e8f8ea8e8797c99e58231c8738a971c8d23c24c4ce219cb39812e3d1f2fd50d2

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
agent_044510cd3993420b.exe
Size 2.5MB
Sample260816-tkcb6sed39
SHA256 e8f8ea8e8797c99e58231c8738a971c8d23c24c4ce219cb39812e3d1f2fd50d2
MD5 ea4a79e5b9397e302231c2e48a419e70
SHA1 f6322946690c8e87e34710f4e5007dc25eb50008
SHA512 843ccf40f8384348e693681dd4d15712a96ca43267d21b5720140b70166ead2b420a0987f28bf3f18bcd5ef1c482c936a3da91d01467698ef582eb9044c33677
SSDEEP 49152:tdZoQXUJ/1nf7mdBgOOGvvlA0V8n+b+ra9Msjezs:mGy/JmdBOuNZfjezs
TLSH
T198C57C57B115096EC66BD63A817A6A3AB631B3843731AFFB0D4C9E34EE129C58F1D304
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealth = "C:\\Users\\Admin\\AppData\\Local\\Temp\\agent_044510cd3993420b.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealth = "C:\\Users\\Admin\\AppData\\Local\\Temp\\agent_044510cd3993420b.exe"	reg.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6020	cmd.exe
3152	cmd.exe
4584	cmd.exe
704	cmd.exe
2692	cmd.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
4256	reg.exe
3180	reg.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 4256	936	agent_044510cd3993420b.exe	89
PID 3316 wrote to memory of 3180	3316	agent_044510cd3993420b.exe	93
PID 936 wrote to memory of 6020	936	agent_044510cd3993420b.exe	97
PID 936 wrote to memory of 3152	936	agent_044510cd3993420b.exe	99
PID 936 wrote to memory of 4584	936	agent_044510cd3993420b.exe	101
PID 936 wrote to memory of 704	936	agent_044510cd3993420b.exe	103
PID 936 wrote to memory of 2692	936	agent_044510cd3993420b.exe	105

C:\Users\Admin\AppData\Local\Temp\agent_044510cd3993420b.exe
"C:\Users\Admin\AppData\Local\Temp\agent_044510cd3993420b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:936
- C:\Windows\system32\reg.exe
  "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealth /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\agent_044510cd3993420b.exe /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:4256
- C:\Windows\system32\cmd.exe
  "cmd" /C "dir C:\\"
  2⤵
  - Executes a command shell one-liner
  PID:6020
- C:\Windows\system32\cmd.exe
  "cmd" /C "dir C:\\"
  2⤵
  - Executes a command shell one-liner
  PID:3152
- C:\Windows\system32\cmd.exe
  "cmd" /C "dir C:\\"
  2⤵
  - Executes a command shell one-liner
  PID:4584
- C:\Windows\system32\cmd.exe
  "cmd" /C "dir C:\\"
  2⤵
  - Executes a command shell one-liner
  PID:704
- C:\Windows\system32\cmd.exe
  "cmd" /C "dir C:\\"
  2⤵
  - Executes a command shell one-liner
  PID:2692

C:\Users\Admin\AppData\Local\Temp\agent_044510cd3993420b.exe
C:\Users\Admin\AppData\Local\Temp\agent_044510cd3993420b.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Windows\system32\reg.exe
  "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealth /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\agent_044510cd3993420b.exe /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:3180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/936-0-0x0000000000F60000-0x0000000001105000-memory.dmp

Download

memory/3316-1-0x0000000000F60000-0x0000000001105000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads