08926a41e530a492cac242a15813dd3e003532c42804e04370f45d1bc142e19f

Analysis

user interaction
yes
max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 00:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rein.cc.exe
Size 4.3MB
Sample260722-a2yf7aha84
SHA256 08926a41e530a492cac242a15813dd3e003532c42804e04370f45d1bc142e19f
MD5 24e763ee3c2be62dc0340d636d5a2864
SHA1 bd470dccfce1a9578a9086243d2bd0d293648e80
SHA512 68473e5134b17204f2a0d6af0a4346dcc0d181ac136210c9021beeba6ba1da976597a0396bf0740f9ed8a90060d73ccd1fa077e8f6bb0b2f8da1bfaf5810bf3e
SSDEEP 98304:siIfJBXNwZ9IxWnu2j1Eto/Y7mgTm05AwJHE6hmlZqL9PlFq:jIffNwZ9IxWnu2pvg7PAmkzZqL1lFq
TLSH
T18326BE06B395C1A9C1669138CD46D7A7E3717C080F2242EB36D4BE5A3FB36E05E7A742
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 6 IoCs

pid	Process
4608	rein.cc.exe
2208	icsys.icn.exe
2756	explorer.exe
1332	spoolsv.exe
4492	svchost.exe
4560	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	rein.cc.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5244	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rein.cc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4872	rein.cc.exe
4872	rein.cc.exe
4872	rein.cc.exe
4872	rein.cc.exe
4872	rein.cc.exe
4872	rein.cc.exe
4872	rein.cc.exe
4872	rein.cc.exe
4872	rein.cc.exe
4872	rein.cc.exe
4872	rein.cc.exe
4872	rein.cc.exe
4872	rein.cc.exe
4872	rein.cc.exe
4872	rein.cc.exe
4872	rein.cc.exe
4872	rein.cc.exe
4872	rein.cc.exe
4872	rein.cc.exe
4872	rein.cc.exe
4872	rein.cc.exe
4872	rein.cc.exe
4872	rein.cc.exe
4872	rein.cc.exe
4872	rein.cc.exe
4872	rein.cc.exe
4872	rein.cc.exe
4872	rein.cc.exe
4872	rein.cc.exe
4872	rein.cc.exe
4872	rein.cc.exe
4872	rein.cc.exe
2208	icsys.icn.exe
2208	icsys.icn.exe
2208	icsys.icn.exe
2208	icsys.icn.exe
2208	icsys.icn.exe
2208	icsys.icn.exe
2208	icsys.icn.exe
2208	icsys.icn.exe
2208	icsys.icn.exe
2208	icsys.icn.exe
2208	icsys.icn.exe
2208	icsys.icn.exe
2208	icsys.icn.exe
2208	icsys.icn.exe
2208	icsys.icn.exe
2208	icsys.icn.exe
2208	icsys.icn.exe
2208	icsys.icn.exe
2208	icsys.icn.exe
2208	icsys.icn.exe
2208	icsys.icn.exe
2208	icsys.icn.exe
2208	icsys.icn.exe
2208	icsys.icn.exe
2208	icsys.icn.exe
2208	icsys.icn.exe
2208	icsys.icn.exe
2208	icsys.icn.exe
2208	icsys.icn.exe
2208	icsys.icn.exe
2208	icsys.icn.exe
2208	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2756	explorer.exe
4492	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4872	rein.cc.exe
4872	rein.cc.exe
2208	icsys.icn.exe
2208	icsys.icn.exe
2756	explorer.exe
2756	explorer.exe
1332	spoolsv.exe
1332	spoolsv.exe
4492	svchost.exe
4492	svchost.exe
4560	spoolsv.exe
4560	spoolsv.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 4608	4872	rein.cc.exe	89
PID 4872 wrote to memory of 2208	4872	rein.cc.exe	91
PID 4608 wrote to memory of 5244	4608	rein.cc.exe	92
PID 5244 wrote to memory of 2496	5244	cmd.exe	93
PID 5244 wrote to memory of 4244	5244	cmd.exe	94
PID 5244 wrote to memory of 5744	5244	cmd.exe	95
PID 2208 wrote to memory of 2756	2208	icsys.icn.exe	96
PID 2756 wrote to memory of 1332	2756	explorer.exe	97
PID 1332 wrote to memory of 4492	1332	spoolsv.exe	98
PID 4492 wrote to memory of 4560	4492	svchost.exe	99

C:\Users\Admin\AppData\Local\Temp\rein.cc.exe
"C:\Users\Admin\AppData\Local\Temp\rein.cc.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4872
- \??\c:\users\admin\appdata\local\temp\rein.cc.exe
  c:\users\admin\appdata\local\temp\rein.cc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c certutil -hashfile "c:\users\admin\appdata\local\temp\rein.cc.exe " MD5 | find /i /v "md5" | find /i /v "certutil"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5244
  - - C:\Windows\system32\certutil.exe
      certutil -hashfile "c:\users\admin\appdata\local\temp\rein.cc.exe " MD5
      4⤵
      PID:2496
  - - C:\Windows\system32\find.exe
      find /i /v "md5"
      4⤵
      PID:4244
  - - C:\Windows\system32\find.exe
      find /i /v "certutil"
      4⤵
      PID:5744
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2208
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1332
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visibility of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4492
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4560

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rein.cc.exe

Path C:\Users\Admin\AppData\Local\Temp\rein.cc.exe
Size 4.2MB
SHA256 5df919452e1d661dd46ca0ef4959c10eaa1a514bc4a5b785f8c36b79d2993b77
MD5 f8f7669a5bf6522b3e400309d056285a
SHA1 a4d19bd1e6779ce0d5d9ce28e3b32af17a7569ef
SHA512 ecbaef98034ace3a07cc48b3bbeec4c22a5ae69b0acba6f76e56b7545901f1b0ae10bf6c23ea3f76fe0b434d5d4ed17c7f0745eedfa7b0a07039184bad801f57
SSDEEP 98304:JiIfJBXNwZ9IxWnu2j1Eto/Y7mgTm05AwJHE6hmlZqL9PlF:oIffNwZ9IxWnu2pvg7PAmkzZqL1lF
TLSH
T17516BE06B395C1A9C1669138CD46D7A7E3727C084F2243EB36D4BA5A3FB36E05E3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Windows\Resources\Themes\explorer.exe
Size 135KB
SHA256 7f1aa78613702630e647857d059824d56bd7752190339efb68983b0db2fb141c
MD5 5ce2c60228dc7bf9b0bd771a11676bfa
SHA1 8a93ee0a00cc999c29f7ec723e0087c143cc6872
SHA512 ab0adab4badf05e8e9fa3159418c76e66c560b6447affdd0a458937b213676d2ecee21e93389e9c54eff34b1b1d444e44065b14f07c0321f3cceb0d5812a89f3
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXd:UVqoCl/YgjxEufVU0TbTyDDalRd
TLSH
T127D329136E14942FD9618AF06CF5D76ABA226E321FE5BE07725ABB01693210370F531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Windows\Resources\Themes\icsys.icn.exe
Size 135KB
SHA256 518a6a6f6ae47b91762ff6d471450ae2780aa0af4729a4a4fa5f37c01849c43c
MD5 fa79a0bf98df1176f560b38584ac9dc3
SHA1 ef5e3753db0c9e52ecfd3671fac298a5dcfb831a
SHA512 3abf7902c8c8a88b97471701c7726db1d3103fd7107aa6d26aae4dd605c363881d7595be160c8bb3c9cf9b13565c10fa2c3ef108c969e6323c9f44175b698972
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXw:UVqoCl/YgjxEufVU0TbTyDDalRw
TLSH
T128D329277E10442ED86289F07869D65DFEE01E3A1BA6ED0772A2BB003575647B2F130F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\Resources\spoolsv.exe
Size 135KB
SHA256 51eb8d90ee1645e19384b518dd68488acc9a91c1677258ac47efe3a23e6ad08f
MD5 0a0fe6e5fb571b50ea9b0d2d0b1198bc
SHA1 4e9dae6c0ba814b4f9482802d1380e5ae2052084
SHA512 aa071fde7cdb4953b58fbb54a8d32ef7fbaf3f553331f2a80ac16b6ccbcffe20c82ef6bc861aa3d4478facf9755a5b6e6e2d355c2c7ef4f67de012b3a6d18caf
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXd:UVqoCl/YgjxEufVU0TbTyDDalRd
TLSH
T1B0D3F823AD90502FE82289F224B4E77EB9521E361FE0AD477656BB107671643F1F221F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\Resources\svchost.exe
Size 135KB
SHA256 14d3876aaeb9e39808b1f50718a81be35f9632c68c6a1c7d042b92975719e63a
MD5 a0ce5a62deca7c5961cc48917e712710
SHA1 97bdb8ab48711e869670869e9720d17ef49492b0
SHA512 9331b7c5232b782a6d4a29d99bf08e89d87f06a870f27ec4b5ce81096b1f7db75cbcc669dae46705e95ca252327124226d737f3331ce656bde796b7806e39fd7
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXe:UVqoCl/YgjxEufVU0TbTyDDalRe
TLSH
T10BD307137E50102BC816CAF07865D66EB9210E321BE1AD0773A7BF60BAB624775F521F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1332-53-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2208-54-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2756-56-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4492-57-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4560-52-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4872-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4872-55-0x0000000000400000-0x000000000041F000-memory.dmp

Download