265ff3e568105a01f8c6d52912715be58f550096b12332fdc86c7c4e80746323

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 21:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
265ff3e568105a01f8c6d52912715be58f550096b12332fdc86c7c4e80746323.exe
Size 54KB
Sample260825-1tel8aep9z
SHA256 265ff3e568105a01f8c6d52912715be58f550096b12332fdc86c7c4e80746323
MD5 cee6789d9a1e821c975a0a2d1369f06e
SHA1 0c787c22b9d79c422589661efbb6ecd65b46c3af
SHA512 cb68f5343312a9203e99435c84f13b2e5b769a4422931e518fc7818912c75e05ecdacdf4bbf09eea7b97d31932584ea5a72438b9b7b904c35eafd38aa858e474
SSDEEP 1536:yrJPmXpYFaCPFCjax+ohiehQW8PwWTuXbpdXT84XmPMv:IPmXpOzAaxcsQ1wpFx84XmEv
TLSH
T17E43083517D242A7FCDBC231CAB4A327F4E17D867BA15A1F0324D9085F67182B5A8AD3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
5	6116	265ff3e568105a01f8c6d52912715be58f550096b12332fdc86c7c4e80746323.exe

Executes dropped EXE 3 IoCs

pid	Process
2804	wlrmdr.exe
1944	oxofkqys.exe
5248	syshost.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1944 set thread context of 4384	1944	oxofkqys.exe	58
PID 5248 set thread context of 4384	5248	syshost.exe	58

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3312	schtasks.exe
1204	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
6116	265ff3e568105a01f8c6d52912715be58f550096b12332fdc86c7c4e80746323.exe
6116	265ff3e568105a01f8c6d52912715be58f550096b12332fdc86c7c4e80746323.exe
1944	oxofkqys.exe
1944	oxofkqys.exe
1944	oxofkqys.exe
1944	oxofkqys.exe
5248	syshost.exe
5248	syshost.exe
5248	syshost.exe
5248	syshost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4860	explorer.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4860	explorer.exe
Token: SeCreatePagefilePrivilege	4860	explorer.exe
Token: SeShutdownPrivilege	4860	explorer.exe
Token: SeCreatePagefilePrivilege	4860	explorer.exe
Token: SeShutdownPrivilege	4860	explorer.exe
Token: SeCreatePagefilePrivilege	4860	explorer.exe
Token: SeShutdownPrivilege	4860	explorer.exe
Token: SeCreatePagefilePrivilege	4860	explorer.exe
Token: SeShutdownPrivilege	4860	explorer.exe
Token: SeCreatePagefilePrivilege	4860	explorer.exe
Token: SeShutdownPrivilege	4860	explorer.exe
Token: SeCreatePagefilePrivilege	4860	explorer.exe
Token: SeShutdownPrivilege	4860	explorer.exe
Token: SeCreatePagefilePrivilege	4860	explorer.exe
Token: SeShutdownPrivilege	4860	explorer.exe
Token: SeCreatePagefilePrivilege	4860	explorer.exe
Token: SeShutdownPrivilege	4860	explorer.exe
Token: SeCreatePagefilePrivilege	4860	explorer.exe
Token: SeShutdownPrivilege	4860	explorer.exe
Token: SeCreatePagefilePrivilege	4860	explorer.exe
Token: SeShutdownPrivilege	4860	explorer.exe
Token: SeCreatePagefilePrivilege	4860	explorer.exe
Token: SeShutdownPrivilege	4860	explorer.exe
Token: SeCreatePagefilePrivilege	4860	explorer.exe
Token: SeShutdownPrivilege	4860	explorer.exe
Token: SeCreatePagefilePrivilege	4860	explorer.exe
Token: SeShutdownPrivilege	4860	explorer.exe
Token: SeCreatePagefilePrivilege	4860	explorer.exe
Token: SeShutdownPrivilege	4860	explorer.exe
Token: SeCreatePagefilePrivilege	4860	explorer.exe
Token: SeShutdownPrivilege	4860	explorer.exe
Token: SeCreatePagefilePrivilege	4860	explorer.exe
Token: SeShutdownPrivilege	4860	explorer.exe
Token: SeCreatePagefilePrivilege	4860	explorer.exe
Token: SeShutdownPrivilege	4860	explorer.exe
Token: SeCreatePagefilePrivilege	4860	explorer.exe
Token: SeShutdownPrivilege	4860	explorer.exe
Token: SeCreatePagefilePrivilege	4860	explorer.exe
Token: SeShutdownPrivilege	4860	explorer.exe
Token: SeCreatePagefilePrivilege	4860	explorer.exe
Token: SeShutdownPrivilege	4860	explorer.exe
Token: SeCreatePagefilePrivilege	4860	explorer.exe
Token: SeShutdownPrivilege	4860	explorer.exe
Token: SeCreatePagefilePrivilege	4860	explorer.exe
Token: SeShutdownPrivilege	4860	explorer.exe
Token: SeCreatePagefilePrivilege	4860	explorer.exe
Token: SeShutdownPrivilege	4860	explorer.exe
Token: SeCreatePagefilePrivilege	4860	explorer.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 6116 wrote to memory of 4384	6116	265ff3e568105a01f8c6d52912715be58f550096b12332fdc86c7c4e80746323.exe	58
PID 6116 wrote to memory of 4436	6116	265ff3e568105a01f8c6d52912715be58f550096b12332fdc86c7c4e80746323.exe	59
PID 6116 wrote to memory of 2668	6116	265ff3e568105a01f8c6d52912715be58f550096b12332fdc86c7c4e80746323.exe	79
PID 6116 wrote to memory of 4860	6116	265ff3e568105a01f8c6d52912715be58f550096b12332fdc86c7c4e80746323.exe	80
PID 4860 wrote to memory of 3468	4860	explorer.exe
PID 6116 wrote to memory of 1944	6116	265ff3e568105a01f8c6d52912715be58f550096b12332fdc86c7c4e80746323.exe	90
PID 1944 wrote to memory of 3312	1944	oxofkqys.exe	91
PID 4860 wrote to memory of 2812	4860	explorer.exe
PID 1944 wrote to memory of 4384	1944	oxofkqys.exe	58
PID 5248 wrote to memory of 1204	5248	syshost.exe	95
PID 5248 wrote to memory of 4384	5248	syshost.exe	58

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4384

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4436

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2668
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Users\Admin\AppData\Local\Temp\265ff3e568105a01f8c6d52912715be58f550096b12332fdc86c7c4e80746323.exe
    "C:\Users\Admin\AppData\Local\Temp\265ff3e568105a01f8c6d52912715be58f550096b12332fdc86c7c4e80746323.exe"
    3⤵
    - Downloads MZ/PE file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\oxofkqys.exe
      "C:\Users\Admin\AppData\Local\Temp\oxofkqys.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1944
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /xml "C:\Users\Admin\AppData\Local\Temp\MsEdgeUpdate.xml" /tn "\Users\Admin\WindowsPushNotifSvc" /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3312

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
1⤵
- Executes dropped EXE
PID:2804

C:\Users\Admin\AppData\Local\Microsoft\syshost.exe
C:\Users\Admin\AppData\Local\Microsoft\syshost.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5248
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /xml "C:\Users\Admin\AppData\Local\Temp\MsEdgeUpdate.xml" /tn "\Users\Admin\WindowsPushNotifSvc" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MsEdgeUpdate.xml

Path C:\Users\Admin\AppData\Local\Temp\MsEdgeUpdate.xml
Size 1KB
SHA256 466afcd86a64fbc3bbe32feb6a92fcf718e5efc338007fb9c9add09e8bfb907c
MD5 b7e3942c73cfd0f1e883c9f7ba1e0abc
SHA1 2e38c45c47a436097c928b92ef100d4828f75415
SHA512 199d3d353d62a07a84c6ca42b41d675275f9f04b77c02bb0d0f482c0fd2e324c50710619280a60f906cbf6831ebc2bf2775cc640418b85b53e1644933e5f9026
TLSH
T1C63124436BFE1209F1F26F5CAAB654215EA3BC654C39D46C00AC250DCAF3D62C961BB7
MD5 SHA1 SHA512 TLSH

Submit Download

oxofkqys.exe

Path C:\Users\Admin\AppData\Local\Temp\oxofkqys.exe
Size 1.0MB
SHA256 5101af2542f117d364de90661a235d98876c36c4d580888adc4907ad35d44f92
MD5 60f86ad0d27ca0c5c0b5ead2954abe18
SHA1 2f85a691f3ef664d300a6e9973c07c3d7dabe090
SHA512 a84868ea5e8856802766c1e305f3d94cf0fbdbbbbc0df36dca5c86943d535a955f64d4407940eef4c26290d2772dbebe9304869ab2e461f55b9ee1c09fdc3dfd
SSDEEP 24576:rtGCx0FyGBMSJ7T9y1nws4G3KB0QlpDHJPjgm4Cj:rHCyGySJ7T9yws4GaDlHrg8
TLSH
T15635D037F9AD41E8DBADB077246CB680D788BB06AFA770BD2A8E34437456C476465303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wlrmdr.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
Size 54KB
SHA256 265ff3e568105a01f8c6d52912715be58f550096b12332fdc86c7c4e80746323
MD5 cee6789d9a1e821c975a0a2d1369f06e
SHA1 0c787c22b9d79c422589661efbb6ecd65b46c3af
SHA512 cb68f5343312a9203e99435c84f13b2e5b769a4422931e518fc7818912c75e05ecdacdf4bbf09eea7b97d31932584ea5a72438b9b7b904c35eafd38aa858e474
SSDEEP 1536:yrJPmXpYFaCPFCjax+ohiehQW8PwWTuXbpdXT84XmPMv:IPmXpOzAaxcsQ1wpFx84XmEv
TLSH
T17E43083517D242A7FCDBC231CAB4A327F4E17D867BA15A1F0324D9085F67182B5A8AD3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4384-0-0x0000024256C00000-0x0000024256C02000-memory.dmp

Download

memory/4384-52-0x0000024258080000-0x00000242580B2000-memory.dmp

Download

memory/4384-58-0x0000024258130000-0x0000024258161000-memory.dmp

Download

memory/4860-12-0x0000000180000000-0x0000000180005000-memory.dmp

Download

memory/4860-13-0x0000000002E80000-0x0000000002E81000-memory.dmp

Download

memory/4860-51-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

Download