bd29ae2fccd2765d23ae043d3c1a0e2e72a46d11bd449b3884ecf4e5f39deb2a

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 19:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dl.hta
Size 1KB
Sample260907-xrm9sseq8z
SHA256 bd29ae2fccd2765d23ae043d3c1a0e2e72a46d11bd449b3884ecf4e5f39deb2a
MD5 707f0512d1fa15e03a5c5700bfc11d05
SHA1 7919f1de90367e4a79d0e3521f5e12d469014e82
SHA512 c12167fe1905b61a31bc9f6a60a9b9cf33e9e626b0dd7c535d5bcc64c7fec6bd694ff2719754454d031d297b66943a7eaa7841d1fc39d9a1c66491cb300712df
TLSH
T163111277E406D6350B2294D43094D82CD4A344D680948133EA8CC8E47E2B7CCFB2C7EA
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 10 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	4660	mshta.exe
2	4660	mshta.exe
3	4660	mshta.exe
4	4724	cscript.exe
5	4724	cscript.exe
6	4724	cscript.exe
7	4724	cscript.exe
8	4724	cscript.exe
9	4724	cscript.exe
10	4660	mshta.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
6	4724	cscript.exe

Creates a file in the Startup directory 1 TTPs 5 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uvupd.exe	cscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftEdgeUpdate.lnk	RuttileBroker.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SummitClientAgent.lnk	RuttileBroker.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftEdgeUpdate.lnk	SummitClientAgent.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SummitClientAgent.lnk	SummitClientAgent.exe

Executes dropped EXE 4 IoCs

pid	Process
4220	RuttileBroker.exe
3208	SummitClientAgent.exe
2468	SummitClientAgent.exe
3364	SummitClientAgent.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4724	cscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SummitClientAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuttileBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SummitClientAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SummitClientAgent.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2468	SummitClientAgent.exe
2468	SummitClientAgent.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 4724	4660	mshta.exe	89
PID 4724 wrote to memory of 4220	4724	cscript.exe	92
PID 4220 wrote to memory of 3208	4220	RuttileBroker.exe	93
PID 2468 wrote to memory of 3364	2468	SummitClientAgent.exe	96

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\dl.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\SysWOW64\cscript.exe
  "C:\Windows\System32\cscript.exe" //nologo //B "C:\Users\Admin\AppData\Local\Temp\dlr.vbs"
  2⤵
  - Badlisted process makes network request
  - Downloads MZ/PE file
  - Creates a file in the Startup directory
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Users\Admin\AppData\Local\Temp\RuttileBroker.exe
    "C:\Users\Admin\AppData\Local\Temp\RuttileBroker.exe"
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4220
  - - C:\Users\Admin\AppData\Local\SummitClientAgent\SummitClientAgent.exe
      "C:\Users\Admin\AppData\Local\SummitClientAgent\SummitClientAgent.exe"
      4⤵
      Creates a file in the Startup directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3208

C:\Users\Admin\AppData\Local\SummitClientAgent\SummitClientAgent.exe
"C:\Users\Admin\AppData\Local\SummitClientAgent\SummitClientAgent.exe" --service
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Users\Admin\AppData\Local\SummitClientAgent\SummitClientAgent.exe
  "C:\Users\Admin\AppData\Local\SummitClientAgent\SummitClientAgent.exe" --session-helper
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SummitClientAgent.exe.cleanup

Path C:\Users\Admin\AppData\Local\SummitClientAgent\SummitClientAgent.exe.cleanup
Size 51B
SHA256 48992dbaa509b408bee5cf712d7b1a2b81468151ed57adee1ef8201a45e38604
MD5 3c160bb131a04ff71058bfbd8b00d0d1
SHA1 ba9f0fe2c0440d83e09b8072037cac2c5bb70b43
SHA512 c19ee90738ace9f11bfabfaf70ed59b3023c8af8861cb1aaf65b213b0a5d65166daae4a9d21323c6299f84ff10c8f2dd46286260fec444a6c1c300b8d8fe6c1b
TLSH
T1B590024045CBD666048450674D7165FC816A09592A5F37905724C4082155449A58A711
MD5 SHA1 SHA512 TLSH

Submit Download

RuttileBroker.exe

Path C:\Users\Admin\AppData\Local\Temp\RuttileBroker.exe
Size 889KB
SHA256 6011c457fe0de19ebda63769587a15ec35ee77414691809407c3acfd53737cb2
MD5 f64c48e0fc10cbef11ac66c68f42384a
SHA1 27bf23f30268346bb905a1a7b5c98a79a6d02dae
SHA512 f5c45c8f5e274d3e18c788824ec4f9bd1b3565f5e6510af2f027a9de5a1f6b5c0e35cdd41523735da193b4a563cdf8b05d2763ecf56aefbe0c4b75d4180fa93e
SSDEEP 24576:H9MIzrq+QfdcbtlqUr1V8jcNLukph+hgkuKb/EIyNOekPDZExH+wfYK87O:dMKlqk1V8bGM9EIkO5lEJ+m8C
TLSH
T1AA15CF09E60305F6D12382B189DFD7BBD220BA5D8222AE7FFF4ECD45F1727012A5519A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dlr.vbs

Path C:\Users\Admin\AppData\Local\Temp\dlr.vbs
Size 1KB
SHA256 aa75725634e9d7c4004b625c3f5d216dbddaeeda06e1fa7308a28a87c60b5b23
MD5 43a39f7b705a9aa3bdbd06a3be6e763c
SHA1 6d24a68a33f56e05004239ffe9ccb5638e293bbb
SHA512 9aa7b89580cf01889037ad4b02877359dafeefe0b9e13687645d94f3ef660c0a2f90914982523a6ea5bcfa8ebabb6f50df031ec88e891dcdb2cd2aa5e514ecb7
TLSH
T1A9317202E607DFF863929CF4B394391AA5F0C96B66051036D6CC8954770F9B53774A36
MD5 SHA1 SHA512 TLSH

Submit Download

SummitClientAgent.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SummitClientAgent.lnk
Size 1KB
SHA256 4f4dc6f2c7c9350ca60bddba147d5a04c99bac14c8734bae0a5df37ed07563e8
MD5 1dc216294d389d605a58dced1fb50ed5
SHA1 edee8e3894bf91c8692ba9305ae7fb3b7d17de0b
SHA512 f023e8428cabc6626d9f9699757d2e0bd650ac7cd868fddc40f58b3c506d37cabaef9458617bfcc47434b7b8c89d4964731ccd188ec6af88f92c8e00e66715f6
TLSH
T14921CC128ACF2B5AD3C843B669BA6215EA32FC46F760DF4D50B1821E2911A52A804F5F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2468-50-0x0000000066CC0000-0x0000000066E40000-memory.dmp

Download

memory/2468-40-0x0000000066CC0000-0x0000000066E40000-memory.dmp

Download

memory/2468-70-0x0000000000320000-0x0000000000405000-memory.dmp

Download

memory/2468-52-0x0000000066CC0000-0x0000000066E40000-memory.dmp

Download

memory/2468-51-0x0000000066CC0000-0x0000000066E40000-memory.dmp

Download

memory/3208-36-0x0000000066CC0000-0x0000000066E40000-memory.dmp

Download

memory/3208-37-0x0000000066CC0000-0x0000000066E40000-memory.dmp

Download

memory/3208-20-0x0000000000320000-0x0000000000405000-memory.dmp

Download

memory/3208-26-0x0000000066CC0000-0x0000000066E40000-memory.dmp

Download

memory/3208-54-0x0000000066CC0000-0x0000000066E40000-memory.dmp

Download

memory/3208-55-0x0000000000320000-0x0000000000405000-memory.dmp

Download

memory/3208-25-0x0000000001650000-0x0000000001651000-memory.dmp

Download

memory/3364-69-0x0000000066CC0000-0x0000000066E40000-memory.dmp

Download

memory/3364-71-0x0000000000320000-0x0000000000405000-memory.dmp

Download

memory/4220-16-0x0000000000530000-0x0000000000615000-memory.dmp

Download