2ab9a1146d8174deabb3c697ce5efc4eceba200977871917bc1c265a8eb16f0e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 11:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2ab9a1146d8174deabb3c697ce5efc4eceba200977871917bc1c265a8eb16f0e.exe
Size 317KB
Sample260910-m52dgasblc
SHA256 2ab9a1146d8174deabb3c697ce5efc4eceba200977871917bc1c265a8eb16f0e
MD5 cec7653c89b232f286e07b71a54082d9
SHA1 7ca28076ed4c299fd40e463fd7c18c07cc427799
SHA512 32de74797616a92eba4fa13722decb87ec0edb1f0f68625e1496d5616133eaae71a6d879b1407cc4ac9dd6b55b735749f2dd8d2ef5018aac4ab6c24c0a8845c4
SSDEEP 6144:UQ8OyYvc36AVuc7DQd/5zlgBR4JDPye3bSAfraM:Uj16Qu15yBRCDa4fraM
TLSH
T121648D5AF3A814F9F977923CC8529607E772BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1104	apprta94d.exe
4200	apprta94d.exe
1724	svca94d.exe
4368	svca94d.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AppSvca94d = "C:\\Users\\Admin\\AppData\\Local\\Programs\\a94d\\svca94d.exe"	apprta94d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AppRta94d = "C:\\Users\\Admin\\AppData\\Local\\AppRta94d\\apprta94d.exe"	2ab9a1146d8174deabb3c697ce5efc4eceba200977871917bc1c265a8eb16f0e.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4692	2ab9a1146d8174deabb3c697ce5efc4eceba200977871917bc1c265a8eb16f0e.exe
4692	2ab9a1146d8174deabb3c697ce5efc4eceba200977871917bc1c265a8eb16f0e.exe
1104	apprta94d.exe
1104	apprta94d.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 1104	4692	2ab9a1146d8174deabb3c697ce5efc4eceba200977871917bc1c265a8eb16f0e.exe	89
PID 1104 wrote to memory of 1724	1104	apprta94d.exe	96

C:\Users\Admin\AppData\Local\Temp\2ab9a1146d8174deabb3c697ce5efc4eceba200977871917bc1c265a8eb16f0e.exe
"C:\Users\Admin\AppData\Local\Temp\2ab9a1146d8174deabb3c697ce5efc4eceba200977871917bc1c265a8eb16f0e.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Users\Admin\AppData\Local\AppRta94d\apprta94d.exe
  "C:\Users\Admin\AppData\Local\AppRta94d\apprta94d.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Users\Admin\AppData\Local\Programs\a94d\svca94d.exe
    "C:\Users\Admin\AppData\Local\Programs\a94d\svca94d.exe"
    3⤵
    - Executes dropped EXE
    PID:1724

C:\Users\Admin\AppData\Local\AppRta94d\apprta94d.exe
C:\Users\Admin\AppData\Local\AppRta94d\apprta94d.exe
1⤵
- Executes dropped EXE
PID:4200

C:\Users\Admin\AppData\Local\Programs\a94d\svca94d.exe
C:\Users\Admin\AppData\Local\Programs\a94d\svca94d.exe
1⤵
- Executes dropped EXE
PID:4368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprta94d.exe

Path C:\Users\Admin\AppData\Local\AppRta94d\apprta94d.exe
Size 317KB
SHA256 fff8823152e31b5ab1b352f41a1c1fa6a710a987e6f1e2cbe0d01a235d042396
MD5 6960930ace6a61a2ad33eab67ddcaf70
SHA1 b999829351f6f2d1ccc094c39ae5822252c9a38e
SHA512 8a1d4a5e5b2e96fd8bad69a62cd154736d7e92599fd8eb98e6de747d3af1f93344665dadd2d951aa14de6ee6e461d0f7255467885f1501ec39c512f0f2a205e4
SSDEEP 6144:uQ8OyYvc36AVuc7DQd/5zlgBR4JDoyeybSKfrO2T:uj16Qu15yBRCDbpfrLT
TLSH
T1F9648D5AF3A804F9F9B7923CC9529607E772BC160760D78F27A046663F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svca94d.exe

Path C:\Users\Admin\AppData\Local\Programs\a94d\svca94d.exe
Size 317KB
SHA256 41b9f7691e8ca63fbdd4d61529ffee9fe77053da728c7222255fcad494a85325
MD5 4e660ebaea1b5a3de571d5aec0e6c475
SHA1 ab37d776283b16775599fe6803a8854d017be200
SHA512 63d363604cace05f902b4377e9bd49467e192cb171720eac0209ebaabd3e5661553371be8077a0b1be58c8e80f9cc9aed9bc22dad3b86a1f112bbf03e89dc2d9
SSDEEP 6144:2HQ8OyYvc36AVuc7DQd/5zlgBR4JD7yeUbSztr12:2Hj16Qu15yBRCDGKtr12
TLSH
T1C9648D5AF3A814F9F977923CC8529607E772BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download