2e274775a98b7ce4a4aa7d5edc74e5e443ea63797f4e83ffecafbc95bb2a2ba1

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 20:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RezX (1).exe
Size 957KB
Sample260711-ysymlact3t
SHA256 2e274775a98b7ce4a4aa7d5edc74e5e443ea63797f4e83ffecafbc95bb2a2ba1
MD5 2dfe9a8a4e9cb84c5571ca841e41bba6
SHA1 73da6735937850b011cbb16f1186a60aca1d1d28
SHA512 8eddba7122df6c31f14e89963718c53af9ce6d7ecc81658bf7d32b0d66a9678e87180506a9237d96a8b169ac06d6a38950f9a7c2ec80ea4c50ac8c0319996d98
SSDEEP 24576:A7rKp9g0rCFuhhO1nGriN4+arlW//flegDGiTWiWnQ1:A7rKpaN+hO1nMi9arlW//flegDGiT/WQ
TLSH
T18B259D4AA2B811ECD47BD178C146921BEB727495132087DB27E4DAA92F63BF1773B301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	RezX (1).exe

Looks for VMWare services registry key. 1 TTPs 1 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	RezX (1).exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4400	RezX (1).exe
4400	RezX (1).exe
4400	RezX (1).exe
4400	RezX (1).exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4400	RezX (1).exe

C:\Users\Admin\AppData\Local\Temp\RezX (1).exe
"C:\Users\Admin\AppData\Local\Temp\RezX (1).exe"
1⤵
- Enumerates VirtualBox registry keys
- Looks for VMWare services registry key.
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 5080f6603915dfa191f8cafc0a4e22dd1a93a7f84fdf468a5a160407f7f26521
MD5 b5c7ab3eb2e40fd7e4d322869e4bd578
SHA1 3371f4a3256aafadfc4fd8d37e88d427468ebb0b
SHA512 7d89e7d7c87d830cc98f4afaeb0a6b512a6a452112ade540760ae228a25c538b07d861c405a9ab002437df3d09e07c61762ba092d997bb394572225a9a648eaa
TLSH
T197E0C2113BA80204E5770B3C6D3364485937772B6E01CACD0734008D0C25F91CD32719
MD5 SHA1 SHA512 TLSH

Submit Download