33dafe7086f97ad2fde35d5d7321f42ac7b694c68ce7aff4577d8c4fa0e9837a

Analysis

user interaction
yes
max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 03:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mrx.exe
Size 1.7MB
Sample260924-egdnhade35
SHA256 33dafe7086f97ad2fde35d5d7321f42ac7b694c68ce7aff4577d8c4fa0e9837a
MD5 ecc8b3cbe2e64170849ab61e319fd8dc
SHA1 18fa5371cb5a42f728d4ccfb220c0c783ac877d2
SHA512 2a07953e5809c33bad4d29bf50e869ee80d4e75de84ebfa30ec5cd32d84160c297db74fc11e87b5c71840f5f5cf06c4bb923bfada362a08f047bda8bbba7ee9c
SSDEEP 49152:WD2BPdFya42e3jwIji1egPAnS0ZNduAwyxvJb6:HNvFKjvjIpPAh3UaxvB
TLSH
T1D985024EEA6B18F8C9F7D4B88542653AFAB2B49A43B097C793C00A470B577D8E53D740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 4 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
2888	mrx.exe
2888	mrx.exe
2888	mrx.exe
2888	mrx.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2888	mrx.exe
2888	mrx.exe

C:\Users\Admin\AppData\Local\Temp\mrx.exe
"C:\Users\Admin\AppData\Local\Temp\mrx.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Debugger Evasion

T1622

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2888-1-0x000001B7AE240000-0x000001B7AE241000-memory.dmp

Download

memory/2888-2-0x000001B7AE240000-0x000001B7AE241000-memory.dmp

Download

memory/2888-0-0x000001B7AE240000-0x000001B7AE241000-memory.dmp

Download