e0bf9601194e4cecc88adadd3a5324db9fa85cdd3d29a6ef87e782e950326b3c

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 15:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e0bf9601194e4cecc88adadd3a5324db9fa85cdd3d29a6ef87e782e950326b3c.exe
Size 5.6MB
Sample260824-sxx9qsaj21
SHA256 e0bf9601194e4cecc88adadd3a5324db9fa85cdd3d29a6ef87e782e950326b3c
MD5 ba21e0548dee4c48277e6dce73c2b369
SHA1 62fe711d2fb2278d27791ee77c9b0f8805d914fe
SHA512 e5c4863f42b5e08e7d4befd2325e926723bf2b09e0917455fb8fbc40361457386d1ecd89eaf1ef83e3db505a4ed78220556952b41c7f18002e481ef81b0b7afb
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0bc9h3pFEoqPBN:+0s420bTjzGlBrJTJb8QAMQ/Zc4TAN
TLSH
T1814623D6785E2AABC20D6CB98D168E6675AC5BB1C7604CD3EFD43DF34810CD32632926
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3184	SystemTrayHelper.exe

Executes dropped EXE 9 IoCs

pid	Process
4780	SystemTrayHelper.exe
3184	SystemTrayHelper.exe
3264	RuntimeBroker32.exe
3688	RuntimeBroker32.exe
4792	UserSession.exe
3452	UserSession.exe
4140	BackgroundTask.exe
2160	BackgroundTask.exe
4472	RuntimeBroker32.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\SystemTrayHelper.exe\""	e0bf9601194e4cecc88adadd3a5324db9fa85cdd3d29a6ef87e782e950326b3c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\RuntimeBroker32.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\UserSession.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\BackgroundTask.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\RuntimeBroker32.exe\""	BackgroundTask.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
52	raw.githubusercontent.com
2	raw.githubusercontent.com

Detect suspicious telegram bot 5 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x001200000001c422-12.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c425-19.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c426-54.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c428-88.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c426-123.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e0bf9601194e4cecc88adadd3a5324db9fa85cdd3d29a6ef87e782e950326b3c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4608	e0bf9601194e4cecc88adadd3a5324db9fa85cdd3d29a6ef87e782e950326b3c.exe
4608	e0bf9601194e4cecc88adadd3a5324db9fa85cdd3d29a6ef87e782e950326b3c.exe
4608	e0bf9601194e4cecc88adadd3a5324db9fa85cdd3d29a6ef87e782e950326b3c.exe
4608	e0bf9601194e4cecc88adadd3a5324db9fa85cdd3d29a6ef87e782e950326b3c.exe
4608	e0bf9601194e4cecc88adadd3a5324db9fa85cdd3d29a6ef87e782e950326b3c.exe
4608	e0bf9601194e4cecc88adadd3a5324db9fa85cdd3d29a6ef87e782e950326b3c.exe
4608	e0bf9601194e4cecc88adadd3a5324db9fa85cdd3d29a6ef87e782e950326b3c.exe
4608	e0bf9601194e4cecc88adadd3a5324db9fa85cdd3d29a6ef87e782e950326b3c.exe
3184	SystemTrayHelper.exe
3184	SystemTrayHelper.exe
3184	SystemTrayHelper.exe
3184	SystemTrayHelper.exe
4780	SystemTrayHelper.exe
4780	SystemTrayHelper.exe
4780	SystemTrayHelper.exe
4780	SystemTrayHelper.exe
4780	SystemTrayHelper.exe
4780	SystemTrayHelper.exe
4780	SystemTrayHelper.exe
4780	SystemTrayHelper.exe
3688	RuntimeBroker32.exe
3688	RuntimeBroker32.exe
3688	RuntimeBroker32.exe
3688	RuntimeBroker32.exe
3688	RuntimeBroker32.exe
3688	RuntimeBroker32.exe
3688	RuntimeBroker32.exe
3688	RuntimeBroker32.exe
4792	UserSession.exe
4792	UserSession.exe
3452	UserSession.exe
3452	UserSession.exe
3452	UserSession.exe
3452	UserSession.exe
4792	UserSession.exe
4792	UserSession.exe
4792	UserSession.exe
4792	UserSession.exe
4792	UserSession.exe
4792	UserSession.exe
4140	BackgroundTask.exe
4140	BackgroundTask.exe
2160	BackgroundTask.exe
2160	BackgroundTask.exe
2160	BackgroundTask.exe
2160	BackgroundTask.exe
4140	BackgroundTask.exe
4140	BackgroundTask.exe
4140	BackgroundTask.exe
4140	BackgroundTask.exe
4140	BackgroundTask.exe
4140	BackgroundTask.exe
4472	RuntimeBroker32.exe
4472	RuntimeBroker32.exe
4472	RuntimeBroker32.exe
4472	RuntimeBroker32.exe
4472	RuntimeBroker32.exe
4472	RuntimeBroker32.exe
4472	RuntimeBroker32.exe
4472	RuntimeBroker32.exe
4472	RuntimeBroker32.exe
4472	RuntimeBroker32.exe
4472	RuntimeBroker32.exe
4472	RuntimeBroker32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 3184	4608	e0bf9601194e4cecc88adadd3a5324db9fa85cdd3d29a6ef87e782e950326b3c.exe	91
PID 4780 wrote to memory of 3264	4780	SystemTrayHelper.exe	93
PID 3688 wrote to memory of 3452	3688	RuntimeBroker32.exe	98
PID 4792 wrote to memory of 2160	4792	UserSession.exe	101
PID 4140 wrote to memory of 4472	4140	BackgroundTask.exe	102

C:\Users\Admin\AppData\Local\Temp\e0bf9601194e4cecc88adadd3a5324db9fa85cdd3d29a6ef87e782e950326b3c.exe
"C:\Users\Admin\AppData\Local\Temp\e0bf9601194e4cecc88adadd3a5324db9fa85cdd3d29a6ef87e782e950326b3c.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemTrayHelper.exe" --monitor
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3184

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3264

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\UserSession.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3452

C:\Users\Admin\AppData\Local\Temp\Diagnostics\UserSession.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\UserSession.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\BackgroundTask.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2160

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\BackgroundTask.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\BackgroundTask.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 3d6f060b7287bcdee784465103ea19d69bca480ac8447dfd700d1fbe5e1ce249
MD5 3f6184d4c8785f712b1bcb749f965a0b
SHA1 8b30abfeecef80535e5695bd5065be355fa0e592
SHA512 9eb1d8db17d40def7a5de67410bc05b231a02c43c041a61fac31f4296e823ddbcfbc17200317bfe4a4ad5b5b520f324f04c2970aa61cda5a9b58b222629dcb36
TLSH
T1CA41FACABA1CB854BF45DF4448B4CE222E7CF2D41540159635FAC8F22486FC86F0B89C
MD5 SHA1 SHA512 TLSH

Submit Download

6EBD0D78D799E307DA6AD4F19004AA0E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6EBD0D78D799E307DA6AD4F19004AA0E
Size 1KB
SHA256 8029d9f416217c1042df3825c21f54aba694ef8fd8de0faff83dda911c1295df
MD5 9c9f901845e98718676f6132079cf3af
SHA1 12a4dec9b2791c1dbafb0801e163590aa70416b4
SHA512 75e393a54176fdbed49db8c34f379560d1f47c1bdc2aae071e912fe61162fa2a99739a89fb7b057dbc6ce59ed0bc002657f2f136a5d23ce1f33d3323eaa3e836
TLSH
T1CE21CEE95C95205232C8BAA0DAFBDD9B9D35097423E0C4DF41A18B850563BC9CED55C8
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 b81116edab25e80257d6d921330660db3b1776a17cbda1bd30d14ff6de3ccfe2
MD5 1f355b7483aa6c9f77b70ee58022d58b
SHA1 43945357a6ffdfe90c89fb363e966d327467cc31
SHA512 4bfbbef47034e242e000c8c56382221f7f20a1f058cfb786f689c6b13ce4edf0f7aa778126e5f655373af9c1a710e4000f7816156439fb0d90d82d29f512159a
TLSH
T1B4F022103AFAA079F026EA3943E660B2D629F20A24019AFD26B363056A54E142C03D2E
MD5 SHA1 SHA512 TLSH

Submit Download

6EBD0D78D799E307DA6AD4F19004AA0E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6EBD0D78D799E307DA6AD4F19004AA0E
Size 238B
SHA256 6f132c755f088a1521ef3f2aa7a757c24daff9ee9baf5cc765c9618ecbe79069
MD5 d27e8a5a1ad95ddaadfe4849d0ca64a3
SHA1 31f06e45e88f8570e1d444173ebb08ce3d00ed0b
SHA512 40056d3d2fafbdb104b019bead063f586d6e52546b9e32704178d52e238097fcfb155867f883f73008b55134c28723629b2dd986c3a84d752ce3cc0a3031e1cd
TLSH
T1ADD012866759415AF4158A3ADAC18243AE55BE09B4028B052BE412488C5FF476E32E09
MD5 SHA1 SHA512 TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\BackgroundTask.exe
Size 6.0MB
SHA256 73b502aa858ee09223bc830302ca206246678fd7f3792619eb6363400842805b
MD5 b61e7c328f2716ce6542cbfd88555865
SHA1 f9e1bf4bde4822e7e62a2ca8f20dcebb166bc33e
SHA512 932642f4aa38d6efe998cec23994e327540d1b220dbf384adf60b5cf423154cc325380e8b17f771b71157e46a2acf5374ba91314454994373a6415e368719889
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0bc9h3pFEoqPBEKC:+0s420bTjzGlBrJTJb8QAMQ/Zc4TAEF
TLSH
T1F55623D6B85E2ABBC20D1CB98D168E6675AC1B71C7605CD3EFD52DF34810CD32A32926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemTrayHelper.exe
Size 5.7MB
SHA256 9dbe9b7b0850f499a11197bc66aa39b08281ac0f872b335ac8c5e3279fcdfe63
MD5 69bec2b8696ee0d346d8e2cb4c4f3554
SHA1 208d9f5480caccb508a5539a4f2d92be739c147c
SHA512 72abd7e531cc2d5d399e977990c58ef784a9431d19661754ee47c1ccdc1be64a41f7e014434683188d7b957830f8a1ab26ed57cd38e1a8b785e732b08fadf3f3
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0bc9h3pFEoqPBE:+0s420bTjzGlBrJTJb8QAMQ/Zc4TAE
TLSH
T1245623D6B85E2ABBC20D2CB98D168E6675AC5B71C7605CD3EFD52DF34810CC32632926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\UserSession.exe
Size 5.9MB
SHA256 04c6f91adc5c87926342d826d2a200f9ae8351adb430acd7018ea88b4187b563
MD5 1ee02785d196512c4e9e0f9d568139c9
SHA1 a8ef0c78a4e81c896fbaf6dd3aca47414b345a42
SHA512 1d7d8e1c3fbf273aeaa29d0890cbf54e5157e99e37a15cb1625ae059758c1f1f0c177c473a4a46287abddd5cffc0174851c4f61b9f811af24b264b9d07d46cff
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0bc9h3pFEoqPBEKd:+0s420bTjzGlBrJTJb8QAMQ/Zc4TAES
TLSH
T1A15623D6B85E2ABBC20D1CB98D168E6675AC5BB1C7605CD3EFD52DF34810CC32632926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe
Size 5.8MB
SHA256 9b2000010cba0be1897afb379a0f34df253561fca656c5b6aeb95bec6cf9f39e
MD5 04d5f94e63d135fbe459058fe8b236fc
SHA1 b1ec0466c13ee1322de09353b12f2f82e3214d10
SHA512 cdfb5c1c21511eb35dffb852ce8f2de6fa55a26baf935a7d85e3083af6751266b576772acb1a4753aafa0f06c6087e8765a667bddf18ba851a2cbd7d92e298f0
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0bc9h3pFEoqPB3:+0s420bTjzGlBrJTJb8QAMQ/Zc4TA3
TLSH
T11E5623D6B85E2ABBC20D1CB98D168E6675AC5B71C7605CD3EFD52DF34810CC32A32926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\RuntimeBroker32.exe
Size 6.1MB
SHA256 12bfc0b3fcce77ad70737d04e5c348f59b1c85baace95c28181ae6641e9a7d68
MD5 79ec86bb56148f08f753483b98ceaa6a
SHA1 273de82b006c6c527e085b26501d8dcbd9b8cc40
SHA512 ea80e9478db4df3fd332f86e7fb4f03ca26e6161e04145be1039a5e20d7b915a50808261c2c079fa811ef1af5a026f5604172e45d12ec8df3430c9136ee4c372
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZ0bc9h3pFEoqPBEKg:+0s420bTjzGlBrJTJb8QAMQ/Zc4TAEJ
TLSH
T1215623D6785E2AABC20D1CB98D168E6675AC5BB1C7605CD3EFD52EF34810CC32732926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download