8cea4ffa51b7dabe3beed9c215fff3ff89ffd2bc528f781d0387b9320d6d4064

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GenP-v4.2.0.exe
Size 68.3MB
Sample260718-2fkfzset7r
SHA256 8cea4ffa51b7dabe3beed9c215fff3ff89ffd2bc528f781d0387b9320d6d4064
MD5 5d5d0d22443eacadef375f41b53e7cdc
SHA1 153bf9987525397b7da40afa15d0f845507d579b
SHA512 309b67a3c6c9f35f1327abaa5f10a7524ae349c5640aab86c62316f51f18a05899a01804511f9e8881fbc58467d37b18a77ed76336fa1603e41dcdb5872444ea
SSDEEP 1572864:sg0P08SRlFCoR05lE5ouNNEV2E5xMHeYR9AvXMzBvYv4x0g6Zbq/zC1:s9PAMjEeuNNI2EQ39kXMlAg1S
TLSH
T198F73329A3E502EDFD1BF271CA1BC503E671795223768A4F1678AB366E33271291D370
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4860	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2800	GenP-v4.2.0.exe
2800	GenP-v4.2.0.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2800	GenP-v4.2.0.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 4860	2800	GenP-v4.2.0.exe	84
PID 4860 wrote to memory of 1940	4860	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\GenP-v4.2.0.exe
"C:\Users\Admin\AppData\Local\Temp\GenP-v4.2.0.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -store Root mitmproxy >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Windows\system32\certutil.exe
    certutil -store Root mitmproxy
    3⤵
    PID:1940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

config.ini

Path C:\Users\Admin\AppData\Local\Temp\config.ini
Size 32KB
SHA256 3c8ca5fedddd358b8244d5bd35105c28c5692fb41ff3d6a34d928ba55909fac4
MD5 4a75c56c6eccc89ba13eb4b6819fa223
SHA1 f8908f85465c8dd9af1d87a78f13785430743b70
SHA512 3f28a39e6315fb13810075e2587d9f55e775c0e8e1614ca0686b81c42adeab8d8fc7866144af4cf6972d42f00d25b05ca0907c04170b374bc458ec736736727d
SSDEEP 768:BcnGdBFp3e6hKWLnrbrLQ0xafaOUN0lzjMO8uHfnV51C4GyZ2zm7pZR2:5BFp3e6hKWLnrbrLQ0xMHUatjMO8uHfS
TLSH
T186E2A54F59DF1667E0A1BD4D31F2B8A32F2EB08DD6DE8A81439C013D3A6740961E7D98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download