Analysis
- max time kernel
149s - max time network
78s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/09/2026, 13:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
server.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
server.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target server.exe
- Size 32KB
- Sample260913-ranaksgl2w
- SHA256 5b7ab1dc1f734da9db9334deb5af55dc00512080fb641f43b6cbf4d1b71eae48
- MD5 b5c1e6f3b65a26ad3b841078c456938d
- SHA1 bbde99a69cd679c967a1c221934ce75c1ac39bcc
- SHA512 de25310b74d022d6262293b7b71413d6ee7ec8c82c5793f55329cde134f3ea835526bfa5deee8572df78b7db2eb568ffd75a3af9a81afd79454d5581e7080ec0
- SSDEEP 384:vtHw9lRPwz2jSUpInHDzcNIpBKywTDwMGWYccF3BoJzEY+tHVkw3ccNwifGIyLsH:v5w9lRPwzpjbvwTDwMh+Uw3ccrfLlqr
- TLSH T176E2094C73A48A23C67E57B84E70964207F1C14B5526EBAF8EC550DA1EA7BE41E00EF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4600 netsh.exe - Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e4bb54a1bf9366c54d1d9a99da0e1403.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e4bb54a1bf9366c54d1d9a99da0e1403.exe server.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe - Suspicious use of AdjustPrivilegeToken 57 IoCs
description pid Process Token: SeDebugPrivilege 3156 server.exe Token: 33 3156 server.exe Token: SeIncBasePriorityPrivilege 3156 server.exe Token: 33 3156 server.exe Token: SeIncBasePriorityPrivilege 3156 server.exe Token: 33 3156 server.exe Token: SeIncBasePriorityPrivilege 3156 server.exe Token: 33 3156 server.exe Token: SeIncBasePriorityPrivilege 3156 server.exe Token: 33 3156 server.exe Token: SeIncBasePriorityPrivilege 3156 server.exe Token: 33 3156 server.exe Token: SeIncBasePriorityPrivilege 3156 server.exe Token: 33 3156 server.exe Token: SeIncBasePriorityPrivilege 3156 server.exe Token: 33 3156 server.exe Token: SeIncBasePriorityPrivilege 3156 server.exe Token: 33 3156 server.exe Token: SeIncBasePriorityPrivilege 3156 server.exe Token: 33 3156 server.exe Token: SeIncBasePriorityPrivilege 3156 server.exe Token: 33 3156 server.exe Token: SeIncBasePriorityPrivilege 3156 server.exe Token: 33 3156 server.exe Token: SeIncBasePriorityPrivilege 3156 server.exe Token: 33 3156 server.exe Token: SeIncBasePriorityPrivilege 3156 server.exe Token: 33 3156 server.exe Token: SeIncBasePriorityPrivilege 3156 server.exe Token: 33 3156 server.exe Token: SeIncBasePriorityPrivilege 3156 server.exe Token: 33 3156 server.exe Token: SeIncBasePriorityPrivilege 3156 server.exe Token: 33 3156 server.exe Token: SeIncBasePriorityPrivilege 3156 server.exe Token: 33 3156 server.exe Token: SeIncBasePriorityPrivilege 3156 server.exe Token: 33 3156 server.exe Token: SeIncBasePriorityPrivilege 3156 server.exe Token: 33 3156 server.exe Token: SeIncBasePriorityPrivilege 3156 server.exe Token: 33 3156 server.exe Token: SeIncBasePriorityPrivilege 3156 server.exe Token: 33 3156 server.exe Token: SeIncBasePriorityPrivilege 3156 server.exe Token: 33 3156 server.exe Token: SeIncBasePriorityPrivilege 3156 server.exe Token: 33 3156 server.exe Token: SeIncBasePriorityPrivilege 3156 server.exe Token: 33 3156 server.exe Token: SeIncBasePriorityPrivilege 3156 server.exe Token: 33 3156 server.exe Token: SeIncBasePriorityPrivilege 3156 server.exe Token: 33 3156 server.exe Token: SeIncBasePriorityPrivilege 3156 server.exe Token: 33 3156 server.exe Token: SeIncBasePriorityPrivilege 3156 server.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3156 wrote to memory of 4600 3156 server.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"1⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4600
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1