Analysis
- user interaction
yes - max time kernel
22s - max time network
22s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
14/07/2026, 04:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
RezX (1).exe
Resource
win10v2004-20260513-en
4 signatures
120 seconds
General
- Target RezX (1).exe
- Size 957KB
- Sample260714-e97gaaev3j
- SHA256 2e274775a98b7ce4a4aa7d5edc74e5e443ea63797f4e83ffecafbc95bb2a2ba1
- MD5 2dfe9a8a4e9cb84c5571ca841e41bba6
- SHA1 73da6735937850b011cbb16f1186a60aca1d1d28
- SHA512 8eddba7122df6c31f14e89963718c53af9ce6d7ecc81658bf7d32b0d66a9678e87180506a9237d96a8b169ac06d6a38950f9a7c2ec80ea4c50ac8c0319996d98
- SSDEEP 24576:A7rKp9g0rCFuhhO1nGriN4+arlW//flegDGiTWiWnQ1:A7rKpaN+hO1nMi9arlW//flegDGiT/WQ
- TLSH T18B259D4AA2B811ECD47BD178C146921BEB727495132087DB27E4DAA92F63BF1773B301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService RezX (1).exe - Looks for VMWare services registry key. 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools RezX (1).exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4264 RezX (1).exe 4264 RezX (1).exe 4264 RezX (1).exe 4264 RezX (1).exe 4264 RezX (1).exe 4264 RezX (1).exe 4264 RezX (1).exe 4264 RezX (1).exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4264 RezX (1).exe