Analysis
- user interaction
yes - max time kernel
34s - max time network
35s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
10/09/2026, 11:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CSX.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
4 signatures
150 seconds
General
- Target CSX.exe
- Size 4.1MB
- Sample260910-nkgn1agf56
- SHA256 d57bca04222545b534724726bb55ee09fa6ccaae248fc9a10711f807974a29a3
- MD5 6c09945d52b148735c9f5d29d86de0a2
- SHA1 afe03d3a33f36e710bfb6bca99b241c1bfdba2d1
- SHA512 69fab617deaa1b0546e098004544fe95ebf0fa098dd73d11a905401e69a6f88f944ddd4e1cae4652342456db4df1889505f27562e8a6fc89b03b56784d99827a
- SSDEEP 98304:f9JjSRgOf7Omk6OyNwIrqJtLFNv5sfjap:f9XO/k7yNwIrutr5Aup
- TLSH T1491601217F719D38CD4671B21D188FE7661AAC313F5F52C23A487B9298224FF62F4926
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 6 raw.githubusercontent.com - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CSX.exe - Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe 4808 CSX.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\CSX\audio_cache.bin
- Size 1.8MB
- SHA256 1d6e95940fac69afd253d04773818b4c404424332ba913dae00ed428a7b79dc6
- MD5 99b02863ade4f4d7d5d9200e643982b9
- SHA1 c1af46e0852b31d4c5753d5ddde2ca6bb3f4e396
- SHA512 2239356b4a44f00c4f38abd45a1b8d70c74381eb0e348d436c9d5c11026550a2cfb446ea6f333bde349c88a8a944d531cb1e15dcf5d1548326a66434bacc4900
- SSDEEP 24576:7tXcJ1yPB7GuoY9vy0dKdXPiIP4mDeKWrzei3CIpyErcCvjK9mysXC0y4:ZXGgyuB9xQPrwmDeOi3lPrcH9my41y4
- TLSH T13185CF43B6828122D4680270E53FEB7F497D7C74072585D3B7C91AE7D9B02E09EB2A97
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\CSX\dxdiag_cache.bin
- Size 180KB
- SHA256 731854a7705d539eee41c47d22112f6e6aa34615b3b61723ec847a3ea0e269af
- MD5 bafd76845da784f889fc7d90c6ff20b3
- SHA1 0f56b16c33f9764772dabc3cbafc6baea034d97b
- SHA512 f6376fd933c1cc62402084bba1771dedd61011abf6ebdde54dc6f4d77e3b489ea25d1fa5a5270167254490d19cd24170ac898f4a54b92848a38b16a8f8103271
- SSDEEP 3072:8N9t5nHwYi3PhpIpx8kFmOz0DuJMJuszALCAWnm345ecu1fxTQFX2pcVPxIiTb4u:4VUppzMP0DuSJu4YXWEmx
- TLSH T1F6046C01F592D03BE6BE0A745931DFA58B7DBD604FE4A8CB77801DFA49306C0AB35A16
- MD5 SHA1 SHA512 SSDEEP TLSH