b9e69c510116c6b266d0c957cce30fd872532dbbf1f5e20d0edcafd32968f9f5

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AG_2.10.0_3.exe
Size 998KB
Sample260827-pfty7sgq8v
SHA256 b9e69c510116c6b266d0c957cce30fd872532dbbf1f5e20d0edcafd32968f9f5
MD5 dbe8b714ab6d4dc3412175a369ed248a
SHA1 ef1caae1a4d5056257e7ab61e015b2ec2ac5fd27
SHA512 4dc826d2fd019ebd28060960a9953319d3b50ca7474cdae6cc9d0163776daa7830042d022ed92ba51aa65f61467c1ae10f740705bb500abcee6895383d63e7e0
SSDEEP 24576:Zc7QCSainyL0kDHZa+MvEPefyEVeuxQCHuTrt5R0Vvk:ZckC1bFDHZGvz7Iuxe9m
TLSH
T1072533AD7B71F995D3B8C1F6D891A14A31AB6DF315023F5A5088BEBDDCB8E19250C803
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4260-0-0x00007FF6DF630000-0x00007FF6DF8E1000-memory.dmp	upx
behavioral2/memory/4260-1-0x00007FF6DF630000-0x00007FF6DF8E1000-memory.dmp	upx

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6128	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 6128	4260	AG_2.10.0_3.exe	90

C:\Users\Admin\AppData\Local\Temp\AG_2.10.0_3.exe
"C:\Users\Admin\AppData\Local\Temp\AG_2.10.0_3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Windows\system32\cmd.exe
  "cmd" /C "color 0A"
  2⤵
  - Executes a command shell one-liner
  PID:6128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4260-0-0x00007FF6DF630000-0x00007FF6DF8E1000-memory.dmp

Download

memory/4260-1-0x00007FF6DF630000-0x00007FF6DF8E1000-memory.dmp