27db524e45cbdba4ef9be81e5520f9e02609eedc629751f89cd72d0b343c6c26

Analysis

max time kernel
149s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RC7.exe
Size 3.9MB
Sample260801-ry3eeabh78
SHA256 27db524e45cbdba4ef9be81e5520f9e02609eedc629751f89cd72d0b343c6c26
MD5 645b94e9d5f3fbf970fd3fadaa9c81aa
SHA1 1560403af14115227508e5d9d3a1747f8a92b7dd
SHA512 ae6ffe1abd8c793a9d94305efbeae156b864344e8ff1ffb5b82ec2979338cca5a9b323878ec7bb7cd8e8757ab06d4fb1b47f318f9d5a673decea7e219203c810
SSDEEP 98304:/1ARbTy2dO9CX8LS9Q8aTKeuq9qXyBqspyomAHkqi:/KbTt8u9QfTJqXUqs8oxg
TLSH
T17C1601E8F9C6D9C2C676B4F79830217C551E8DBDAB16030322B07E78257229BCE5D58E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Downloads MZ/PE file 6 IoCs

flow	pid	Process
8	4292	RC7.exe
8	4292	RC7.exe
8	4292	RC7.exe
8	4292	RC7.exe
8	4292	RC7.exe
8	4292	RC7.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	RC7.exe

Loads dropped DLL 6 IoCs

pid	Process
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
8	raw.githubusercontent.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1720	cmd.exe

Delays execution with timeout.exe 7 IoCs

defense_evasion

pid	Process
2500	timeout.exe
4960	timeout.exe
3664	timeout.exe
4564	timeout.exe
692	timeout.exe
2024	timeout.exe
1004	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	RC7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	RC7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RC7.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe
4292	RC7.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4292	RC7.exe
Token: SeRestorePrivilege	3936	7z.exe
Token: 35	3936	7z.exe
Token: SeSecurityPrivilege	3936	7z.exe
Token: SeSecurityPrivilege	3936	7z.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 4780	4292	RC7.exe	89
PID 4780 wrote to memory of 3412	4780	csc.exe	91
PID 4292 wrote to memory of 1720	4292	RC7.exe	92
PID 1720 wrote to memory of 2904	1720	cmd.exe	94
PID 1720 wrote to memory of 1196	1720	cmd.exe	95
PID 1720 wrote to memory of 2024	1720	cmd.exe	96
PID 1720 wrote to memory of 1004	1720	cmd.exe	97
PID 1720 wrote to memory of 2500	1720	cmd.exe	98
PID 1720 wrote to memory of 4960	1720	cmd.exe	99
PID 1720 wrote to memory of 3664	1720	cmd.exe	100
PID 1720 wrote to memory of 4564	1720	cmd.exe	101
PID 1720 wrote to memory of 692	1720	cmd.exe	102
PID 4292 wrote to memory of 3936	4292	RC7.exe	104

C:\Users\Admin\AppData\Local\Temp\RC7.exe
"C:\Users\Admin\AppData\Local\Temp\RC7.exe"
1⤵
- Downloads MZ/PE file
- Checks BIOS information in registry
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\RC7.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_d4c9a9fa66c24a289d2ea4df297023a4.cs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES18CE.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB6D4250AF15A492C91E850AA946595C.TMP"
    3⤵
    PID:3412
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\rc7_bootstrap.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\system32\mode.com
    mode con: cols=80 lines=25
    3⤵
    PID:2904
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1196
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2024
- - C:\Windows\system32\timeout.exe
    timeout /t 3 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1004
- - C:\Windows\system32\timeout.exe
    timeout /t 8 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2500
- - C:\Windows\system32\timeout.exe
    timeout /t 6 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4960
- - C:\Windows\system32\timeout.exe
    timeout /t 3 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3664
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4564
- - C:\Windows\system32\timeout.exe
    timeout /t 3 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:692
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" x "C:\RC7\Old Scripts\old scripts.rar" -o"C:\RC7\Old Scripts" -y
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ganexius.txt

Path C:\RC7\Old Scripts\Ganexius.txt
Size 71KB
SHA256 d30bc6463d50d46166ea6e6679f9ca276fdde059794c33d18b21873774393a78
MD5 327845505d8bdc80dd7a3ac639edc9df
SHA1 ebdd6b22b6422fc9eb313de7ec8828decdfcefb1
SHA512 53a6a2a26f12e3c25bbf711f3306a871e45c2acd13fbea086ad58dcb4174577bd0bc2aa33f56d70246ffe92985fd97423d06f4b41bc4ecea7a4fa63d4bd564ec
SSDEEP 768:44LtoWL0XkA+5oYf8g8/LL4oCJixsZNdaocU2PnUmxGoJ4YVOuqm4RVctkYWgqY8:428XnYf8g8TLyfi2ewMKNz6zcL
TLSH
T1B073B94EB7CD01B549DFEA3818772C42BE7BE023257A18CD72EC5045AF9890C64F5A9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Grasp Of Midas.txt

Path C:\RC7\Old Scripts\Grasp Of Midas.txt
Size 66KB
SHA256 ed1e298aa8835e431cde732523b36343ba20a4545c0df9d4635894367e1fff0e
MD5 269ef8f46cfaab611f13473816d5fac0
SHA1 8afa006e837fdb65efb0f059b38e1830b914fa1a
SHA512 5da22152ab1f6527ad8295578970ce903768d78dcfecf7b2cd8ab452024f8ecb2da2e58d304f6723679e257307cf76aaa270d2d25e55136d0db19c79f7533f90
SSDEEP 1536:WdpXGRYf8g8UOovnEAMkgvCYwmqmRjbHruAWT3K5Vc8b20tjtgq:WdpXGRYf8g88vnEAfgvCYwmqmRjbHru4
TLSH
T1FF634529278710B345DA7734180A39125E66B4472F3B8EABB2CC00CC7B1F95C72ADF5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hyacintho Flamma Poenos.txt

Path C:\RC7\Old Scripts\Hyacintho Flamma Poenos.txt
Size 55KB
SHA256 5ae9db582a380a391dd7aed62d105ec53f59d4952b04fcb2bc175e90bfed3a13
MD5 1c86f847a82e8e13a4bcc788df616c97
SHA1 3be133e773cfb31c57deca26ee1dab257276dab3
SHA512 3d515332c7bbe269fdb2b6da529b8e2e550c979502685a7d81e6ff9646612cae3da013361555fa9789d57301fe0e8a315009c9f6ee6933c767d0851a6c74af80
SSDEEP 768:W4LtrZL0Xcr0xBEqIZx9oYf8g8c1CMzN5UZeTKVrTbgk7mAEfvOFj6S6vN9Z+E93:W2SXnRYf8g8pMzNzsegapx
TLSH
T1F843822E239201F29997F73C08573D0759A2B4533BBB4E9EB2CC10CABF2E45C7564A19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

old scripts.rar

Path C:\RC7\Old Scripts\old scripts.rar
Size 4.4MB
SHA256 8743f48444bf0576a9ea904599c2476b0f0ffd613a0b7a9890666f1f1e46ba73
MD5 b041776070636e30ba523819a02e2519
SHA1 93385f0b1990e0f96880f428cf636a46a8d29d24
SHA512 194eebc3de338bcd6652a6cece29ff39b7908959e2921252f51e9e36e44ad866357262c094119f0a72ec6fe1970f04d569547b59c42648f5cc631a48a394d8e4
SSDEEP 98304:xRRK9O+5K11csayBF5/croXY1sbe1qAwlbQ2O+vam/FqojuRAEuSOkZxJsezlS7l:LEsKUcqBF5c8FeQAwZskDWpoknFzlS+I
TLSH
T10026331FBEA4AA10103697A0E0210E3D77FAD7435EB2F17F617B04C8B52D5ED64A85AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES18CE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES18CE.tmp
Size 1KB
SHA256 f86da196e05c0dd3d849127f8046a1126828b9fd1fc1374a1b83e27a3bc2ac6b
MD5 2371c5c516c37540e40d6f0415af6fa5
SHA1 078b23f87e76fbc19e53f4a8fd06800b8cb4478c
SHA512 ab2512e8f954675b14b4143af8f9c133dcb60ae1867416f535b24573b137560281864c285b4d1f89401db8c930c35de202e94a3d614157734b4a58a27f486984
TLSH
T10A413F8093D88B1FE17243312CF7972AA674FE51AE9E475DB588123E1E02740DEC32B1
MD5 SHA1 SHA512 TLSH

Submit Download

rc7_bootstrap.bat

Path C:\Users\Admin\AppData\Local\Temp\rc7_bootstrap.bat
Size 3KB
SHA256 c9b5b796c6effd6b0c8823fcb01e9527e4e9d1af3e8d6ce9b9b4ad6aa7af2d56
MD5 20088bcd38543121aff202343f686d7b
SHA1 9236c775d980138c5201744197230b4f3cf55932
SHA512 ee1a77a244998673de367626ba82f92dd216dc7bb31ef87698dfe2cea197a3a5e786930cd28fcb26293be3656d7bc3a214fe05c218bd7ad7e05006b431fe8f72
TLSH
T16771F805ACDD7845BEEB5A521A2ADC28B20BC19F9DF5154EBCDE0B116F013E198D33B2
MD5 SHA1 SHA512 TLSH

Submit Download

libcrypto-3-x64.dll

Path C:\Users\Admin\AppData\Local\Xeno\nk\libcrypto-3-x64.dll
Size 7.1MB
SHA256 16e85806333aa3b3a4fe8c31c9402b78ee01a4a143e9031db165c48386dd6289
MD5 b47c9988a203a596803837c128853517
SHA1 2f669bf535dde5727989da919ffa5c36cf9d78e2
SHA512 24874b5902785cea67d3781e59471e6b8fb8c9d9e6e33e8c894745eb4324bfa1ab123ff2809269e1a7b2eb604343efe556183479c0e0d30214dec252c31fb69b
SSDEEP 196608:uHhm399Xki0GiR/8yGX26ui1CPwDvt3uFOxC:uHhm399XkifiR/8rGfi1CPwDvt3uFoC
TLSH
T164767BADA67C0109E8AA81BDC2979327D771B91957F013CF186196F80F23FD92B7A740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl.dll

Path C:\Users\Admin\AppData\Local\Xeno\nk\libcurl.dll
Size 637KB
SHA256 8645f1b6bec48f061e54941ec1d9c5e4b8096ce1a80d8ea0a0353e4cb557f8f5
MD5 8c14feded4b94c4b72af1f710f236778
SHA1 62dd8f17cff9916faa792a8188f8e82ed6edf9c8
SHA512 c0222d788aef2be7eb205f923302a79b59ec6018210944cf6d807b073fcd2c08182f42e4a1766b7e42e190ac4ebb090f6afe026a52e5bb11f585db180bbe0fc8
SSDEEP 12288:EzbJ84IyhxblduSGHhphyfiuEkatR5YI80OdnmqKENG:EzbJ84pjbWSGHz1uEkatR5YI80Odnmqt
TLSH
T13CD46C56B3F414A9D1A7C17CC6538227E3B2B0542361A7DB12B4CBBA6F13BE2573A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3-x64.dll

Path C:\Users\Admin\AppData\Local\Xeno\nk\libssl-3-x64.dll
Size 1.4MB
SHA256 bfc059e16951fa90cc14489a8263f35c6703e762f2f5413682b4f7935bbced57
MD5 754fff93ed112eb26bd4a6b0e8300deb
SHA1 de9edf5c9ac80b1f26dcc91d89791065097a7d23
SHA512 05d215d1e0cd65a98cf55a2a5e123992e5719006eb346261c0c03a629cfe2cde910765a1a87a3f5a93d2371ea9c15d677277b903d55c24731bcc7c7eed87a71a
SSDEEP 24576:CV6b+rLptrBSFH+tK8olR+WmXWdEVB36eVE:CV6bedt9UlIzWdEVB3a
TLSH
T1F1656CAAA7B8019CD5B6C17CC2934B23D2B6F4162370A7DF0A658A781F63BD5173D384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

niggakernel.dll

Path C:\Users\Admin\AppData\Local\Xeno\nk\niggakernel.dll
Size 2.3MB
SHA256 f53ca2efa3f4151d06c1f37be14c3eba756a5fd895ba2e526d2738341631492c
MD5 4a407ed81fe4c2c37d1207aa4e9238be
SHA1 7f6a82eea3c72d9109a489ae73e7d4a7ec75d971
SHA512 0aaed3feb6b903d31bb400b3575bb349f080d525e6cfd167a42661fa9f11f9d89d68879b48fb5acd4fc2a92127857f8bc8f63df601f07056ba548b0c7008f075
SSDEEP 49152:zNL3nuCfjyJDh8sa3QrOps5DA4eSewD4W9NSABjt:zUa6C9OV
TLSH
T1C9B58E17A69901ECD076D1F88A5B5513E7B17C4903316BEB02E0B9652F23AF68F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Xeno\nk\zlib1.dll
Size 88KB
SHA256 f6b58fdde3bfef2c25c7254fadfed12d86d81c4a5c962262715868c48063fc76
MD5 68cf6f98cb8b227814a59ff3f909a0af
SHA1 0383a4d7a74417d3ec90526e61b7637256e0bb57
SHA512 b59f9eeededd1f76f048b57ae753f79227aead32006fc649532a9bae3f441515bab85338d25b26e5002c54c65d661c0c3048f5c3c1ded6274638ee950afb4744
SSDEEP 1536:QvkS6XmTzqbKxfXOTBpp/foyUaDmjGI23aIOcIOZhhkxBJNJ5:PdXozwBppnqG3oSZfkxBJNJ5
TLSH
T1C5936B4AAAB412A5D6F78178D8D207ADC331701407A44BDF9648A7691F23BE41F363FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCB6D4250AF15A492C91E850AA946595C.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCB6D4250AF15A492C91E850AA946595C.TMP
Size 1KB
SHA256 c5a26f6a0d43de04bf54c9c20124122ae3144612d48f0d5d717b0bf220358a71
MD5 1d66def419746113613ea26894ce6f5f
SHA1 447d5e984952363429bac950cee78a06c6b82cc4
SHA512 cdfa2e79d03ee0788fca490c0affde48e33b6979a79b11dc1abb6526331af95d92d38a4ee182a4db7a68e4ef47a9c2d5a71d5aee03c42bf178e959ed6705d9f5
TLSH
T18921AB81A2E8421EF2B3477079F283639169BE668D7E43EC7488175F1B1660085936B1
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_d4c9a9fa66c24a289d2ea4df297023a4.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_d4c9a9fa66c24a289d2ea4df297023a4.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4292-19-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp

Download

memory/4292-1394-0x0000000003340000-0x0000000003348000-memory.dmp

Download

memory/4292-65-0x0000000003310000-0x0000000003322000-memory.dmp

Download

memory/4292-18-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp

Download

memory/4292-15-0x00000000014B0000-0x00000000014BA000-memory.dmp

Download

memory/4292-6-0x000000001CA50000-0x000000001CD22000-memory.dmp

Download

memory/4292-7-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp

Download

memory/4292-0-0x00007FFAFD4FF000-0x00007FFAFD500000-memory.dmp

Download

memory/4292-1395-0x000000001FAD0000-0x000000001FCE2000-memory.dmp

Download

memory/4292-5-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp

Download

memory/4292-4-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp

Download

memory/4292-3-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp

Download

memory/4292-2-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp

Download

memory/4292-1-0x00000000005D0000-0x00000000009C4000-memory.dmp

Download

memory/4292-1421-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp

Download