0b7f8d926cef640aea5c0d28eb89d5f64c334ebb1c19b70abc4d1e74b04e7c4c

Analysis

max time kernel
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 17:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GenP-v4.2.1.exe
Size 68.3MB
Sample260730-vv41lstalc
SHA256 0b7f8d926cef640aea5c0d28eb89d5f64c334ebb1c19b70abc4d1e74b04e7c4c
MD5 bd78430acaaea74209e7b8879691bf9e
SHA1 95888f4458ac1d72db67cd33271abb7118b30a65
SHA512 16e5101a92a50ef4e68f28aab4a72899ba6767f83ff5b2add260b91d4371bb751a2b149747c83020ff97d96b0656b23d5f02e1326134c5374c1576f4ff02c7ee
SSDEEP 1572864:CVdsSCuUAOizL2H05lE5ouNNEV2E5xMHeYR9AwXMzBvYv4x0g6Zbq/zCI:7SsAOuLHEeuNNI2EQ393XMlAg1H
TLSH
T122F73319A3A042EEED2BE2768957C50BD772B8422373960F5675677A2F33731681E330
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3368	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1276	GenP-v4.2.1.exe
1276	GenP-v4.2.1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1276	GenP-v4.2.1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1276	GenP-v4.2.1.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 3368	1276	GenP-v4.2.1.exe	89
PID 3368 wrote to memory of 5760	3368	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\GenP-v4.2.1.exe
"C:\Users\Admin\AppData\Local\Temp\GenP-v4.2.1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -store Root mitmproxy >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3368
- - C:\Windows\system32\certutil.exe
    certutil -store Root mitmproxy
    3⤵
    PID:5760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

config.ini

Path C:\Users\Admin\AppData\Local\Temp\config.ini
Size 31KB
SHA256 f80a6bfbb88ca58a8dbf5f68497a9fe0ff7922daf3add0c36eec7e467004e65f
MD5 b53985a9daae7710a2cfdbfa7d693f11
SHA1 dad5e4eedf909c7c369c4009f4f25ffdc81a08f8
SHA512 cb6c273aa0db72dc60df8abf94acacbbcb3d45cdb49d5d83ae08a07779d0b2ddcf1db3989f6f1507e0b8a9d508788a866b2b5475b242235ce15eff61c37b0ce0
SSDEEP 768:5dW2KVpXesVMK46c2GfVj9pOBl0ME4MqfKef+VY43oAfF2OT5KlSU:jKVpXesVMK46c2GfVRgBSz4MqfKef+VA
TLSH
T15FE2A80F99CF1667D1A1BD8E32F2BC931F2EB08DEADA4691538D013D394740562E7DA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1276-31-0x0000022C09640000-0x0000022C09641000-memory.dmp

Download