3a0cb1db46e690f1cc38f7573da6917e1fb1c6d25f027bea2288442f4d9b5a1c

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 02:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_2d606878548583bbf2b6cf382025ab27_akira_babyshark_china-chopper_elex_glassworm_hacktools_mimikatz_qilin.exe
Size 6.0MB
Sample260819-cf9nfavcnf
SHA256 3a0cb1db46e690f1cc38f7573da6917e1fb1c6d25f027bea2288442f4d9b5a1c
MD5 2d606878548583bbf2b6cf382025ab27
SHA1 2657632c0c0a3310f617af35190083e799bbef84
SHA512 6e72af2d522f523224f2b19ec37c7f6f86d1241f36abb64285beeb048e21284bfccf581428a9a5daf52b21a5cef6820574d914a43eb1b8a6b2ee01fd1bc5328f
SSDEEP 49152:LV0v96HN3LrIUBdlAS4tTDTDL3BYXM6or3AXN7WcyAfcLyh6wHh682LiNqk81j+O:LVVHpXldborFACK5NLgx
TLSH
T15556AE38D9655CA3C2638271769E9218AE3060479955BC08BFDC85ECAF4CB3F417A3DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution 1 IoCs

resource	yara_rule
behavioral2/memory/3684-8-0x0000000000BA0000-0x00000000011AF000-memory.dmp	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral2/memory/3684-8-0x0000000000BA0000-0x00000000011AF000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects command variations typically used by ransomware 1 IoCs

resource	yara_rule
behavioral2/memory/3684-8-0x0000000000BA0000-0x00000000011AF000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
behavioral2/memory/3684-8-0x0000000000BA0000-0x00000000011AF000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables containing commands for clearing Windows Event Logs 1 IoCs

resource	yara_rule
behavioral2/memory/3684-8-0x0000000000BA0000-0x00000000011AF000-memory.dmp	INDICATOR_SUSPICIOUS_ClearWinLogs

Detects executables packed with Themida 1 IoCs

resource	yara_rule
behavioral2/memory/3684-8-0x0000000000BA0000-0x00000000011AF000-memory.dmp	INDICATOR_EXE_Packed_Themida

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
behavioral2/memory/3684-8-0x0000000000BA0000-0x00000000011AF000-memory.dmp	INDICATOR_EXE_Packed_VMProtect

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
behavioral2/memory/3684-8-0x0000000000BA0000-0x00000000011AF000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
behavioral2/memory/3684-8-0x0000000000BA0000-0x00000000011AF000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

detects Windows exceutables potentially bypassing UAC using eventvwr.exe 1 IoCs

resource	yara_rule
behavioral2/memory/3684-8-0x0000000000BA0000-0x00000000011AF000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer

Executes dropped EXE 1 IoCs

pid	Process
1076	CodexSync.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CodexSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_2d606878548583bbf2b6cf382025ab27_akira_babyshark_china-chopper_elex_glassworm_hacktools_mimikatz_qilin.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5708	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3684	2026-08-19_2d606878548583bbf2b6cf382025ab27_akira_babyshark_china-chopper_elex_glassworm_hacktools_mimikatz_qilin.exe
3684	2026-08-19_2d606878548583bbf2b6cf382025ab27_akira_babyshark_china-chopper_elex_glassworm_hacktools_mimikatz_qilin.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 5708	3684	2026-08-19_2d606878548583bbf2b6cf382025ab27_akira_babyshark_china-chopper_elex_glassworm_hacktools_mimikatz_qilin.exe	88
PID 3684 wrote to memory of 1076	3684	2026-08-19_2d606878548583bbf2b6cf382025ab27_akira_babyshark_china-chopper_elex_glassworm_hacktools_mimikatz_qilin.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-19_2d606878548583bbf2b6cf382025ab27_akira_babyshark_china-chopper_elex_glassworm_hacktools_mimikatz_qilin.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_2d606878548583bbf2b6cf382025ab27_akira_babyshark_china-chopper_elex_glassworm_hacktools_mimikatz_qilin.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /Create /F /TN CodexSync /TR \"C:\Users\Admin\AppData\Local\CodexSync\CodexSync.exe\" /SC MINUTE /MO 3
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5708
- C:\Users\Admin\AppData\Local\CodexSync\CodexSync.exe
  "C:\Users\Admin\AppData\Local\CodexSync\CodexSync.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CodexSync.exe

Path C:\Users\Admin\AppData\Local\CodexSync\CodexSync.exe
Size 443KB
SHA256 3cf1d0c2b100ff74b659da9dbe4d66640f66dacceef62cb5966e86a89112dcbc
MD5 c2f1a3c87923c5dc4e39befa208be2e1
SHA1 f9adadf169e0275bcbd24fae2c03b16850897cd2
SHA512 1d5b14fbf8d9f75bad0842c6787f3dcc3c20dceb367eecef3f05fb05b5cc86480903f937998031c3c77db6842867c36557ffb5c86e9e664dc1c9faaf3ee3bb31
SSDEEP 6144:Vqt4cixPnk0TqrV9AKo+BOL+ph940DUN/1lPtyq27eolH4Q9jgfA7KQRCqCsQnPs:Mt9ePk0TqrSCppI/MqClYcz/kqKIlta
TLSH
T190A47D0AF943B1B9C97718B1046FE37FEA304E090427DE77DBD6AEA5FA2B7101619205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1076-9-0x0000000000C60000-0x0000000000CD5000-memory.dmp

Download

memory/1076-18-0x0000000000C60000-0x0000000000CD5000-memory.dmp

Download

memory/3684-0-0x00000000011A0000-0x00000000011A1000-memory.dmp

Download

memory/3684-8-0x0000000000BA0000-0x00000000011AF000-memory.dmp

Download