2168af2e9b8e69be1eb9ff292e173d281fd89f7aff2ef054ef2f5a9ea3bd5dd9

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 09:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2168af2e9b8e69be1eb9ff292e173d281fd89f7aff2ef054ef2f5a9ea3bd5dd9.exe
Size 316KB
Sample260910-k76pvsam5x
SHA256 2168af2e9b8e69be1eb9ff292e173d281fd89f7aff2ef054ef2f5a9ea3bd5dd9
MD5 bfdb19471266ef9e78ed2b3a36d9187f
SHA1 2ef10b4984548558a2e37572bfcde1657a167f2e
SHA512 d2273d9e7fb27c6bcad46123e826a33f2ae1ad9e3a77841cab6403764ae38b6b5d14daac12e05c228203c9925458f80a72f809235008cb281d025cb770e2b827
SSDEEP 6144:QQ8OyYvc36AVuc7DQd/5zlgBR4JDSyeJubSzuri:Qj16Qu15yBRCDB2uri
TLSH
T11B648C5AF3A804F9E977923CC9529607F772BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2576	apprt996c.exe
5068	apprt996c.exe
3184	svc996c.exe
2772	svc996c.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AppRt996c = "C:\\Users\\Admin\\AppData\\Local\\AppRt996c\\apprt996c.exe"	2168af2e9b8e69be1eb9ff292e173d281fd89f7aff2ef054ef2f5a9ea3bd5dd9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AppSvc996c = "C:\\Users\\Admin\\AppData\\Local\\Programs\\996c\\svc996c.exe"	apprt996c.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4740	2168af2e9b8e69be1eb9ff292e173d281fd89f7aff2ef054ef2f5a9ea3bd5dd9.exe
4740	2168af2e9b8e69be1eb9ff292e173d281fd89f7aff2ef054ef2f5a9ea3bd5dd9.exe
2576	apprt996c.exe
2576	apprt996c.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 2576	4740	2168af2e9b8e69be1eb9ff292e173d281fd89f7aff2ef054ef2f5a9ea3bd5dd9.exe	100
PID 2576 wrote to memory of 3184	2576	apprt996c.exe	103

C:\Users\Admin\AppData\Local\Temp\2168af2e9b8e69be1eb9ff292e173d281fd89f7aff2ef054ef2f5a9ea3bd5dd9.exe
"C:\Users\Admin\AppData\Local\Temp\2168af2e9b8e69be1eb9ff292e173d281fd89f7aff2ef054ef2f5a9ea3bd5dd9.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Users\Admin\AppData\Local\AppRt996c\apprt996c.exe
  "C:\Users\Admin\AppData\Local\AppRt996c\apprt996c.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Users\Admin\AppData\Local\Programs\996c\svc996c.exe
    "C:\Users\Admin\AppData\Local\Programs\996c\svc996c.exe"
    3⤵
    - Executes dropped EXE
    PID:3184

C:\Users\Admin\AppData\Local\AppRt996c\apprt996c.exe
C:\Users\Admin\AppData\Local\AppRt996c\apprt996c.exe
1⤵
- Executes dropped EXE
PID:5068

C:\Users\Admin\AppData\Local\Programs\996c\svc996c.exe
C:\Users\Admin\AppData\Local\Programs\996c\svc996c.exe
1⤵
- Executes dropped EXE
PID:2772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprt996c.exe

Path C:\Users\Admin\AppData\Local\AppRt996c\apprt996c.exe
Size 316KB
SHA256 84e5f1d8b1f5fcfbb59bc17c69c9ffad307c4b2e9492eee3d4ac1b911d79d842
MD5 bb75e60233998aa3c7b79bd90d853880
SHA1 a310b0d36d6cc1f15fb0162ead035b570015d89f
SHA512 46ac0cd8371050ea5cd0753f7b9b0e06a083d3da3d18c87baea48e5977ebbc870d83138ade0d6b94ccc9b63bfa3828d65f59187134f2f1a353579874de94dc2f
SSDEEP 6144:YQ8OyYvc36AVuc7DQd/5zlgBR4JDGyeYhbSwXrz:Yj16Qu15yBRCDVT9Xrz
TLSH
T11B648D5AF3A814F9F977923CC8529607F672BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc996c.exe

Path C:\Users\Admin\AppData\Local\Programs\996c\svc996c.exe
Size 316KB
SHA256 77826f891444e97b48972cbc9a804a357487b07557f943175e68bf015d3e33cb
MD5 8f1fbbce46944d047bfac24ac5d9b64b
SHA1 5696b4d848cb0063a86fa4b43a1a41607d26231c
SHA512 af0e7344e6d8d20696c1c06cd5d4774c48ce98aa8d289772d06f4811e4c33da129e5da1b510450f00a887e5bde0840732064e71245ddc071b61c36e3cdcf6a0f
SSDEEP 6144:IQ8OyYvc36AVuc7DQd/5zlgBR4JDlye1bSCAIrq:Ij16Qu15yBRCDMoAIrq
TLSH
T10B648D5AF3A904F9F977923CC8529607E772BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download