2e274775a98b7ce4a4aa7d5edc74e5e443ea63797f4e83ffecafbc95bb2a2ba1

Resubmissions

14/07/2026, 04:39

260714-e97gaaev3j9

14/07/2026, 04:38

260714-e9plgagw9t9

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RezX (1).exe
Size 957KB
Sample260714-e9plgagw9t
SHA256 2e274775a98b7ce4a4aa7d5edc74e5e443ea63797f4e83ffecafbc95bb2a2ba1
MD5 2dfe9a8a4e9cb84c5571ca841e41bba6
SHA1 73da6735937850b011cbb16f1186a60aca1d1d28
SHA512 8eddba7122df6c31f14e89963718c53af9ce6d7ecc81658bf7d32b0d66a9678e87180506a9237d96a8b169ac06d6a38950f9a7c2ec80ea4c50ac8c0319996d98
SSDEEP 24576:A7rKp9g0rCFuhhO1nGriN4+arlW//flegDGiTWiWnQ1:A7rKpaN+hO1nMi9arlW//flegDGiT/WQ
TLSH
T18B259D4AA2B811ECD47BD178C146921BEB727495132087DB27E4DAA92F63BF1773B301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	RezX (1).exe

Looks for VMWare services registry key. 1 TTPs 1 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	RezX (1).exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2360	RezX (1).exe
2360	RezX (1).exe
2360	RezX (1).exe
2360	RezX (1).exe
2360	RezX (1).exe
2360	RezX (1).exe
2360	RezX (1).exe
2360	RezX (1).exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2360	RezX (1).exe

C:\Users\Admin\AppData\Local\Temp\RezX (1).exe
"C:\Users\Admin\AppData\Local\Temp\RezX (1).exe"
1⤵
- Enumerates VirtualBox registry keys
- Looks for VMWare services registry key.
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads