24ea2a5e84f6da537a831b83630e34540e1b5806a1ac72aa8027fc6543317c28

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 08:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
24ea2a5e84f6da537a831b83630e34540e1b5806a1ac72aa8027fc6543317c28.exe
Size 9.2MB
Sample260814-kr93cazsct
SHA256 24ea2a5e84f6da537a831b83630e34540e1b5806a1ac72aa8027fc6543317c28
MD5 ce3f7e4235c89e9cb09fbd74f44575b9
SHA1 6bcefbafdc4346c943546400f8b0df62b787f4ad
SHA512 3524014feee5d9e1ae3bc2967fb8b47cc5b93da97585f36b4cbf86199f9ab0e45e8299bf41171ff10646be1be36181c686b313763937859735dc95f3e63902d8
SSDEEP 98304:+xS5jvqgAwz5cu0fwmfRBwW7UwBpwLBDSAnMd//9YWFn+P:W2z5cRwmfRBwUOLFn43OW1
TLSH
T1FCA65B03F69580E8C0ADC5B8872BA637EB76FC890524B29B5BE44F212F66F505F1C359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\TorC2Client = "C:\\Users\\Admin\\AppData\\Local\\Temp\\24ea2a5e84f6da537a831b83630e34540e1b5806a1ac72aa8027fc6543317c28.exe"	24ea2a5e84f6da537a831b83630e34540e1b5806a1ac72aa8027fc6543317c28.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
30	api.ipify.org

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5020	24ea2a5e84f6da537a831b83630e34540e1b5806a1ac72aa8027fc6543317c28.exe
5020	24ea2a5e84f6da537a831b83630e34540e1b5806a1ac72aa8027fc6543317c28.exe
5020	24ea2a5e84f6da537a831b83630e34540e1b5806a1ac72aa8027fc6543317c28.exe
4140	24ea2a5e84f6da537a831b83630e34540e1b5806a1ac72aa8027fc6543317c28.exe
4140	24ea2a5e84f6da537a831b83630e34540e1b5806a1ac72aa8027fc6543317c28.exe
5020	24ea2a5e84f6da537a831b83630e34540e1b5806a1ac72aa8027fc6543317c28.exe
5020	24ea2a5e84f6da537a831b83630e34540e1b5806a1ac72aa8027fc6543317c28.exe
5020	24ea2a5e84f6da537a831b83630e34540e1b5806a1ac72aa8027fc6543317c28.exe
4140	24ea2a5e84f6da537a831b83630e34540e1b5806a1ac72aa8027fc6543317c28.exe
4140	24ea2a5e84f6da537a831b83630e34540e1b5806a1ac72aa8027fc6543317c28.exe
4140	24ea2a5e84f6da537a831b83630e34540e1b5806a1ac72aa8027fc6543317c28.exe
4140	24ea2a5e84f6da537a831b83630e34540e1b5806a1ac72aa8027fc6543317c28.exe

C:\Users\Admin\AppData\Local\Temp\24ea2a5e84f6da537a831b83630e34540e1b5806a1ac72aa8027fc6543317c28.exe
"C:\Users\Admin\AppData\Local\Temp\24ea2a5e84f6da537a831b83630e34540e1b5806a1ac72aa8027fc6543317c28.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:5020

C:\Users\Admin\AppData\Local\Temp\24ea2a5e84f6da537a831b83630e34540e1b5806a1ac72aa8027fc6543317c28.exe
C:\Users\Admin\AppData\Local\Temp\24ea2a5e84f6da537a831b83630e34540e1b5806a1ac72aa8027fc6543317c28.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dir.sqlite3

Path C:\Users\Admin\AppData\Local\torproject\Arti\cache\dir.sqlite3
Size 64KB
SHA256 c44672cf3768418d3184d5b7833f9ddbf3e3bedaf95f9589afadf0dc3652a1dd
MD5 7d031fc61a708ae01292f67d5468abe2
SHA1 0a293697551740c77484ae0662b29fd158294642
SHA512 db3bc9ee80a0ccd02474e69659aaa03d87f5f202f6ef6f4129125ce27570adbcd1675bf4ed4fd841fdbf88d3019541cfa9b22e0336d8ee9aa941dad1d0f35569
SSDEEP 48:TXt5cvCs4TbF3Kl31rMNuDsMHNBjEu5596YQ7IRcFJVNw1kV/v74CI:xj7HFaPQN67NrbgYQLb/tUCI
TLSH
T1CD53DB9F5FA83220C8A001B3ADD15C63293C865F4B53BDE071E440C5EFCA9696078CE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dir.sqlite3

Path C:\Users\Admin\AppData\Local\torproject\Arti\cache\dir.sqlite3
Size 40.7MB
SHA256 fe9b374cb53e2b2611d619b3a4a5ddeb1fe2bd9af7cfee20c7b3675b67fc5840
MD5 d27b4151ed3a2e261bc92ca3ad27c30f
SHA1 92e73e03d6ac4c70b3ed91107de75e6fbb256c05
SHA512 a16c831dc4ef5225418b7f838e51ebc549913b8b9be6b3ba226ac45f2766eeaa51278c4a96b468edf8787c4a4157d431c3d0c56c6e56fef07157d28f0a39d0f6
SSDEEP 49152:SpAguRmN50SWbx6emqXvNZKKBBMgACS7oxIJ/2em:6KH
TLSH
T18F97AED989AB04C1CE05E7FDDC1617C3DF208A3E0B50419172AAB5677F7329AC15EA3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

con_microdesc_sha3-256-e052083e997caf948286b3dfd635c771dd27828fa1a362f9d289c62d614b86bd

Path C:\Users\Admin\AppData\Local\torproject\Arti\cache\dir_blobs\con_microdesc_sha3-256-e052083e997caf948286b3dfd635c771dd27828fa1a362f9d289c62d614b86bd
Size 3.4MB
SHA256 1f7856c891ed7695ea80a62b119fb0ac2a33960e6936c1342df08604a6a64d60
MD5 393ea9e3a16ebfe00cb02986ca4f44e7
SHA1 88357bdee027542376e3e79c15737fb51ebf1d8f
SHA512 8f4568a215722b2715d2883ee2ab8e959ded4fe28501c13d4b7a9f9541f69a82ba7cbb991b2ad7f7dbe1d269d4a129a3e64081cec6092fa4ff5bddb522e150b9
SSDEEP 24576:XPR9c1dyrmmM0d6fXRR6jKwhrsocIBoomh7M9j9Fm2uf:XUnwMrXRdw1Oo1i
TLSH
T130F533EA97124EEAD32A09DBE510FF7BF33F5725C2486B94286F48FA7205091752093D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iptpub.tmp

Path C:\Users\Admin\AppData\Local\torproject\Arti\data\hss\tor-c2-client\iptpub.tmp
Size 52B
SHA256 fa6733155464826da904adbfa1fc1dba945554d50cd9399e1a1668817207d1e3
MD5 d20e12f52c9403bde0104adc6d244043
SHA1 80e17aa6699a0521b9eea687315ac97e84d04a3d
SHA512 7643ddb30340150cc8ba073a9f6961033517a63276d14319e03e8cfd7340964a59bba6c2f8e25dc295c3138a35aae24a0212a4242a88bbca1430501d34288c3b
TLSH
T1119002551CB654A20C921216556D57879B60B95A00847D01258F091C2A484240667519
MD5 SHA1 SHA512 TLSH

Submit Download

iptpub.tmp

Path C:\Users\Admin\AppData\Local\torproject\Arti\data\hss\tor-c2-client\iptpub.tmp
Size 302B
SHA256 918859eb4d8147e0b5d1ded21e6ef22bcc78f14686f48c015d6ae7baf81036b3
MD5 1ee7dfa9d832ff7af326a5fa7bfce7f7
SHA1 4b9b9374c644ed5a4f010239b53e9c973af6236b
SHA512 fa26ef4559107f8dd1614f96ae7cb0dec15cee4b9815c6375cc03de8827956cb73f4e018afde01e0e44d0525c82134ccd537e2f132e9d47fd029f44348de9531
TLSH
T171E02B59F9B2D8CF00761E33CA3C9A4222D8A93B19483F027B4C214E2F0B4361E72B1C
MD5 SHA1 SHA512 TLSH

Submit Download

iptpub.tmp

Path C:\Users\Admin\AppData\Local\torproject\Arti\data\hss\tor-c2-client\iptpub.tmp
Size 426B
SHA256 9e91f19362f0bd483b92bfd99f84e79502e06e10912a3689c42864a3c2b98008
MD5 b5799d7b194e11f6b70c481f8422791a
SHA1 87d530d61ffb7b1d080dda80bd3d81bc1f9a18df
SHA512 94d02cdb2509c40457f1a298ec0b7c200d13e635e2ac6f3630811b00bcb38d78dd3a562489f2118dc03d549b2a8ddd31179e858ace777438baa45de25c8eb074
TLSH
T18FE02B58BAB2E8CB44765932D63C9A012198A97719482F217B4C2B5E2F0B4261E71728
MD5 SHA1 SHA512 TLSH

Submit Download

iptpub.tmp

Path C:\Users\Admin\AppData\Local\torproject\Arti\data\hss\tor-c2-client\iptpub.tmp
Size 302B
SHA256 ee51e1b1cf2efcadc1a033257fae72b8d31b8fe9ebe5e3423dd40d26f74f5cc0
MD5 d92dcba118ee4321c6dd045815630c95
SHA1 540337be7e9174fb2a2671a2c85f43d59cdccab8
SHA512 19dee1def28384809d5faf5171cc830d9d7302711559da2b067703516974bfbffcbdc7fae117ee99e41ccced62fe374d1b233bc2069579d64966ee94e360cc6f
TLSH
T110E02B59F9B2D8CF00761A33CA3C8A4222D8A93719483F027B4C214E2F0B4361E72B1C
MD5 SHA1 SHA512 TLSH

Submit Download

iptpub.tmp

Path C:\Users\Admin\AppData\Local\torproject\Arti\data\hss\tor-c2-client\iptpub.tmp
Size 302B
SHA256 838b695a3e97c03f6ed6f0a023112c708154dd3529aea160c9b6bd8ae1468365
MD5 a5f50b2c03761747a6b3fc18268d092e
SHA1 3a43ed4d9551db73cf2fc102bfb829af71abdb4d
SHA512 cab48f066079b51ec7c744c76ac8776e5e120037acaaf8516e23dd993a5090cfb85c3297b50cd5b24872dc55ee2d172a80ed613c676fbee1cab0b2aa99036431
TLSH
T177E02B59F9B2D8CF00761E33DA3C8A4226D8A93B19483F027B4C214E2F0B4361E72B1C
MD5 SHA1 SHA512 TLSH

Submit Download

ipts.tmp

Path C:\Users\Admin\AppData\Local\torproject\Arti\data\hss\tor-c2-client\ipts.tmp
Size 1KB
SHA256 c9263c33109294098bfe350838bd274bd3a97e4903dbad23669c275c3cb5ac4e
MD5 4ce988149525ed3313972ca3242e79ee
SHA1 95cb00a74e9bdd0bd9a727ca3d282511a599b9ef
SHA512 0584308db79c0a30f37e346719a42a93d9b5d5a302b4d1b90f78ec0255d8773ef8dfd881cb7efb4173509fe3a719dd7f508398d7da558df64187a6dd1f798b36
TLSH
T14D210E08DCF6496B083A613B985D30C4B2F579876A9E3D187B4C168E1F2C04B4DF17AC
MD5 SHA1 SHA512 TLSH

Submit Download

ks_hs_blind_id+20678_1440_43200.ed25519_expanded_private

Path C:\Users\Admin\AppData\Local\torproject\Arti\data\keystore\hss\tor-c2-client\ks_hs_blind_id+20678_1440_43200.ed25519_expanded_private
Size 456B
SHA256 ea94c7133d5c8c1271857967e4e1d6ed43cd50b720148340a1c6a69aaab1f6e1
MD5 c4daa8ed30660ee3037f50940cd30854
SHA1 3c7baafddb810bd8600ff11707bfaefada3c4cf5
SHA512 cbea182d5a7d136eecaf4ec5560946d9d38d58966bd5ca4fa14a5abdcd5088a22f065e5a03ad1d93689fd60e49f8d54b916246603abb110824cdf3cf2c14c037
TLSH
T115F0DC3FCAA42F00692BD5D2D98203679F00C1A72E3661A9286095C741F9D13D36D956
MD5 SHA1 SHA512 TLSH

Submit Download

ks_hs_blind_id+20679_1440_43200.ed25519_expanded_private

Path C:\Users\Admin\AppData\Local\torproject\Arti\data\keystore\hss\tor-c2-client\ks_hs_blind_id+20679_1440_43200.ed25519_expanded_private
Size 456B
SHA256 d5f5fc6dd0697d71ab4691e17e15df4335d5a81c3a85b74ce9c3c87b867e2b53
MD5 58b2c1cf69d3fcc3940d6eb1289bd3b5
SHA1 90b9ec3764328c641c6cbca88c07514b82aa1bd8
SHA512 b324c7f4767a9cafc4dc809994171dd6901391fc5114aae21ea1346d3ee343a4302d299f8c7d3a2d7a5b44daa8390f3486d612fe17979ec3b210b12d09190b3e
TLSH
T120F0237ECF652E11BC2BC2E08C260157AF44C9A33A5AB0F8143184460672E62E2EC671
MD5 SHA1 SHA512 TLSH

Submit Download

ks_hs_desc_sign+20678_1440_43200.ed25519_private

Path C:\Users\Admin\AppData\Local\torproject\Arti\data\keystore\hss\tor-c2-client\ks_hs_desc_sign+20678_1440_43200.ed25519_private
Size 387B
SHA256 8211e51979796e5e334471e6942d8d85c7b57952421e61a39745d7c718928947
MD5 699a5e02672447d0b302f84b4e20f441
SHA1 5b0f2afb959b63734aceeb94910ca4720bdecf7d
SHA512 a2adc39465b1ddedb093beb639f56b4c198b05ffcf7b3e496d6e97799df1fbb7e0d98914760fc84781964bab2f887f5d2156c60ced08a68b9089a23f54d6dbc9
TLSH
T1E2E022326C9C7BD06C2BDBD82866012B9FA4D197106CA0E80240E11B24B7E22C52C8D1
MD5 SHA1 SHA512 TLSH

Submit Download

ks_hs_desc_sign+20679_1440_43200.ed25519_private

Path C:\Users\Admin\AppData\Local\torproject\Arti\data\keystore\hss\tor-c2-client\ks_hs_desc_sign+20679_1440_43200.ed25519_private
Size 387B
SHA256 87051b5eb80bd51da7e40f98f86db826a7f644bc5b4e26e693b46e3d92d7a127
MD5 8d00e70d5b6bb69d25c31d158d38b3cd
SHA1 dfdb10ba5f04edd91d977493dbe62278692f68bc
SHA512 d9c98f5f295e190596aebcab896df3f35e55c50e2b5ab30907279b77546bd0b7914a29eba5638c55a6d193800a11fd8ef0f52b3215476597dac152e1adf9672f
TLSH
T1B2E02BB57CD42ED9587EC2D68D23161A4FEE80575134B1E481A480026D76F51F50D4E8
MD5 SHA1 SHA512 TLSH

Submit Download

ks_hs_id.ed25519_expanded_private

Path C:\Users\Admin\AppData\Local\torproject\Arti\data\keystore\hss\tor-c2-client\ks_hs_id.ed25519_expanded_private
Size 456B
SHA256 1191aad3844a3818c620afa5605bbe50f0742a9bcf8c7c2157736eb1695bdfbe
MD5 26069800cbe67baf02940e9ba7ccc55e
SHA1 f33cc5c23bfe99f2abdadcdb139d922a56729ef2
SHA512 f1ae4e071653b3966c0ee165c9c210b03f03f4b331fdfa9512a090f5c77fefc72ed0b5e978529bd2da69d390ad0e3a1f4ab5f617e9589fd49afc2f8139b65819
TLSH
T131F0D43F8E902F0D6D27CDC19911063F6F04D1D32D9B34E50721144703E19B1931C481
MD5 SHA1 SHA512 TLSH

Submit Download

circuit_timeouts.json

Path C:\Users\Admin\AppData\Local\torproject\Arti\data\state\circuit_timeouts.json
Size 65B
SHA256 9dbe12675e515f32f07aea11cc9f8bea69b3f143b3d825d98ca1ef41b2988ee7
MD5 b2b738c82cdfbf56440274e03a50c9f8
SHA1 5c1a0274017a666f069980c3c5a6220026cd3336
SHA512 d4c9dbca06de019b7ea2519e24ad603d6283c3f0aa7f9d97b9b014861f54d9cfb4f6a295b48d6bf69f2ee122668709df175afcf8f90b0e7e67a3e643f28e84e8
TLSH
T103A02220C0A200B3E0C023300222C3C88F20EF0232A23208300F0C0C02883A8033A222
MD5 SHA1 SHA512 TLSH

Submit Download

guards.json

Path C:\Users\Admin\AppData\Local\torproject\Arti\data\state\guards.json
Size 121B
SHA256 a2c2287ea6aa4ba07c2c1ab66268828c011a5d9cacef6dba1179a6bd196c2c3d
MD5 bd45eb55dc8a46aa313e7f68dd9cf953
SHA1 c6b7653ca38370cd639678a925802d1cd8a282eb
SHA512 058ffd60fa2aa2ab14022c0628d72a47440ad99bdfc82f8e6a4e303febde74514bda8e3064c015f57c63760462ca1193ee858040ce85cf8182d638d888e9cb71
TLSH
T1C3B09276A87B4C1611C0562A88382283E30128F3658CBC2E34CF450C0B4D0349DB5188
MD5 SHA1 SHA512 TLSH

Submit Download

guards.json

Path C:\Users\Admin\AppData\Local\torproject\Arti\data\state\guards.json
Size 10KB
SHA256 f45c341e11c78d3ceac30123e8d558e3157384f0bdb15c617f532591a57b9ef8
MD5 55cf47394054f3070d6c2e1f6b94bf3d
SHA1 b642a4d96e08152dffc2cd139b715d24755576e0
SHA512 2f97263cac286cebf66635b9f599e6cbde7c8c96d582b19bae871b5bff2de8902ab85c31ac144d7e6be7cd5281134c015174e73f378369c920af985bf368c825
SSDEEP 192:X8JhJbzJNRJgJyJNJTJtUJ0e8J+KnHJB2J+IaZJHJiJxmJUJfgJ9fJOrJ8Ju9H2:M7VzLRSoHtHU+e8dnHOAJwDm+eXf8i0W
TLSH
T100229E54CC7A2C834ADD563D847A52C2D324A18F7FAD3C143B4E569C0F5D5AC0A3ABAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client.id

Path C:\Users\Admin\AppData\Roaming\tor-client\client.id
Size 36B
SHA256 123f9f2398195ac08b6db006455d970fcce4dd4fda8eb3da5b393a63b7f82548
MD5 2f03aa7516cf7c0e153787e8f9ea3dc1
SHA1 f63c8c9a6806ebcaba4f41795e6334c132e2cd34
SHA512 9abca341a2f38d0af78d8941ecb57f4bd17026cf60d8b80b33111e74b51532f6d03cecc687466a5d806535d1d871f24ef823464222bbd755e2b459e10e60f5ca
MD5 SHA1 SHA512

Submit Download