33dafe7086f97ad2fde35d5d7321f42ac7b694c68ce7aff4577d8c4fa0e9837a

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 03:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mrx.exe
Size 1.7MB
Sample260924-egdnhade35
SHA256 33dafe7086f97ad2fde35d5d7321f42ac7b694c68ce7aff4577d8c4fa0e9837a
MD5 ecc8b3cbe2e64170849ab61e319fd8dc
SHA1 18fa5371cb5a42f728d4ccfb220c0c783ac877d2
SHA512 2a07953e5809c33bad4d29bf50e869ee80d4e75de84ebfa30ec5cd32d84160c297db74fc11e87b5c71840f5f5cf06c4bb923bfada362a08f047bda8bbba7ee9c
SSDEEP 49152:WD2BPdFya42e3jwIji1egPAnS0ZNduAwyxvJb6:HNvFKjvjIpPAh3UaxvB
TLSH
T1D985024EEA6B18F8C9F7D4B88542653AFAB2B49A43B097C793C00A470B577D8E53D740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 4 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
5620	mrx.exe
5620	mrx.exe
5620	mrx.exe
5620	mrx.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5620	mrx.exe
5620	mrx.exe

C:\Users\Admin\AppData\Local\Temp\mrx.exe
"C:\Users\Admin\AppData\Local\Temp\mrx.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Debugger Evasion

T1622

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5620-3-0x000002355FB10000-0x000002355FB11000-memory.dmp

Download

memory/5620-2-0x000002355FB10000-0x000002355FB11000-memory.dmp

Download

memory/5620-1-0x000002355FB10000-0x000002355FB11000-memory.dmp

Download

memory/5620-0-0x000002355FB10000-0x000002355FB11000-memory.dmp

Download