35c19d16d6c224b9d1d69b173b56f23d8e5c44d8e9eb69a47c91f30172dd6c14

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 21:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
35c19d16d6c224b9d1d69b173b56f23d8e5c44d8e9eb69a47c91f30172dd6c14.exe
Size 363KB
Sample260826-zydeaafd39
SHA256 35c19d16d6c224b9d1d69b173b56f23d8e5c44d8e9eb69a47c91f30172dd6c14
MD5 4c99346dc56b842a7ead17efc699780b
SHA1 f47c8953ef40b104e4a2ab3fee4aca4bf656d7ae
SHA512 9a1994dc759742861cdcfcbb20e48ceda0698e600463168679b88074374c97657a5d0d48f36a3f7b859c55fec4443f7abfaf561d22df43992e8db9236738782e
SSDEEP 6144:hGCsdNylF3mDEr9fztpd5HHL/cVxPdoRnkobzHU0K/vX1cLETWIMQ5PtJ:h9sdqDpztpd5HjYIdbg0K3X1cQyIh5T
TLSH
T18C8423AED2A91B7ACED712737D6E4C454221E5BF8A70B1C3B43024DF99406A2DCCE06D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
696	hSwo5JpL37U8zYh.exe
4360	CTS.exe
1508	CTS.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	35c19d16d6c224b9d1d69b173b56f23d8e5c44d8e9eb69a47c91f30172dd6c14.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4908-0-0x0000000000D90000-0x0000000000DA7000-memory.dmp	upx
behavioral1/memory/4360-10-0x00000000005D0000-0x00000000005E7000-memory.dmp	upx
behavioral1/memory/4908-9-0x0000000000D90000-0x0000000000DA7000-memory.dmp	upx
behavioral1/files/0x000800000002435e-8.dat	upx
behavioral1/files/0x0005000000021560-13.dat	upx
behavioral1/files/0x000a000000023fd3-36.dat	upx
behavioral1/memory/1508-41-0x00000000005D0000-0x00000000005E7000-memory.dmp	upx
behavioral1/memory/4360-42-0x00000000005D0000-0x00000000005E7000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	35c19d16d6c224b9d1d69b173b56f23d8e5c44d8e9eb69a47c91f30172dd6c14.exe
File created	C:\Windows\CTS.exe	CTS.exe
File created	C:\Windows\CTS.exe	CTS.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	35c19d16d6c224b9d1d69b173b56f23d8e5c44d8e9eb69a47c91f30172dd6c14.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CTS.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4908	35c19d16d6c224b9d1d69b173b56f23d8e5c44d8e9eb69a47c91f30172dd6c14.exe
Token: SeDebugPrivilege	4360	CTS.exe
Token: SeDebugPrivilege	1508	CTS.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 4360	4908	35c19d16d6c224b9d1d69b173b56f23d8e5c44d8e9eb69a47c91f30172dd6c14.exe	87

C:\Users\Admin\AppData\Local\Temp\35c19d16d6c224b9d1d69b173b56f23d8e5c44d8e9eb69a47c91f30172dd6c14.exe
"C:\Users\Admin\AppData\Local\Temp\35c19d16d6c224b9d1d69b173b56f23d8e5c44d8e9eb69a47c91f30172dd6c14.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Users\Admin\AppData\Local\Temp\hSwo5JpL37U8zYh.exe
  C:\Users\Admin\AppData\Local\Temp\hSwo5JpL37U8zYh.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4360

C:\Windows\CTS.exe
C:\Windows\CTS.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 31KB
SHA256 a293ca1cf5d82e8d45460b569aa2f5f1ea62257300e2df92b83984c2bfc9f924
MD5 48426919650af7842949156ec0816f9b
SHA1 6996d9b6107093692d1d61e71be415575b9779af
SHA512 fd129a2dbd8ddb94c9db4abfea871af9f8379c83aa39a94e8eee5d0171e7edb1bcb7329d71a8ddcabbdd3b570bdcbff7da7e3a475c3f568ebf4f7d7c6a8d487d
SSDEEP 768:XocAX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIocVSEFRYsmFQWtQ:SKcR4mjD9r823FR/mFltQ
TLSH
T11DE2E17CFBCA0E39DB92A13F34DE591D6915E636448D424B253BB083B9B139C74D2720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hSwo5JpL37U8zYh.exe

Path C:\Users\Admin\AppData\Local\Temp\hSwo5JpL37U8zYh.exe
Size 334KB
SHA256 58b7e175725ddf68a7a6c891889daaa3b7d4f90c14bfcff287cb3336cbd7da60
MD5 f310d4e936b68a5d76b7b808507e99f9
SHA1 6dccf493508f97212688413bec28f86befbff8e2
SHA512 daead56dfdd7b4a7a8fabdc6e12144273aae244aa90817d76281e5a7414e3f07ca2761f481bda91a47fc3c1c911ff1783e7421e566e3b3fc59b443de141d9e5d
SSDEEP 3072:5R4MYDAJyY8PPai8DqjX1yyTnTfqGuEGElJRsIxldzVerpYJlDwKSNL+gwCp4LJi:5G0OIyTTWSTRzVerpUNxFpmNKK
TLSH
T1B074B55170D0DF32CAB21038669AAE54DE68A1E343342CC3B2CD7BAB5FF6590553726B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hSwo5JpL37U8zYh.exe

Path C:\Users\Admin\AppData\Local\Temp\hSwo5JpL37U8zYh.exe
Size 363KB
SHA256 5e3a3053b6ecf75d3c3d5bdb8338cb1ead69dd3789cac672cdd776e73adfa25c
MD5 d7607ccfbc8fad57a891e497ef44a419
SHA1 96438f4c2d6aff995b5f5e05bcab7518e0e57c80
SHA512 ae1748d0204666b96dccc1ee10a43a2616a8a504a9cc3337c229baa41d8f0efdf8a4062bc99a6c31a86dcf2f0e44a7fa85ddfc6c81cd0acaf935f63ae2ae405a
SSDEEP 6144:hGHy6yGF9pP9f4AuBr7JlToCZwuBigq01BJPN9dSHx7AJ1B2F4:h+l9plf4Au/GqpDnVNmHqJP2F4
TLSH
T1AB8423A1CBCA3175CE9501F69FE3FD06F5B4A9B906AAC671370F8441B84714E9BD3822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CTS.exe

Path C:\Windows\CTS.exe
Size 29KB
SHA256 9d25cc704b1c00c9d17903e25ca35c319663e997cb9da0b116790b639e9688f2
MD5 70aa23c9229741a9b52e5ce388a883ac
SHA1 b42683e21e13de3f71db26635954d992ebe7119e
SHA512 be604a2ad5ab8a3e5edb8901016a76042ba873c8d05b4ef8eec31241377ec6b2a883b51c6912dc7640581ffa624547db334683975883ae74e62808b5ae9ab0b5
SSDEEP 768:XocAX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIocVSEF:SKcR4mjD9r823F
TLSH
T176D2E17CFBCA0E39DBD2613F35EA591E6955D637418E524B213B7083B9A13BC24C3624
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1508-41-0x00000000005D0000-0x00000000005E7000-memory.dmp

Download

memory/4360-10-0x00000000005D0000-0x00000000005E7000-memory.dmp

Download

memory/4360-42-0x00000000005D0000-0x00000000005E7000-memory.dmp

Download

memory/4908-0-0x0000000000D90000-0x0000000000DA7000-memory.dmp

Download

memory/4908-9-0x0000000000D90000-0x0000000000DA7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads