1f0bfbfa0771600d9325ca85b2e8103161b98cfbebe20abbd1be3f8390412b7f

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tung_full.exe
Size 16.0MB
Sample260922-txlrdaad49
SHA256 1f0bfbfa0771600d9325ca85b2e8103161b98cfbebe20abbd1be3f8390412b7f
MD5 e509ba90832ebea2d8af27f53736cbf7
SHA1 8e5628cbb02e4d4e43e11154e5582b4175b690a8
SHA512 b8607fbb3b33b5bda79085240dfd6419fa0ed67cc903b40a570e56a08388f3ae7b17f0105d3554fc54524e4ec40a8dc2ea8c186665a85f3bd510101638913744
SSDEEP 196608:hRupgvHk9t2agl6VYcIKevf+SUWg/ZJ1q464NZZEl0QfRwMnFdEZpndS6642a5+6:hYo3fRwZpdd2aX
TLSH
T19EF65C0367874DE5CCC26B74A59F233DA720FD219E391F7B9A6886301E533D89D2AB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeSvc.exe	tung_full.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeSvc.exe	tung_full.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\Runtime Broker = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tung_full.exe\""	tung_full.exe

Contacts third-party web service commonly abused for C2 1 TTPs 25 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
28	discord.com
52	discord.com
27	discord.com
37	discord.com
38	discord.com
39	discord.com
45	discord.com
50	discord.com
67	api.gofile.io
4	discord.com
13	discord.com
26	discord.com
34	discord.com
36	discord.com
47	discord.com
51	discord.com
60	discord.com
22	discord.com
31	discord.com
33	discord.com
35	discord.com
46	discord.com
57	discord.com
61	discord.com

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
63	api.ipify.org
59	api.ipify.org

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3752	schtasks.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 5872	1448	tung_full.exe	89
PID 1448 wrote to memory of 1932	1448	tung_full.exe	92
PID 1448 wrote to memory of 204	1448	tung_full.exe	94
PID 1448 wrote to memory of 4708	1448	tung_full.exe	96
PID 1448 wrote to memory of 848	1448	tung_full.exe	98
PID 1448 wrote to memory of 2164	1448	tung_full.exe	100
PID 1448 wrote to memory of 6116	1448	tung_full.exe	102
PID 1448 wrote to memory of 1820	1448	tung_full.exe	104
PID 1448 wrote to memory of 3752	1448	tung_full.exe	106
PID 1448 wrote to memory of 4724	1448	tung_full.exe	108
PID 1448 wrote to memory of 5932	1448	tung_full.exe	112
PID 1448 wrote to memory of 820	1448	tung_full.exe	114
PID 1448 wrote to memory of 3492	1448	tung_full.exe	116
PID 1448 wrote to memory of 2640	1448	tung_full.exe	119
PID 1448 wrote to memory of 2640	1448	tung_full.exe	119
PID 1448 wrote to memory of 5800	1448	tung_full.exe	122
PID 1448 wrote to memory of 5800	1448	tung_full.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tung_full.exe
"C:\Users\Admin\AppData\Local\Temp\tung_full.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -K -
  2⤵
  PID:5872
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -K -
  2⤵
  PID:1932
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -K -
  2⤵
  PID:204
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -K -
  2⤵
  PID:4708
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -K -
  2⤵
  PID:848
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -K -
  2⤵
  PID:2164
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -K -
  2⤵
  PID:6116
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -K -
  2⤵
  PID:1820
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /f /tn RuntimeBroker /xml "C:\Users\Admin\AppData\Local\Temp\rtsA375.tmp.xml"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3752
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -K -
  2⤵
  PID:4724
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -K -
  2⤵
  PID:5932
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -K -
  2⤵
  PID:820
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -K -
  2⤵
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu --no-first-run --no-default-browser-check
  2⤵
  PID:2640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu --no-first-run --no-default-browser-check
  2⤵
  PID:5800

C:\Users\Admin\AppData\Local\Temp\tung_full.exe
"C:\Users\Admin\AppData\Local\Temp\tung_full.exe"
1⤵
PID:2676

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1940

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4540

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4168

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rtsA375.tmp.xml

Path C:\Users\Admin\AppData\Local\Temp\rtsA375.tmp.xml
Size 1KB
SHA256 602bfd092f45d2d97f3ad2b3bbf958271317b8ef8b8d5b37c1f1682001175ee4
MD5 1eb4c89c8cf44f64aabbd2a75a5e2b16
SHA1 a6bb953a1c461b07f8e5916a9dbfe080db7de77f
SHA512 13325e60cc84c490b6b97f8a89c6de247bcfb83a9d9ad6d63afe8e6edc46f5dd7d430a61447fa5297f81cb2854bdfb10a4f695e26b4010dd47ec90c4dbc7b814
TLSH
T13B2144806D04F217719A573ACBD267C767B6AB288BB50039D8CC4C68708F18EB142563
MD5 SHA1 SHA512 TLSH

Submit Download

tc_5a8_11.body

Path C:\Users\Admin\AppData\Local\Temp\tc_5a8_11.body
Size 107B
SHA256 f3c3c90056201aad2441b42526688eb49dc0d2a6e593aec5a35d90a483f34fe5
MD5 f4b0e5b90012cd526dfc5005bb4dd729
SHA1 da7c4c28bdd899da06b1aaba9cb54d1644a60af6
SHA512 2f0c75ac54b3babd30483b70832747b54ee76a95d85653e178ebf9108f5fe037a130f43463360f8160883bc1271526d5d360bc0175dfcb711155d0e4c78950b8
TLSH
T140B012015BE5B4B319CF0756EDAEC1220DE143980E407590BB5C91AA1D316B2B4F3C38
MD5 SHA1 SHA512 TLSH

Submit Download

tc_5a8_13.body

Path C:\Users\Admin\AppData\Local\Temp\tc_5a8_13.body
Size 217B
SHA256 f4c86351c376b6edc9a95b2b15d8bd1d5d949025e4a5466b3fc9dd89298d34b7
MD5 2e48c68a2f6f8eaf9b75c103c9789efd
SHA1 107476d74c722b16b1f13557e3c1c3f62cf2d3c9
SHA512 ab706fdbd538ba71bc8e40cbd76b820f714aadfee5645951372506d14da3b37dd38a9d666de37a26a2d7e3afbc2bc5dc1f776f5c785b97069a2bff63cc660b94
TLSH
T1EFD0233499512132B4C6037C842DD968E6B1502571D18953D8B3C241D443BE75F7206E
MD5 SHA1 SHA512 TLSH

Submit Download

tc_5a8_6.body

Path C:\Users\Admin\AppData\Local\Temp\tc_5a8_6.body
Size 19B
SHA256 557cb72a9f793471ae56b628af30b431d964861ae44bbcbf4e7b63177f89f818
MD5 c859c8012240ac7958c72eb6314b66e1
SHA1 747dff6f5343e38cf81a0de9b5322b0ccb142d46
SHA512 4065baa35eaef732da8421714b8755aa4792a2327704df8ae9cd154a3b8e15276b7df22a93fe67c06d0efee3135bfb2a7657bbb1d19e4e886d6e86d5653bcffe
MD5 SHA1 SHA512

Submit Download

tc_5a8_8.body

Path C:\Users\Admin\AppData\Local\Temp\tc_5a8_8.body
Size 24B
SHA256 600028ea5d8bb529d7768ce131243c9664a48977d575bf14aa102ed5e161da3f
MD5 5704f0ffa95b722ec9c13e4ae97f150d
SHA1 daacb9b3589746796c97a4dbc10ba7e4d69cd033
SHA512 e3ca76c4cb01e3b6a56ec67fee4a04c10493e69d54f9078011d7f8850d614a0dc96ef85322483ea77f113c185a3332aadbcc44010ef1211ff1bb20bda4d41c7b
MD5 SHA1 SHA512

Submit Download

tc_5a8_a.body

Path C:\Users\Admin\AppData\Local\Temp\tc_5a8_a.body
Size 71B
SHA256 a4d92959ac0a99d26c439246a7d0eac33d9aac292d3e343d36f79f4e1b1e2fe4
MD5 83563c18505c445e7ceb57646edbc218
SHA1 9e62a8d1ee6e846dd14ca469496e06eeabecb75d
SHA512 c07ce83b9341bfbbb5b486444cb2215fbc9b6e7ebc38bbd12fd085dac299b878ebfa80ede3bb1ce89fea8d4b2c4be986d9f7cb29ee6f02095866d6f140a808f1
TLSH
T18BA022C0FC3030B230CE08A3AC238E080020230208C0CEE8280202000E03B88ECF3B0C
MD5 SHA1 SHA512 TLSH

Submit Download

tc_5a8_c.body

Path C:\Users\Admin\AppData\Local\Temp\tc_5a8_c.body
Size 97B
SHA256 70ae930a19531bd2ca1fee2cef7fa9362c088fcc466b893e8e0fbb0286786241
MD5 b8fbef4494be7b0db56a3d5681af171e
SHA1 5ba08b38994ef21b709b29cf71bc916b6973eae0
SHA512 7cb9cd7744fff72b7ae35226cc39a41540f00866f54c5c7865df38658dd00857b184cd1bcd8fb71c9842488783032b176cea493a49b6252a6cd0b1b30291f06e
TLSH
T12DB01207DA0860B728C94B247C51C165336042621C81C9441A9D524528573B6B9B2830
MD5 SHA1 SHA512 TLSH

Submit Download

tc_5a8_e.body

Path C:\Users\Admin\AppData\Local\Temp\tc_5a8_e.body
Size 87B
SHA256 48ff504c13b7cd72d77fa1cc6a7ef133662375e118a6b02fd67efebf0773758a
MD5 c3e2001a15891504104f61d0577039b0
SHA1 71910474177695c5e73d7b4d7dbc46305659bf2b
SHA512 a115b4688f574c227a957821be9daaf54aea45a9f6183b50aa9ab226801203f8bdce7d9451df155dac4f455ac496cb5c7714b5383b2ffc6245a5b58fe92b88c0
TLSH
T18EB01286A70110722C920650AC63C11050944510984144908882100C0D033B79993A0F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1448-15-0x00007FF79EF20000-0x00007FF79FD84000-memory.dmp

Download

memory/1448-0-0x00007FF79EF20000-0x00007FF79FD84000-memory.dmp

Download

memory/1448-6-0x00007FF79EF20000-0x00007FF79FD84000-memory.dmp

Download

memory/1448-5-0x00007FF79EF20000-0x00007FF79FD84000-memory.dmp

Download

memory/1448-26-0x00007FF79EF20000-0x00007FF79FD84000-memory.dmp

Download

memory/1448-27-0x00007FF79EF20000-0x00007FF79FD84000-memory.dmp

Download

memory/1448-2-0x00007FF79EF20000-0x00007FF79FD84000-memory.dmp

Download

memory/1448-35-0x00007FF79EF20000-0x00007FF79FD84000-memory.dmp

Download

memory/2676-25-0x00007FF79EF20000-0x00007FF79FD84000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads