a1ed36193b302a76a978ff933cc8ad9a875bd4a25a4240fb7cfca02c81d701e2

Analysis

max time kernel
301s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 15:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GenP-v4.2.1.exe
Size 68.3MB
Sample260809-s263fa1bme
SHA256 a1ed36193b302a76a978ff933cc8ad9a875bd4a25a4240fb7cfca02c81d701e2
MD5 aa2fe40831d8e337ad693571c3a91e9d
SHA1 de5f0dd806bad01c1150f99d551d7044cda960e4
SHA512 4d25c77b04845177b0954c6b86a39d51a4e4151f7d76fd028d81a395e76aaf02eee5055043b90366aa5f2f48ed57a147f1734aeb895ab6de7c3f09ea8c2afd22
SSDEEP 1572864:8VdsSCuUAOizL2S05lE5ouNNEV2E5xMHeYR9AwXMzBvYv4x0g6Zbq/zCG:pSsAOuLyEeuNNI2EQ39jXMlAg1Z
TLSH
T1EDF73319A3A042EEED2BE2768957C50BD772B8422373960F5675677A2F33731681E330
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1968	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3088	GenP-v4.2.1.exe
3088	GenP-v4.2.1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3088	GenP-v4.2.1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3088	GenP-v4.2.1.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 1968	3088	GenP-v4.2.1.exe	89
PID 1968 wrote to memory of 984	1968	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\GenP-v4.2.1.exe
"C:\Users\Admin\AppData\Local\Temp\GenP-v4.2.1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -store Root mitmproxy >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Windows\system32\certutil.exe
    certutil -store Root mitmproxy
    3⤵
    PID:984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

config.ini

Path C:\Users\Admin\AppData\Local\Temp\config.ini
Size 32KB
SHA256 457217b91de99af07460101e521e6996461f792fa9d0620be7bf4ccf6b7872c7
MD5 6889001cd08852fe7214ad903d428792
SHA1 7b3f4e57c9e071d9c93b462915d1118a4e2eaeb4
SHA512 396d56bed0db5e0b6ef8859bb1edf4bf7bdee4cfba012eecc5d6b9e23581866f4cbb26a9e760771c7eacdcf842e5cc374769e78dbfef68383d93382d1ee414f4
SSDEEP 768:5dW2KVpXesOZH46c2GfVy9pOBl08E4M4fKef+VY43PKfF2OT5Kl5U:jKVpXesOZH46c2GfVGgBSD4M4fKef+Vc
TLSH
T103E2A70F99CF1667D1A1BD8E32F2BC931F2EB08DEADA4691538D013D394740562E7D98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3088-31-0x00000255BF3D0000-0x00000255BF3D1000-memory.dmp

Download