b6e4bb62094652d1226d00dabc8abfe38e41c2a92b3cc80c34959607c6dd5923

Analysis

user interaction
yes
max time kernel
119s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 23:59

Target
Beg.exe
Size 63.7MB
Sample260802-317yfsthjd
SHA256 b6e4bb62094652d1226d00dabc8abfe38e41c2a92b3cc80c34959607c6dd5923
MD5 657a5cb300e274e2e477f5a33c783522
SHA1 7775f7b04fc73e62b4cf1f60bf685901661c55b3
SHA512 835c1af74ceb3899f9c66ca77629a2b49cfca91315c073eea412d384fc267454b8bf8f348036d86d91508d6f82f8db28ef1a54cae342de13fb9788aaa6866a59
SSDEEP 786432:IpxXiUidVwFej7zBIsQmhiJe+bjVkacXrAB:IpxXiUi/wFevz6sQmhiJe+bhkm
TLSH
T124E7724C24500AE5915BE815EAABCF1B5FE9D6EB4BE8244DBCA88E344CD3CB71D1074B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3440	beg_temp.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3732	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 3440	3632	Beg.exe	92
PID 3440 wrote to memory of 3216	3440	beg_temp.exe	94
PID 3440 wrote to memory of 2684	3440	beg_temp.exe	95
PID 2684 wrote to memory of 1800	2684	cmd.exe	98
PID 3440 wrote to memory of 1912	3440	beg_temp.exe	101
PID 1912 wrote to memory of 3732	1912	cmd.exe	102

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

pid	Process
1800	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Beg.exe
"C:\Users\Admin\AppData\Local\Temp\Beg.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Users\Admin\AppData\Local\Temp\beg_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\beg_temp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title 5669737461
    3⤵
    - Executes a command shell one-liner
    PID:3216
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c attrib -h -s "C:\Users\Admin\AppData\Local\Temp\server.pfx"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Windows\system32\attrib.exe
      attrib -h -s "C:\Users\Admin\AppData\Local\Temp\server.pfx"
      4⤵
      Views/modifies file attributes
      PID:1800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop vgc >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1912
  - - C:\Windows\system32\sc.exe
      sc stop vgc
      4⤵
      Launches sc.exe
      PID:3732