34271ee0ecc97adddfdff01edfd5a77d175d4b6d2b1042efe8361880559b854a

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
34271ee0ecc97adddfdff01edfd5a77d175d4b6d2b1042efe8361880559b854a.exe
Size 317KB
Sample260910-p2k87atekh
SHA256 34271ee0ecc97adddfdff01edfd5a77d175d4b6d2b1042efe8361880559b854a
MD5 5b756337387b74fd00cd2bf6c5ca977e
SHA1 284e7dbcbc2ba06723d03b30fb809b6771d0cbab
SHA512 42a879612ae590ba9279cf892f1a4d87ce2b4fa52488151f5ed940b718a98fc19f5bbb86fe946b83f0a7a9999e3c9f77cc5dc372d662735d77a0d3fb44c9bef9
SSDEEP 6144:kQ8OyYvc36AVuc7DQd/5zlgBR4JDeyeVbS28rG:kj16Qu15yBRCDNM8rG
TLSH
T1AF648D5AF3A814F9F9B7923CC8529507F672BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
216	apprtd000.exe
4572	apprtd000.exe
4704	svcd000.exe
2724	svcd000.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AppRtd000 = "C:\\Users\\Admin\\AppData\\Local\\AppRtd000\\apprtd000.exe"	34271ee0ecc97adddfdff01edfd5a77d175d4b6d2b1042efe8361880559b854a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AppSvcd000 = "C:\\Users\\Admin\\AppData\\Local\\Programs\\d000\\svcd000.exe"	apprtd000.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4124	34271ee0ecc97adddfdff01edfd5a77d175d4b6d2b1042efe8361880559b854a.exe
4124	34271ee0ecc97adddfdff01edfd5a77d175d4b6d2b1042efe8361880559b854a.exe
216	apprtd000.exe
216	apprtd000.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 216	4124	34271ee0ecc97adddfdff01edfd5a77d175d4b6d2b1042efe8361880559b854a.exe	96
PID 216 wrote to memory of 4704	216	apprtd000.exe	99

C:\Users\Admin\AppData\Local\Temp\34271ee0ecc97adddfdff01edfd5a77d175d4b6d2b1042efe8361880559b854a.exe
"C:\Users\Admin\AppData\Local\Temp\34271ee0ecc97adddfdff01edfd5a77d175d4b6d2b1042efe8361880559b854a.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Users\Admin\AppData\Local\AppRtd000\apprtd000.exe
  "C:\Users\Admin\AppData\Local\AppRtd000\apprtd000.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:216
- - C:\Users\Admin\AppData\Local\Programs\d000\svcd000.exe
    "C:\Users\Admin\AppData\Local\Programs\d000\svcd000.exe"
    3⤵
    - Executes dropped EXE
    PID:4704

C:\Users\Admin\AppData\Local\AppRtd000\apprtd000.exe
C:\Users\Admin\AppData\Local\AppRtd000\apprtd000.exe
1⤵
- Executes dropped EXE
PID:4572

C:\Users\Admin\AppData\Local\Programs\d000\svcd000.exe
C:\Users\Admin\AppData\Local\Programs\d000\svcd000.exe
1⤵
- Executes dropped EXE
PID:2724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprtd000.exe

Path C:\Users\Admin\AppData\Local\AppRtd000\apprtd000.exe
Size 317KB
SHA256 37f52e89a396cb5da0984c03163dfa1cd78a8e2efac5f31b725bdf2da21a21c7
MD5 742ede8e9dd29ad77abd97449e298f1a
SHA1 54aa6fbd88250797e5fb35751395a3b133e627c5
SHA512 f5e0dadf8aec777df13fee175c096b7d44d3b6b102b3b528ad3cbdb93095d2579d0c86c850c786db5313f72fd387582264d04cbedb07961ffd0f7e8a02f8d581
SSDEEP 6144:6Q8OyYvc36AVuc7DQd/5zlgBR4JDgyeubSJlrT:6j16Qu15yBRCDTylrT
TLSH
T121648D5AF3A814F9F977923CC8529607E772BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svcd000.exe

Path C:\Users\Admin\AppData\Local\Programs\d000\svcd000.exe
Size 317KB
SHA256 7c40df48d78150328e20f666bb6dd7de0b641eab377b57ff0730d42112dc53e8
MD5 0e755007bac7009d930b06aaffc530b8
SHA1 6708201f73f850e4e30d36a9f8a70328f1bae65a
SHA512 6f4fb7e1bdc1195b3310a9b22c8f538a1c6148a4bdd27612ee9e2faf67ba9ddc5de7ba058c6daa0ee9f1c248734de449e24ab21b35050c9eed5f53798ab6384c
SSDEEP 6144:+Q8OyYvc36AVuc7DQd/5zlgBR4JD4yeTebSDhrM:+j16Qu15yBRCDrmXhrM
TLSH
T159648D5AF3A814F9F977923CC8529507F6B2BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download