Analysis
- user interaction
yes - max time kernel
149s - max time network
146s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
27/07/2026, 20:04
Behavioral task
behavioral1
Sample
FueagoNeuxs.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
FueagoNeuxs.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Windows Portable 64-bit.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
18 signatures
150 seconds
General
- Target Windows Portable 64-bit.exe
- Size 64KB
- Sample260727-ytmlqa1vgw
- SHA256 4b316291bf9bf7a45f4ddd012151d3157876fdc4a3b818c1729ce13344bf4d98
- MD5 de9d9dc1b09fda4c799103a1da38aeb1
- SHA1 20adcb8af658ce023684f2cf897a5b2ea8086ca2
- SHA512 f65a9e39dfaf614e403603b34728f3a21986ad7923c14779aba8bc972f394476b808d2b620ae722417535c64b714e30d4bbc5b86e39d0ae7cc7530629bb5f9bf
- SSDEEP 768:h44CUqXbw9xotfv6ksfT+OJE5ER1fVqxSs7956tHYVmq7N9XoMOwQP:hnqrwSZsn27Ss7956tHYoLx
- TLSH T1F453E50966ED9422F2BECB7D69B40212C733B4F65535EF9B4DDD90991BA730029C0B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions Windows Portable 64-bit.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions Windows Portable 64-bit.exe - Looks for VMWare Tools registry key 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools Windows Portable 64-bit.exe Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools Windows Portable 64-bit.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Windows Portable 64-bit.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Windows Portable 64-bit.exe - Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Portable 64-bit.lnk Windows Portable 64-bit.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Portable 64-bit.lnk Windows Portable 64-bit.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Portable 64-bit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows Portable 64-bit.exe" Windows Portable 64-bit.exe Set value (str) \REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Portable 64-bit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows Portable 64-bit.exe" Windows Portable 64-bit.exe - Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 17 pastebin.com 18 pastebin.com 19 discord.com 20 discord.com 23 pastebin.com 24 discord.com - Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 Windows Portable 64-bit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Windows Portable 64-bit.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 Windows Portable 64-bit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Windows Portable 64-bit.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1696 cmd.exe 4204 cmd.exe - System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 3240 netsh.exe 4152 netsh.exe - Checks SCSI registry key(s) 3 TTPs 2 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S Windows Portable 64-bit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S Windows Portable 64-bit.exe - Delays execution with timeout.exe 2 IoCs
pid Process 5844 timeout.exe 2124 timeout.exe - Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation Windows Portable 64-bit.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer Windows Portable 64-bit.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName Windows Portable 64-bit.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation Windows Portable 64-bit.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer Windows Portable 64-bit.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName Windows Portable 64-bit.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4356 wmic.exe 4356 wmic.exe 4356 wmic.exe 4356 wmic.exe 2920 Windows Portable 64-bit.exe 1424 wmic.exe 1424 wmic.exe 1424 wmic.exe 1424 wmic.exe 1180 Windows Portable 64-bit.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4356 wmic.exe Token: SeSecurityPrivilege 4356 wmic.exe Token: SeTakeOwnershipPrivilege 4356 wmic.exe Token: SeLoadDriverPrivilege 4356 wmic.exe Token: SeSystemProfilePrivilege 4356 wmic.exe Token: SeSystemtimePrivilege 4356 wmic.exe Token: SeProfSingleProcessPrivilege 4356 wmic.exe Token: SeIncBasePriorityPrivilege 4356 wmic.exe Token: SeCreatePagefilePrivilege 4356 wmic.exe Token: SeBackupPrivilege 4356 wmic.exe Token: SeRestorePrivilege 4356 wmic.exe Token: SeShutdownPrivilege 4356 wmic.exe Token: SeDebugPrivilege 4356 wmic.exe Token: SeSystemEnvironmentPrivilege 4356 wmic.exe Token: SeRemoteShutdownPrivilege 4356 wmic.exe Token: SeUndockPrivilege 4356 wmic.exe Token: SeManageVolumePrivilege 4356 wmic.exe Token: 33 4356 wmic.exe Token: 34 4356 wmic.exe Token: 35 4356 wmic.exe Token: 36 4356 wmic.exe Token: SeIncreaseQuotaPrivilege 4356 wmic.exe Token: SeSecurityPrivilege 4356 wmic.exe Token: SeTakeOwnershipPrivilege 4356 wmic.exe Token: SeLoadDriverPrivilege 4356 wmic.exe Token: SeSystemProfilePrivilege 4356 wmic.exe Token: SeSystemtimePrivilege 4356 wmic.exe Token: SeProfSingleProcessPrivilege 4356 wmic.exe Token: SeIncBasePriorityPrivilege 4356 wmic.exe Token: SeCreatePagefilePrivilege 4356 wmic.exe Token: SeBackupPrivilege 4356 wmic.exe Token: SeRestorePrivilege 4356 wmic.exe Token: SeShutdownPrivilege 4356 wmic.exe Token: SeDebugPrivilege 4356 wmic.exe Token: SeSystemEnvironmentPrivilege 4356 wmic.exe Token: SeRemoteShutdownPrivilege 4356 wmic.exe Token: SeUndockPrivilege 4356 wmic.exe Token: SeManageVolumePrivilege 4356 wmic.exe Token: 33 4356 wmic.exe Token: 34 4356 wmic.exe Token: 35 4356 wmic.exe Token: 36 4356 wmic.exe Token: SeDebugPrivilege 2920 Windows Portable 64-bit.exe Token: SeIncreaseQuotaPrivilege 1424 wmic.exe Token: SeSecurityPrivilege 1424 wmic.exe Token: SeTakeOwnershipPrivilege 1424 wmic.exe Token: SeLoadDriverPrivilege 1424 wmic.exe Token: SeSystemProfilePrivilege 1424 wmic.exe Token: SeSystemtimePrivilege 1424 wmic.exe Token: SeProfSingleProcessPrivilege 1424 wmic.exe Token: SeIncBasePriorityPrivilege 1424 wmic.exe Token: SeCreatePagefilePrivilege 1424 wmic.exe Token: SeBackupPrivilege 1424 wmic.exe Token: SeRestorePrivilege 1424 wmic.exe Token: SeShutdownPrivilege 1424 wmic.exe Token: SeDebugPrivilege 1424 wmic.exe Token: SeSystemEnvironmentPrivilege 1424 wmic.exe Token: SeRemoteShutdownPrivilege 1424 wmic.exe Token: SeUndockPrivilege 1424 wmic.exe Token: SeManageVolumePrivilege 1424 wmic.exe Token: 33 1424 wmic.exe Token: 34 1424 wmic.exe Token: 35 1424 wmic.exe Token: 36 1424 wmic.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2920 wrote to memory of 4356 2920 Windows Portable 64-bit.exe 81 PID 1180 wrote to memory of 1424 1180 Windows Portable 64-bit.exe 86 PID 2920 wrote to memory of 3240 2920 Windows Portable 64-bit.exe 89 PID 1180 wrote to memory of 4152 1180 Windows Portable 64-bit.exe 91 PID 2920 wrote to memory of 1696 2920 Windows Portable 64-bit.exe 94 PID 1696 wrote to memory of 5844 1696 cmd.exe 96 PID 1180 wrote to memory of 4204 1180 Windows Portable 64-bit.exe 97 PID 4204 wrote to memory of 2124 4204 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\Windows Portable 64-bit.exe"C:\Users\Admin\AppData\Local\Temp\Windows Portable 64-bit.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Creates a file in the Startup directory
- Adds Run key to start application
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4356
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" wlan show profiles2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:3240
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fefb044b-4732-49ad-acbf-565b039b8aee.bat""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak3⤵
- Delays execution with timeout.exe
PID:5844
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Portable 64-bit.exe"C:\Users\Admin\AppData\Local\Temp\Windows Portable 64-bit.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Creates a file in the Startup directory
- Adds Run key to start application
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1424
-
-
C:\Windows\system32\netsh.exe"netsh" wlan show profiles2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:4152
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\72b466b9-997b-47f5-a926-64be883a03f2.bat""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak3⤵
- Delays execution with timeout.exe
PID:2124
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Netsh Helper DLL
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\72b466b9-997b-47f5-a926-64be883a03f2.bat
- Size 207B
- SHA256 c966eef0ab9df098a8dd3fe3b46ebb7fb01b72c508f5ad64f68b933e7efc961e
- MD5 787ecadc09645e06228176516eb4543a
- SHA1 79d924541a099469a0fddee89c86e113d568859b
- SHA512 dc1653ece642dd62dde5fc5f185aa7cb324a0bf5952136a10007a5700bfe979d1f52ddd9ff6d8c6af82661e2be37785d79371e55b3fb074ed3cec475e5b2f26d
- TLSH T123D0230351D1879C040C705706BF724D807514C46941B7B14200C02C5DDF41FF59FBC0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\fefb044b-4732-49ad-acbf-565b039b8aee.bat
- Size 207B
- SHA256 3b7d1f5812f07c70b17eca12a3616b7c1981caaa4b7e711ba88274484e94b7a3
- MD5 50240b8e8588bd1e77d5f23c1f4e23a0
- SHA1 164b753a227359157a019b17dc1205aeacec6cab
- SHA512 fdafadb265d44e35da054bdb9828eb7ca9569f69b9875c4af0c2653ddb02b541f38149f6ca8196c71bd6dcc014b914adbccd994e0d9c7e1e9717d27ddc349847
- TLSH T157D0A70252D18B9D04446062057F624E41291484794567911340C41C594F41BA4A7FC0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Portable 64-bit.lnk
- Size 1KB
- SHA256 5379189cf21eefaf3b502418260c1ccef23fcde4454acebcb4aed6483af826ba
- MD5 41349ff2bcb957aa6de19cb143b8b7e7
- SHA1 cd1093a510be11a961d038f9d2afb95c775e4331
- SHA512 caae38df53c9602ffd90f5834c702ddac66a17f35e969d834e98cf743add92513cb2d6e541f9d4347c2ea09b539aea0d8c08bdde0355b5fce018d7f6a49c6966
- TLSH T18E21F9094AD22B26C778B5742AF753966B34FC20F6616F0E8100921D1C28BD6AC4AF1F
- MD5 SHA1 SHA512 TLSH