a58ed03b5ff48a51e4e3aa02b6596c8ade7446bb859c22df1bc73bb09dcb32dc

Analysis

user interaction
yes
max time kernel
24s
max time network
23s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
qo2s5jet.exe
Size 16.1MB
Sample260922-rxvyyavwhy
SHA256 a58ed03b5ff48a51e4e3aa02b6596c8ade7446bb859c22df1bc73bb09dcb32dc
MD5 2a0cb7cf5b7e63489d70edc28efd1ce7
SHA1 9e0aea20391bbc230d755e5a5c281eb29a5ce9e2
SHA512 e0fd8bf7ace101fb414cacf8aaa2296bccddc96b350b8ebb6fce5ef31d5c88ad1dfd17db5920cf7f0f1304ce4fd0af692606f5ac37b2f2527c1687a93b41eaed
SSDEEP 393216:qwP7tl88+WyMTG/Yh9GWyr1RXkHFRAT4oZhVRkUipBXC6oACffyMz:97tZ+WB6YPGfZROAnhVRkU+XnoACH3
TLSH
T16707337DE5089B76FBB1C7B62A6F73F5BB268D0840698FDBA29C4DAD40D1A64C43410C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1224	j74q3hck6oos.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	j74q3hck6oos.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	j74q3hck6oos.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1224	2072	qo2s5jet.exe	89

C:\Users\Admin\AppData\Local\Temp\qo2s5jet.exe
"C:\Users\Admin\AppData\Local\Temp\qo2s5jet.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Users\Admin\AppData\Local\Temp\j74q3hck6oos.exe
  "C:\Users\Admin\AppData\Local\Temp\j74q3hck6oos.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:1224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

j74q3hck6oos.exe

Path C:\Users\Admin\AppData\Local\Temp\j74q3hck6oos.exe
Size 16.1MB
SHA256 41368c1454ee9a9964567d0b4925e44c6dbf2845e037f98db3567238ddb858c2
MD5 abc8829ba1af68c781394164d9718f9e
SHA1 645b323d4f2adfd2c9fe5ca66c2e47e523fb3e9e
SHA512 71f9a8e30bf6a98ca773b34a6d0b3534c0636af635952cc1f2205ebd05054f2265c0b420fdf1775deaa1f31ad10e5afa5419bc34ce0430aa12d4c8f0a2ca342d
SSDEEP 196608:hbkC0xd9isRoKLv4D7Z8c6c0cRyeIz9bifJ1pnarpdP:wb9isRnLveqcBlyeuVoVnkdP
TLSH
T16B078C13E9A648E9C1AAD230C5A79273BB707C494B3127D71B94E3342F72BD0AE79354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2072-3-0x00007FF782640000-0x00007FF783662000-memory.dmp

Download