Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 12:22
Behavioral task
behavioral1
Sample
123.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target 123.exe
- Size 584KB
- Sample260819-pj7dpsfa54
- SHA256 62b07d9d1a68010bfdc39df0f22996c386162d53a328ab59a9becb1a30d1a454
- MD5 10477973b66b41fae5e8334cec3e85b6
- SHA1 c6321a5075f7d3cb86f52a60c8644f01e92d9785
- SHA512 03e0fc0e2a03751be8f639a3a6105357ada8e06bc1886b14eccdd64c20dca35a448a2ece6cd3d07a440a459ab53c529660278e7189a33af5fac26b5edfe04cb1
- SSDEEP 6144:VmBvqJJWgEmEizgdS7Mm3o0wmjrdABecyw:VSCJktEMm3WmmBiw
- TLSH T17FD4F21DEF2EBCE4F91E53BE3530482A3F519926B8BE586D61526626CC34343409BDCB
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
redosdru
C2
-
http://www.tgzh.club/NetSyst96.dll
Signatures
- Family: Redosdru
Redosdru is a loader/downloader written in C++.
- Gh0st RAT payload 10 IoCs
resource yara_rule behavioral2/memory/1324-9-0x0000000010000000-0x000000001034B000-memory.dmp family_gh0strat behavioral2/memory/1324-8-0x0000000010000000-0x000000001034B000-memory.dmp family_gh0strat behavioral2/memory/1324-7-0x0000000010000000-0x000000001034B000-memory.dmp family_gh0strat behavioral2/memory/2060-17-0x0000000010000000-0x000000001034B000-memory.dmp family_gh0strat behavioral2/memory/4892-22-0x0000000010000000-0x000000001034B000-memory.dmp family_gh0strat behavioral2/memory/4892-24-0x0000000010000000-0x000000001034B000-memory.dmp family_gh0strat behavioral2/memory/4892-23-0x0000000010000000-0x000000001034B000-memory.dmp family_gh0strat behavioral2/memory/2916-37-0x0000000010000000-0x000000001034B000-memory.dmp family_gh0strat behavioral2/memory/4892-40-0x0000000010000000-0x000000001034B000-memory.dmp family_gh0strat behavioral2/memory/2916-39-0x0000000010000000-0x000000001034B000-memory.dmp family_gh0strat - Executes dropped EXE 4 IoCs
pid Process 2060 Tlwguwa.exe 4892 Tlwguwa.exe 2916 Tlwguwa.exe 1344 Tlwguwa.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: Tlwguwa.exe File opened (read-only) \??\V: Tlwguwa.exe File opened (read-only) \??\Z: Tlwguwa.exe File opened (read-only) \??\L: Tlwguwa.exe File opened (read-only) \??\M: Tlwguwa.exe File opened (read-only) \??\J: Tlwguwa.exe File opened (read-only) \??\N: Tlwguwa.exe File opened (read-only) \??\P: Tlwguwa.exe File opened (read-only) \??\S: Tlwguwa.exe File opened (read-only) \??\X: Tlwguwa.exe File opened (read-only) \??\Y: Tlwguwa.exe File opened (read-only) \??\D: Tlwguwa.exe File opened (read-only) \??\H: Tlwguwa.exe File opened (read-only) \??\I: Tlwguwa.exe File opened (read-only) \??\K: Tlwguwa.exe File opened (read-only) \??\O: Tlwguwa.exe File opened (read-only) \??\R: Tlwguwa.exe File opened (read-only) \??\U: Tlwguwa.exe File opened (read-only) \??\W: Tlwguwa.exe File opened (read-only) \??\B: Tlwguwa.exe File opened (read-only) \??\G: Tlwguwa.exe File opened (read-only) \??\Q: Tlwguwa.exe -
resource yara_rule behavioral2/memory/1324-9-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/memory/1324-8-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/memory/1324-7-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/memory/1324-4-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/memory/2060-17-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/memory/4892-22-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/memory/4892-24-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/memory/4892-23-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/memory/4892-19-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/memory/2916-37-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/memory/4892-40-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/memory/2916-39-0x0000000010000000-0x000000001034B000-memory.dmp upx - Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\AppPatch\NetSyst96.dll 123.exe File opened for modification C:\Program Files\AppPatch\NetSyst96.dll 123.exe File created C:\Program Files (x86)\Microsoft Owhrfh\Tlwguwa.exe 123.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 1776 4892 WerFault.exe 90 - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 123.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Tlwguwa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Tlwguwa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Tlwguwa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Tlwguwa.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Tlwguwa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Tlwguwa.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" Tlwguwa.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum Tlwguwa.exe Key created \REGISTRY\USER\.DEFAULT\Software Tlwguwa.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Tlwguwa.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie Tlwguwa.exe - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe 2916 Tlwguwa.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 1324 123.exe Token: SeDebugPrivilege 2060 Tlwguwa.exe Token: SeDebugPrivilege 4892 Tlwguwa.exe Token: SeDebugPrivilege 4892 Tlwguwa.exe Token: SeDebugPrivilege 4892 Tlwguwa.exe Token: SeDebugPrivilege 2916 Tlwguwa.exe Token: SeDebugPrivilege 1344 Tlwguwa.exe Token: SeDebugPrivilege 2916 Tlwguwa.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1324 wrote to memory of 2060 1324 123.exe 89 PID 4892 wrote to memory of 2916 4892 Tlwguwa.exe 91 PID 4892 wrote to memory of 1344 4892 Tlwguwa.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\123.exe"C:\Users\Admin\AppData\Local\Temp\123.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Program Files (x86)\Microsoft Owhrfh\Tlwguwa.exe"C:\Program Files (x86)\Microsoft Owhrfh\Tlwguwa.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2060
-
-
C:\Program Files (x86)\Microsoft Owhrfh\Tlwguwa.exe"C:\Program Files (x86)\Microsoft Owhrfh\Tlwguwa.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Program Files (x86)\Microsoft Owhrfh\Tlwguwa.exe"C:\Program Files (x86)\Microsoft Owhrfh\Tlwguwa.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2916
-
-
C:\Program Files (x86)\Microsoft Owhrfh\Tlwguwa.exe"C:\Program Files (x86)\Microsoft Owhrfh\Tlwguwa.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1344
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 6282⤵
- Program crash
PID:1776
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4892 -ip 48921⤵PID:2852
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft Owhrfh\Tlwguwa.exe
- Size 584KB
- SHA256 62b07d9d1a68010bfdc39df0f22996c386162d53a328ab59a9becb1a30d1a454
- MD5 10477973b66b41fae5e8334cec3e85b6
- SHA1 c6321a5075f7d3cb86f52a60c8644f01e92d9785
- SHA512 03e0fc0e2a03751be8f639a3a6105357ada8e06bc1886b14eccdd64c20dca35a448a2ece6cd3d07a440a459ab53c529660278e7189a33af5fac26b5edfe04cb1
- SSDEEP 6144:VmBvqJJWgEmEizgdS7Mm3o0wmjrdABecyw:VSCJktEMm3WmmBiw
- TLSH T17FD4F21DEF2EBCE4F91E53BE3530482A3F519926B8BE586D61526626CC34343409BDCB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\AppPatch\NetSyst96.dll
- Size 239KB
- SHA256 7baee22c9834bef64f0c1b7f5988d9717855942d87c82f019606d07589bc51a9
- MD5 8c19d83ff359a1b77cb06939c2e5f0cb
- SHA1 a01a199e6f6f3e84cef5c7e6251a2b1291217885
- SHA512 b241c7b0f6372483faf4630e82d7f609e8450bac17cedaeb8fc7db8157ec5363e153f5cab5188eee6d8b27b366656877d4421122c8e26a0a739b6c5308bde381
- SSDEEP 6144:HmbyEr/rerH3HOkzOBhVKaWcu4iXZrOBV:HEyEA+kzIKiu4w
- TLSH T13934235DA581D8B764A934534CAFAC473935D76E1B02A3F364B0207C2F8CBD5EB6A01B
- MD5 SHA1 SHA512 SSDEEP TLSH