b6e4bb62094652d1226d00dabc8abfe38e41c2a92b3cc80c34959607c6dd5923

Analysis

user interaction
yes
max time kernel
171s
max time network
173s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
03/08/2026, 01:24

Target
Beg.exe
Size 63.7MB
Sample260803-bsdabswbkc
SHA256 b6e4bb62094652d1226d00dabc8abfe38e41c2a92b3cc80c34959607c6dd5923
MD5 657a5cb300e274e2e477f5a33c783522
SHA1 7775f7b04fc73e62b4cf1f60bf685901661c55b3
SHA512 835c1af74ceb3899f9c66ca77629a2b49cfca91315c073eea412d384fc267454b8bf8f348036d86d91508d6f82f8db28ef1a54cae342de13fb9788aaa6866a59
SSDEEP 786432:IpxXiUidVwFej7zBIsQmhiJe+bjVkacXrAB:IpxXiUi/wFevz6sQmhiJe+bhkm
TLSH
T124E7724C24500AE5915BE815EAABCF1B5FE9D6EB4BE8244DBCA88E344CD3CB71D1074B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1428	beg_temp.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3332	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 1428	4404	Beg.exe	84
PID 1428 wrote to memory of 4600	1428	beg_temp.exe	86
PID 1428 wrote to memory of 1988	1428	beg_temp.exe	87
PID 1988 wrote to memory of 1184	1988	cmd.exe	90
PID 1428 wrote to memory of 4044	1428	beg_temp.exe	95
PID 4044 wrote to memory of 3332	4044	cmd.exe	96

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

pid	Process
1184	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Beg.exe
"C:\Users\Admin\AppData\Local\Temp\Beg.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Users\Admin\AppData\Local\Temp\beg_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\beg_temp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title 5669737461
    3⤵
    - Executes a command shell one-liner
    PID:4600
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c attrib -h -s "C:\Users\Admin\AppData\Local\Temp\server.pfx"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1988
  - - C:\Windows\system32\attrib.exe
      attrib -h -s "C:\Users\Admin\AppData\Local\Temp\server.pfx"
      4⤵
      Views/modifies file attributes
      PID:1184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop vgc >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4044
  - - C:\Windows\system32\sc.exe
      sc stop vgc
      4⤵
      Launches sc.exe
      PID:3332