9khYLMkIX0+Gzyekv:4VVaeE7wIqyJN5i
TLSH
T158A22B5353A01FFEF3E7153878B27B3745A99A6450938A9F07B32D8D2566282BD32342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw79BC.tmp\InstallOptions.dll
Size 14KB
SHA256 0e014352b64abc431d97460d79757cbafbf6ba997c08b608c294e1f582af269a
MD5 20f3184efe7edddfef3325efc25d12a5
SHA1 8db4c500d73f9525a7e9834df6caea2e70189939
SHA512 433188957a4603c9c61ec698a720021aacf61f46ccc32d5a11bcb6f2d0b1f01e5680635707d8a0ec7a9ef2aa2a85d6dec07ded452e4cb9e280062c0bed555c1a
SSDEEP 192:v4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjWK72dwF7dBOne:wn3T5KdHCMRD/R1cOnrjW+BO
TLSH
T1A4622B55738488F3DBE2043E785237079B995565B4929ED2CA275FC66C3B08D7EB2303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw79BC.tmp\LangDLL.dll
Size 5KB
SHA256 4e72c8b4d36f128b25281440e59e39af7ec2080d02e024f35ac413d769d91f39
MD5 ea60c7bd5edd6048601729bd31362c16
SHA1 6e6919d969eb61a141595014395b6c3f44139073
SHA512 f9dc35220697153bb06e3a06caf645079881cb75aed008dbe5381ecaf3442d5be03500b36bbca8b3d114845fac3d667ddf4063c16bc35d29bbea862930939993
SSDEEP 48:im1nEhqneMPUptuMMNvimk2BAZuMTRCpYEvJdUJvR0J6of5dwe:F1jpl9NLBAZuYtR0xd
TLSH
T1DDC17537B3C105F5E6954633265363C36713A9747766804FCB6712BA1A208B7DD2EB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsw79BC.tmp\ioSpecial.ini
Size 681B
SHA256 3e55bb4915c1fb8e88f0e90a74faebe870a8e94f6638a33250ebe65a0ea6f387
MD5 525e3a016669c1464f5def0a44416892
SHA1 7f8516964976e9287a9b9e402f6fb8ea35d89fc5
SHA512 53b00894fa12f08df8f940448ab3b8f137915c4a606b34f4d7f6af6271a65e653bb1164be0810958bac538b459adf8cfc71565902f2cb5ddcd19c92d858ca317
TLSH
T1D5017B89441FA3684460219668FA37A687E02D3C4B513CF6A052CCC6978CDD78AE9AD3
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsw79BC.tmp\ioSpecial.ini
Size 720B
SHA256 e6fbfc81e5cc5b8925da253f2faa4c1b11c80edd8e0f83d2feb2f123544b27e4
MD5 270094f98be42a64ca1781ef3975250e
SHA1 89726b2c19770dfb4db4ca21a3c482125a542685
SHA512 6dd72d5f08ea8e7e61566dd5619aecee61470978084509eb41a13f09324bd6b58dbb342f1640d3fe1adfc1f9fde95ef381e0640060c52d1d100ca8c8d0e54bd8
TLSH
T143019C89441FD3A84420109664FA379697E01D3C47523CF1E012C8C6538CDD78AA89D7
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads