b527c29eeb7427cb9e2b32b45f76185411ba55c95b40a774b053533c8b03433b

Resubmissions

24/08/2026, 12:38

260824-pt3hhatvcx7

17/03/2026, 20:40

260317-zf69msd18x7

14/03/2026, 15:33

260314-szbhrab12z7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
24/08/2026, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup Installer_patched.exe
Size 3.1MB
Sample260824-pt3hhatvcx
SHA256 b527c29eeb7427cb9e2b32b45f76185411ba55c95b40a774b053533c8b03433b
MD5 5aa636bfaff0a2f1d08d3bf891cdb286
SHA1 dd4eaa687b434d2c0b2ae2e2390c10ff78e684ad
SHA512 0727c134fc61cde4697a9e111edf69ed1dac98f10c23cd55b78d0ac8a5bfae7e613c447d462cf47bd809402c36ee60a11d38621b4e3a105624977aafdfc801b8
SSDEEP 49152:+wMmA+qRD1vAOs/WT1W6Ogl2d/pCI87I5:+FrjRxvdsuT1W6Ogsd/sI87I5
TLSH
T1A9E512C3E9681ED5F83A63F3B5A744D39AB078FE93A4947770A5F2624142291021FDEC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4256	Mysql.exe
5056	Mysql.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Setup Installer_patched.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4256 set thread context of 5056	4256	Mysql.exe	96

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2852	cmd.exe
4964	cmd.exe
3864	cmd.exe
3444	cmd.exe
3856	cmd.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4256	Mysql.exe
4256	Mysql.exe
4256	Mysql.exe
4256	Mysql.exe
4256	Mysql.exe
4256	Mysql.exe
4256	Mysql.exe
4256	Mysql.exe
4256	Mysql.exe
4256	Mysql.exe
4256	Mysql.exe
4256	Mysql.exe
4256	Mysql.exe
4256	Mysql.exe
4256	Mysql.exe
4256	Mysql.exe
4256	Mysql.exe
4256	Mysql.exe
4256	Mysql.exe
4256	Mysql.exe
4256	Mysql.exe
4256	Mysql.exe
4256	Mysql.exe
4256	Mysql.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4256	Mysql.exe
4256	Mysql.exe
4256	Mysql.exe
4256	Mysql.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
4256	Mysql.exe
4256	Mysql.exe
4256	Mysql.exe
4256	Mysql.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 412	4248	Setup Installer_patched.exe	82
PID 4248 wrote to memory of 3856	4248	Setup Installer_patched.exe	84
PID 3856 wrote to memory of 4240	3856	cmd.exe	86
PID 3856 wrote to memory of 4488	3856	cmd.exe	87
PID 4488 wrote to memory of 2852	4488	cmd.exe	90
PID 4488 wrote to memory of 4964	4488	cmd.exe	91
PID 4964 wrote to memory of 1664	4964	cmd.exe	92
PID 4488 wrote to memory of 3864	4488	cmd.exe	93
PID 4488 wrote to memory of 3444	4488	cmd.exe	94
PID 4488 wrote to memory of 4256	4488	cmd.exe	95
PID 4256 wrote to memory of 5056	4256	Mysql.exe	96
PID 4256 wrote to memory of 5056	4256	Mysql.exe	96

C:\Users\Admin\AppData\Local\Temp\Setup Installer_patched.exe
"C:\Users\Admin\AppData\Local\Temp\Setup Installer_patched.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\SYSTEM32\at.exe
  at.exe djhfjshdf937826457862398347
  2⤵
  PID:412
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c IJFlZhnrN & type Configured.dif | %comspec%
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" type Configured.dif "
    3⤵
    PID:4240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\Windows\system32\cmd.exe
      cmd /c set /p ="MZ"
      4⤵
      Executes a command shell one-liner
      PID:2852
  - - C:\Windows\system32\cmd.exe
      cmd /c findstr /V "Paste" Literacy
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4964
    - - C:\Windows\system32\findstr.exe
        
        findstr /V "Paste" Literacy
        5⤵
        
        PID:1664
  - - C:\Windows\system32\cmd.exe
      cmd /c copy /b /y 129986\Mysql.exe + Wheat + Cups + Standing 129986\Mysql.exe
      4⤵
      Executes a command shell one-liner
      PID:3864
  - - C:\Windows\system32\cmd.exe
      cmd /c copy /b /y ..\Ready.dif n
      4⤵
      Executes a command shell one-liner
      PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\129986\Mysql.exe
      Mysql.exe n
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\129986\Mysql.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\129986\Mysql.exe
        5⤵
        Executes dropped EXE
        
        PID:5056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Mysql.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\129986\Mysql.exe
Size 1KB
SHA256 8face104b7ed2fc909940a4ada87d15bf857beda929427e4a0f6ea804b173f70
MD5 ce3648355920ce796967a6910d35fe88
SHA1 4aa79822a8ff470cad22f0219bc127342c62014f
SHA512 a4d634e849fee1c021db8f76528767e0a3711537239359ae3b887463ca08c0d07e8377d5a8c700547c12d5a3f3c53ef39a570d5018643f8545b127bcdb48d959
TLSH
T1D431DDEF8BCA8CE9D47C06B4C456439A3034B6BCE31B4A832FBC011E9D3E11587AD518
MD5 SHA1 SHA512 TLSH

Submit Download

Mysql.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\129986\Mysql.exe
Size 1.1MB
SHA256 881619a47b62b52305d92640cc4d4845a279c23a5a749413785fc8fcb0fdf7fb
MD5 7ac9278876c83c9b597fae68acb6fbf9
SHA1 18150c9b96bffd20c8203ff98a4fc153929bc2c9
SHA512 ddcedf90c53c148d85e36e039fc25712e242e9256ea8791d6cc15bb862b6b85a19a5583b5554f1afda9406affc4e953c4f8a2ddad6fe4d959a9fd5395dc870ee
SSDEEP 24576:r2XJHqX/Rr2YU9EPqYlsgSsJbD1tiP4+kUrp5B:yZql2nuxlRV1t1YrP
TLSH
T1B5355C0663A4419DFEA7E136960BC60BD7B17C4A07739A6F02646B626F337711A2E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Configured.dif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Configured.dif
Size 9KB
SHA256 c1eee6c78e9926f2ba88efb5f65b0048a838a96787cfc501a727fd8436fe2daf
MD5 03d50cdf9c3b1b67d30ba7711f683fbf
SHA1 70988521b8257f5e43cf9797940c1a6759323d8b
SHA512 9dbc4eaf9fbb76cdb620796074066ab6d97d5d222a31ad4b9644eaa716f9ea321e1a5f0c86b93c6192aad2b24ef334174eb0688af11168eaf6769c06dcc84515
SSDEEP 192:uRStg+PEZ+x2m0t79sL83A16e0e6tcbmr3/G/Y88Br9VhyV58LT:xtP2X2Q1Hcpq
TLSH
T15012E8F4714D4972209ABAE5AAE08C4AF733D26118A510B8BF9B59D4CF48C5C533AA37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cups

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Cups
Size 435KB
SHA256 0b8cfad7b336beb91ede877117651415f32de5e0aca757fcff2650db3ebdb7c1
MD5 b888dbea6dbaac4b53caa35746762fc9
SHA1 3bcbb91b9bf8b19f21e768a3181046b50876f245
SHA512 927372e91a4e4f0e6d30e28bf3979ee725912d1a0435c4028096f3a04486fb2bba084fc3e7b17beeaf2b2f073b1664051f312d7d108a8358b60b76d963239aa7
SSDEEP 12288:gazn4wYV/FfEPqG+sCilsgSyzJbD1kyLviPYow+oVHddq:y9EPqYlsgSsJbD1tiP4+kq
TLSH
T1CC945C1973F442D8EEAAE0B2C613C507D7F1B80647B6C61F4574AB622F63B721A2D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Literacy

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Literacy
Size 1KB
SHA256 fff937aa793e1a62edfa2fe78bb732a97ea59f5eca1143ccba56b8e4ef3fb0c4
MD5 3fd31e7b58e85f03de098fb29b3522aa
SHA1 1b439d62bce932147bf5a8ff3de3e77a11158072
SHA512 56d042672c7331fbbb3ab4a4f84b94679aade9c7318d745ac95a9a95682fc35eb9ff924a0e0808674dfbc2c1cf54662630c5572f28521bfdca0b4be6c5e2567c
TLSH
T14431D0DF87C68CE5D47C06B4C455439A3035B6BCE31749832FBC011E9D3E115879D518
MD5 SHA1 SHA512 TLSH

Submit Download

Ready.dif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ready.dif
Size 1.5MB
SHA256 f2013288b14b099f746839cc0db8687d0809f0dfbab0d32134cd6979e1615e5b
MD5 074ad9565661986ba6d0e1a1ae3e8857
SHA1 8a2e0c8a08b7442b9002d2c1901688d58e90fce0
SHA512 7a8820199e5dd7cb5c357d9854a39ebe3cf9e41086529455f9a2559b519adfb72d1a75f43cbfa5c1bcdbde789441668bf5759788d03087e7e05a7aaa346bac86
SSDEEP 24576:4jouVRmiobthIbcHz0PYcOp+u1g/zpRYkTg/poQQttaZQnwTLf3:4JRmRfeb3OlKXB4Ly0mEj3
TLSH
T1AB7533C7FB646183F61F3F18AAFE94120F44DC998A7246AAE5108814F1276F5E31E9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Standing

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Standing
Size 236KB
SHA256 d7949b1f497f920cb7f00105baa75e8915c5a7d06439c72fea128ecdc6064bc7
MD5 f16d974ef3eae2c8c30a7a35402f37a6
SHA1 71233f330fb1b2f516a6d84fcbaa9b65ae0124e8
SHA512 89a5f0fbe9740c5726d165ba1a3a52bd8716b15bf2d2fa120d1d4a06d2141997164dea1dd5e6463ee6aaa0e93dd30d466ad44b6e54e7212f1ac2c399a61e4759
SSDEEP 3072:Yw6uId1bvhOYSQurhrRIb+c2oZxr6DWy4ZNo4TSQ:f6DPbvVGrRz3o+aBZ24
TLSH
T10E34820263A5861BFFA3F63B265FC76E46B56D4E4763687E06182F3978303714A2D630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wheat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Wheat
Size 409KB
SHA256 388a345e0d16a8be28bfef51d8f214f2268e06658fb88bf0a28665f403f9224f
MD5 adb2cf69c0bd2fa6eb06ed4fed633c81
SHA1 bb844675d63ad7aafc633cab2731ee5a129ee3cb
SHA512 f9e752f82a432646c821239e00e9f2de748bb8804a289c7b04930993567ae4630e024f3f78fba83c4d8afe927445747be9eeaca897c6129d8466bf4a80ef3ae6
SSDEEP 6144:O1vRBHPoonCJXJrq/hoVqkSXFsczqkC7aVUaUviTRS505EXoiG:6ZKFJXJH4zXGaVDUaTRr5EXoiG
TLSH
T1F8948E5666A410EED16FD035C90B9A0BE772BC4A1734EB9B03E04E629F23F90176F356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5056-25-0x0000000140000000-0x000000014003C000-memory.dmp

Download

memory/5056-26-0x0000000140000000-0x000000014003C000-memory.dmp

Download

memory/5056-28-0x0000000140000000-0x000000014003C000-memory.dmp

Download

memory/5056-29-0x0000021FFAAA0000-0x0000021FFAADC000-memory.dmp

Download

memory/5056-30-0x00000000006D0000-0x00000000006E9000-memory.dmp

Download