b95d1bf68c6dbfd0fdfecc72453e715612a6f0dcc51c42c2e54cf5e8b51ccf9f

Resubmissions

18/08/2026, 18:51

260818-xhn5qszwgz5

18/08/2026, 18:48

18/08/2026, 18:46

18/08/2026, 18:40

18/08/2026, 18:37

18/08/2026, 18:33

Analysis

max time kernel
30s
max time network
23s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cheatcitytemp.exe
Size 20KB
Sample260818-xetaaaydnc
SHA256 b95d1bf68c6dbfd0fdfecc72453e715612a6f0dcc51c42c2e54cf5e8b51ccf9f
MD5 e4be82730c642be45ad314c16b35000c
SHA1 b320c0a64e3e1e084ac29870990bad8b609f0a50
SHA512 1986b68a3af62dc5b5925787978efc9986e7310f7579f207a5fe5969f52dbb8426d0afbfd47def77f2b12f942380bf53f715525d9f2caaab9881ebe2f3c6f7e0
SSDEEP 192:JUTBDjLsm/D1sT1l0/IyjPoBIz/G9sV7hSNlNqLIcow3wU9u7yRWJwfVSJ/hcos:JA9ND1qADoyz/gsfLICgTyRWnsc
TLSH
T13A92295AB75908E9E132D1BDC6F2251AF172750A1732D3CF2342413E0F623D1AC7BA46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
7	6052	cheatcitytemp.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\KzDCHHbfxBh\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\KzDCHHbfxBh"	crazyalsos.exe

Executes dropped EXE 1 IoCs

pid	Process
1736	crazyalsos.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4564	cmd.exe
2252	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1736	crazyalsos.exe
1736	crazyalsos.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
1736	crazyalsos.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1736	crazyalsos.exe
Token: SeLoadDriverPrivilege	1736	crazyalsos.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 6052 wrote to memory of 4564	6052	cheatcitytemp.exe	90
PID 6052 wrote to memory of 2252	6052	cheatcitytemp.exe	91
PID 2252 wrote to memory of 1736	2252	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\cheatcitytemp.exe
"C:\Users\Admin\AppData\Local\Temp\cheatcitytemp.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
PID:6052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c crazyalsos.exe [email protected]
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Users\Admin\AppData\Local\Temp\crazyalsos.exe
    crazyalsos.exe [email protected]
    3⤵
    - Sets service image path in registry
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: LoadsDriver
    - Suspicious use of AdjustPrivilegeToken
    PID:1736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crazyalsos.exe

Path C:\Users\Admin\AppData\Local\Temp\crazyalsos.exe
Size 150KB
SHA256 e48f6cf038c5fe69e4fe1c7a224df32e963a48a82ea428dfa38a5dcf221cad7c
MD5 1dfa88a8807eecb32e106c1b2c82bc44
SHA1 79456941b6c816ce3fe8d4ad3137d80e0c1c8a3d
SHA512 91df5fcec141bde821e05014333cc71c653c0598bc71b4f093bb07a677747e3104cd9e42b860efbec9caa57d53c76e078f051d8ed8505c696d252f70d8739cac
SSDEEP 3072:0QeuLZ8OB7/Us7sMDcFS0DzbskwBmJTQSaMm5/6Y5vg8h:0gNpBDUs7ncFSQ31JWljGQ
TLSH
T1A7E32A1797A9106EE1B7D6B9CAB24A11EB717C550B74D2CF135048BA0F327D0BA3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download