4c0d2372f3d03a95fae67956989fbc9e307b318c5551f74a48c2b850d55bb169

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 22:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 26.4MB
Sample260724-11hmfsed89
SHA256 4c0d2372f3d03a95fae67956989fbc9e307b318c5551f74a48c2b850d55bb169
MD5 d1bfd06f30b771117de2857d3a9cd0ab
SHA1 36ef1626c84f3c833f8a22073bd744c2678a13c7
SHA512 e5f0c786a44a80629c1bcfe0899008fb06a1247187711b783ac2675ff9852962ea67e0235860ecfce87e1f3bd61b5b6b1caacea04f2c3af87bc54a4fe8db8b7b
SSDEEP 196608:Z7aPC3tUkXLPltLlUJB0HXZ97MM6DJMrEHrcBdoJh34J1VM:Z7aPC3NXLTLlSu7Mx1MrELcBdoP4m
TLSH
T1E1574947F86149E4D0AAD135CA269253BB713C994F3063D72B50FB742F36BE0AA7A344
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
944	powershell.exe
5588	powershell.exe

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4216	netsh.exe
2088	netsh.exe
4156	netsh.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSystemComponent.lnk	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
5412	file.exe
5108	file.exe
1272	file.exe
1904	file.exe
5820	file.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\file.exe"	file.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\RemoteX = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\file.exe"	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RemoteX = "C:\\ProgramData\\Microsoft\\Windows\\file.exe"	file.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	9	Go-http-client/1.1
HTTP User-Agent header	16	Go-http-client/1.1

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5488	schtasks.exe
1508	schtasks.exe
2660	schtasks.exe
1064	schtasks.exe
4464	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3756	file.exe
944	powershell.exe
944	powershell.exe
5588	powershell.exe
5588	powershell.exe
5588	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	944	powershell.exe
Token: SeDebugPrivilege	5588	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3756	file.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 944	3756	file.exe	90
PID 3756 wrote to memory of 5488	3756	file.exe	92
PID 3756 wrote to memory of 1508	3756	file.exe	94
PID 3756 wrote to memory of 2660	3756	file.exe	96
PID 3756 wrote to memory of 4216	3756	file.exe	98
PID 3756 wrote to memory of 5588	3756	file.exe	102
PID 3756 wrote to memory of 2088	3756	file.exe	104
PID 3756 wrote to memory of 4156	3756	file.exe	107
PID 3756 wrote to memory of 1064	3756	file.exe	110
PID 3756 wrote to memory of 4464	3756	file.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NonInteractive -WindowStyle Hidden -NoProfile -Command "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSystemComponent.lnk');$s.TargetPath='C:\Users\Admin\AppData\Local\Microsoft\Windows\file.exe';$s.WindowStyle=7;$s.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:944
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftWindowsManagementClient /tr \"C:\Users\Admin\AppData\Local\Microsoft\Windows\file.exe\" /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5488
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftWindowsManagementClientBoot /tr \"C:\Users\Admin\AppData\Local\Microsoft\Windows\file.exe\" /sc ONSTART /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1508
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftWindowsManagementClientPerf /tr \"C:\Users\Admin\AppData\Local\Microsoft\Windows\file.exe\" /sc MINUTE /mo 5 /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2660
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall delete rule "name=RemoteX Client"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NonInteractive -WindowStyle Hidden -NoProfile -Command "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\WindowsSystemComponent.lnk');$s.TargetPath='C:\ProgramData\Microsoft\Windows\file.exe';$s.WindowStyle=7;$s.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5588
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule "name=RemoteX Client" dir=out action=allow program=C:\Users\Admin\AppData\Local\Temp\file.exe
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2088
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule "name=RemoteX Client In" dir=in action=allow program=C:\Users\Admin\AppData\Local\Temp\file.exe
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4156
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftWindowsManagementClientSystem /tr \"C:\ProgramData\Microsoft\Windows\file.exe\" /sc ONLOGON /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1064
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftWindowsManagementClientSystemBoot /tr \"C:\ProgramData\Microsoft\Windows\file.exe\" /sc ONSTART /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4464

C:\Users\Admin\AppData\Local\Microsoft\Windows\file.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\file.exe
1⤵
- Executes dropped EXE
PID:5412

C:\Users\Admin\AppData\Local\Microsoft\Windows\file.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\file.exe"
1⤵
- Executes dropped EXE
PID:5108

C:\ProgramData\Microsoft\Windows\file.exe
C:\ProgramData\Microsoft\Windows\file.exe
1⤵
- Executes dropped EXE
PID:1272

C:\PROGRA~3\MICROS~1\Windows\file.exe
C:\PROGRA~3\MICROS~1\Windows\file.exe
1⤵
- Executes dropped EXE
PID:1904

C:\ProgramData\Microsoft\Windows\file.exe
"C:\ProgramData\Microsoft\Windows\file.exe"
1⤵
- Executes dropped EXE
PID:5820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9682751b387914c991064e056afd4177f28b1e9e27e6ea1e431e5a2d36333a11
MD5 2412c56d33b9dcb1b262cd1a1b89929d
SHA1 f44dfa9a2240c782954d6ff620b353d40dfd08d4
SHA512 6b03a8418d0a71e7d6f893bdc8ed2ac4fb25545d630677772a616e497a53467596113739327a0d06576d62f4839bb8a1d297b81300fbef7ed0b2fa6ea0367b94
TLSH
T14A115733F3CC8664D89A413650CAAC1136B787DB409EDE9BAB84D559B42F68ACF61160
MD5 SHA1 SHA512 TLSH

Submit Download

file.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\file.exe
Size 26.4MB
SHA256 4c0d2372f3d03a95fae67956989fbc9e307b318c5551f74a48c2b850d55bb169
MD5 d1bfd06f30b771117de2857d3a9cd0ab
SHA1 36ef1626c84f3c833f8a22073bd744c2678a13c7
SHA512 e5f0c786a44a80629c1bcfe0899008fb06a1247187711b783ac2675ff9852962ea67e0235860ecfce87e1f3bd61b5b6b1caacea04f2c3af87bc54a4fe8db8b7b
SSDEEP 196608:Z7aPC3tUkXLPltLlUJB0HXZ97MM6DJMrEHrcBdoJh34J1VM:Z7aPC3NXLTLlSu7Mx1MrELcBdoP4m
TLSH
T1E1574947F86149E4D0AAD135CA269253BB713C994F3063D72B50FB742F36BE0AA7A344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/944-22-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/944-3-0x00007FFFF8E1F000-0x00007FFFF8E20000-memory.dmp

Download

memory/944-7-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/944-8-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/944-9-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/944-10-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/944-11-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/944-12-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/944-13-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/944-14-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/944-15-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/944-18-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/944-19-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/944-6-0x00000163F6B40000-0x00000163F6B62000-memory.dmp

Download

memory/1272-33-0x00007FF7D9AC0000-0x00007FF7DB595000-memory.dmp

Download

memory/1904-37-0x00007FF7D9AC0000-0x00007FF7DB595000-memory.dmp

Download

memory/3756-41-0x00007FF755AB0000-0x00007FF757585000-memory.dmp

Download

memory/3756-43-0x00007FF755AB0000-0x00007FF757585000-memory.dmp

Download

memory/3756-50-0x00007FF755AB0000-0x00007FF757585000-memory.dmp

Download

memory/3756-20-0x00007FF755AB0000-0x00007FF757585000-memory.dmp

Download

memory/3756-49-0x00007FF755AB0000-0x00007FF757585000-memory.dmp

Download

memory/3756-39-0x00007FF755AB0000-0x00007FF757585000-memory.dmp

Download

memory/3756-40-0x00007FF755AB0000-0x00007FF757585000-memory.dmp

Download

memory/3756-48-0x00007FF755AB0000-0x00007FF757585000-memory.dmp

Download

memory/3756-34-0x00007FF755AB0000-0x00007FF757585000-memory.dmp

Download

memory/3756-44-0x00007FF755AB0000-0x00007FF757585000-memory.dmp

Download

memory/3756-42-0x00007FF755AB0000-0x00007FF757585000-memory.dmp

Download

memory/3756-45-0x00007FF755AB0000-0x00007FF757585000-memory.dmp

Download

memory/3756-46-0x00007FF755AB0000-0x00007FF757585000-memory.dmp

Download

memory/3756-47-0x00007FF755AB0000-0x00007FF757585000-memory.dmp

Download

memory/5108-24-0x00007FF64ABD0000-0x00007FF64C6A5000-memory.dmp

Download

memory/5412-2-0x00007FF64ABD0000-0x00007FF64C6A5000-memory.dmp

Download

memory/5820-38-0x00007FF7D9AC0000-0x00007FF7DB595000-memory.dmp

Download