Overview

overview

10

Static

static

3

2026-09-16...da.exe

windows10-2004-x64

10

2026-09-16...da.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    114s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/09/2026, 23:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-16_2abe5b8e0f5613293db574ca911aaa2b_coinminer_rhysida.exe
  • Size 916KB
  • Sample260916-2zslpswfmc
  • SHA256 79a702ab8c235f5713672107d9c29ef2e3f97f55f852fffcdf24b6787b10f4ad
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdiscoveryexecutionrhysidapersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Signatures

  • Family: Rhysida

    Rhysida is a ransomware that is written in C++ and discovered in 2023.

    ransomwarerhysida
  • Detects Rhysida ransom note 1 IoCs
  • Renames multiple (9664) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_2abe5b8e0f5613293db574ca911aaa2b_coinminer_rhysida.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_2abe5b8e0f5613293db574ca911aaa2b_coinminer_rhysida.exe"
    1⤵
    • Creates a file in the Startup directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3080
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\Admin\AppData\Local\Temp\C:\Users\Admin\AppData\Local\Temp\2026-09-16_2abe5b8e0f5613293db574ca911aaa2b_coinminer_rhysida.exe"
      2⤵
      • Executes a command shell one-liner
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:2356
      • C:\Windows\system32\cmd.exe
        cmd.exe /c start ping 127.0.0.1 -n 2
        3⤵
        • Executes a command shell one-liner
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:5984
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.1 -n 2
          4⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:4924

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        Windows Command Shell

        1
        T1059.003

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Defense Evasion

        Credential Access

        Credentials from Password Stores

        2
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Windows Credential Manager

        1
        T1555.004

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Browser Information Discovery

        1
        T1217

        Remote System Discovery

        1
        T1018

        System Network Configuration Discovery

        1
        T1016

        Internet Connection Discovery

        1
        T1016.001

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        CriticalBreachDetected.pdf
        • Path C:\Program Files\7-Zip\Lang\CriticalBreachDetected.pdf
        • Size 111KB
        • SHA256 3cc02a7e8dfb12a7f0fc44c80115f8bc6e460f7b39f32b02b2185ef8424a07ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3080-3360-0x0000000000400000-0x00000000004F5000-memory.dmp
        Download

        memory/3080-9216-0x0000000000400000-0x00000000004F5000-memory.dmp
        Download

        memory/3080-13330-0x0000000000400000-0x00000000004F5000-memory.dmp
        Download

        memory/3080-14212-0x0000000000400000-0x00000000004F5000-memory.dmp
        Download

        memory/3080-14213-0x0000000000400000-0x00000000004F5000-memory.dmp
        Download

        memory/3080-14214-0x0000000000400000-0x00000000004F5000-memory.dmp
        Download