07441c9b35e0eff5269d89e88d17e28c268421901e73aedbf340b0ac3b321531

Analysis

max time kernel
298s
max time network
299s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nyrex_payload.exe
Size 13.9MB
Sample260715-ezyrdset6x
SHA256 07441c9b35e0eff5269d89e88d17e28c268421901e73aedbf340b0ac3b321531
MD5 adcbd5f5436916a1a80ce347bd4fc0e4
SHA1 344a766b6df3005ac2e5ba0422dbdfe3a5aac0fa
SHA512 66631bbf4cd93de82879274f5f66e9a7d3e32a534ba5a6946c1a077f21fa76809fee3ff07b0ab3be5725fbc429cac207ded888466ec747b222af118244356c46
SSDEEP 196608:AU8cAx54IQa35j50rEJo++M3lIDmT7g9KBZyEdoQZYXBDddB34tbayN:UbiI35j50gVRjHZyT4bac
TLSH
T140E623C3E5CDAFEAD0834666A55303DBA0C0A097EB7B07243DCD4C05F156EE9069BB66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1208	timeout.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
4408	taskkill.exe
4212	taskkill.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1096	nyrex_payload.exe
1096	nyrex_payload.exe
1096	nyrex_payload.exe
1096	nyrex_payload.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4408	taskkill.exe
Token: SeDebugPrivilege	4212	taskkill.exe
Token: SeSystemEnvironmentPrivilege	1096	nyrex_payload.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1096	nyrex_payload.exe
1096	nyrex_payload.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 4292	1096	nyrex_payload.exe	86
PID 1096 wrote to memory of 5796	1096	nyrex_payload.exe	88
PID 5796 wrote to memory of 4408	5796	cmd.exe	90
PID 4292 wrote to memory of 4212	4292	cmd.exe	91
PID 1096 wrote to memory of 2596	1096	nyrex_payload.exe	94
PID 2596 wrote to memory of 1208	2596	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\nyrex_payload.exe
"C:\Users\Admin\AppData\Local\Temp\nyrex_payload.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C taskkill /IM "League of Legends.exe" /F /T
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Windows\system32\taskkill.exe
    taskkill /IM "League of Legends.exe" /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4212
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C taskkill /IM "League of Legends.exe" /F /T
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5796
- - C:\Windows\system32\taskkill.exe
    taskkill /IM "League of Legends.exe" /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4408
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C timeout /t 3 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nyrex_payload.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\system32\timeout.exe
    timeout /t 3
    3⤵
    - Delays execution with timeout.exe
    PID:1208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1096-0-0x00007FF692729000-0x00007FF692E88000-memory.dmp

Download

memory/1096-1-0x00007FFE56E50000-0x00007FFE56E52000-memory.dmp

Download

memory/1096-2-0x00007FFE56E60000-0x00007FFE56E62000-memory.dmp

Download

memory/1096-3-0x00007FFE55420000-0x00007FFE55422000-memory.dmp

Download

memory/1096-4-0x00007FFE55B30000-0x00007FFE55B32000-memory.dmp

Download

memory/1096-5-0x00007FFE54900000-0x00007FFE54902000-memory.dmp

Download

memory/1096-6-0x00007FFE54910000-0x00007FFE54912000-memory.dmp

Download

memory/1096-9-0x00007FF691D00000-0x00007FF693C7D000-memory.dmp

Download

memory/1096-12-0x00000215FB080000-0x00000215FB119000-memory.dmp

Download

memory/1096-13-0x00007FF692729000-0x00007FF692E88000-memory.dmp

Download

memory/1096-14-0x00007FF691D00000-0x00007FF693C7D000-memory.dmp

Download

memory/1096-17-0x00000215FB080000-0x00000215FB119000-memory.dmp

Download

memory/1096-18-0x00007FF691D00000-0x00007FF693C7D000-memory.dmp

Download

memory/1096-19-0x00007FF692729000-0x00007FF692E88000-memory.dmp

Download