8cea4ffa51b7dabe3beed9c215fff3ff89ffd2bc528f781d0387b9320d6d4064

Analysis

max time kernel
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GenP-v4.2.0.exe
Size 68.3MB
Sample260718-2fkfzset7r
SHA256 8cea4ffa51b7dabe3beed9c215fff3ff89ffd2bc528f781d0387b9320d6d4064
MD5 5d5d0d22443eacadef375f41b53e7cdc
SHA1 153bf9987525397b7da40afa15d0f845507d579b
SHA512 309b67a3c6c9f35f1327abaa5f10a7524ae349c5640aab86c62316f51f18a05899a01804511f9e8881fbc58467d37b18a77ed76336fa1603e41dcdb5872444ea
SSDEEP 1572864:sg0P08SRlFCoR05lE5ouNNEV2E5xMHeYR9AvXMzBvYv4x0g6Zbq/zC1:s9PAMjEeuNNI2EQ39kXMlAg1S
TLSH
T198F73329A3E502EDFD1BF271CA1BC503E671795223768A4F1678AB366E33271291D370
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1188	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2768	GenP-v4.2.0.exe
2768	GenP-v4.2.0.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2768	GenP-v4.2.0.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 1188	2768	GenP-v4.2.0.exe	89
PID 1188 wrote to memory of 4088	1188	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\GenP-v4.2.0.exe
"C:\Users\Admin\AppData\Local\Temp\GenP-v4.2.0.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -store Root mitmproxy >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\Windows\system32\certutil.exe
    certutil -store Root mitmproxy
    3⤵
    PID:4088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

config.ini

Path C:\Users\Admin\AppData\Local\Temp\config.ini
Size 32KB
SHA256 3d834976cb2e544716392b8a3b059650e41c9831c3e5c59d106abbb371416943
MD5 3d6d27e53369e0049f28e3d8ff0a52cc
SHA1 cc283a58a197379ce366f03b4a363693fdcc2435
SHA512 ff8ad82a4dac0204869d593f824dcf3374abf477e6ace9457dec9de31279b74d0d1a343c603546403be9ea49dc564c7a9e75869058b237e22d91c1104b3645b2
SSDEEP 768:BcnGdBFp3e6hKWLnrbrLQ0xafaOUN0lzjMO8uHfnV51C4GyZ2zm7pZRX:5BFp3e6hKWLnrbrLQ0xMHUatjMO8uHfL
TLSH
T155E2A54F59DF1667E0A1BD4D31F2B8A32F2EB08DD6DE8A81439C013D3A6740961E7D98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download