12f7a3dd2c0c1e94ae0336a024d757485d714769bb8a99ac28f9c8d05a1cb7bd

Analysis

max time kernel
299s
max time network
153s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
25/09/2026, 21:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
583435_CharlottePlastic.exe
Size 2.5MB
Sample260925-1fx7eazydv
SHA256 12f7a3dd2c0c1e94ae0336a024d757485d714769bb8a99ac28f9c8d05a1cb7bd
MD5 a1fcbb1cff00fee5ff3e218fe1782295
SHA1 57b6716d17a4f4ad5d138fdfabec621f5a3ef60a
SHA512 dfe26ab68dd297a0b29692672ceb63156ea2cc5891adb3f476323e5e978da646c41ccf3d01d481f427c4563de51b8ca67906652d4e678d3a2c8fcab0bbddcaf1
SSDEEP 49152:X/O0nOOe9nj4vGbDEbvaOnrz20CVdIP6gg9ga3SIi1A5MVcSRmC90Qq6Gt4a:X/039n0vGbDELtnrz2nVag9h3Sh1mlIq
TLSH
T1C9C5230317E502A3F4B65374D8F3224B69727CC0177927EFA651B25E6AE35C2063AB1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1936	AutoIt3.exe
3540	AutoIt3.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1936 set thread context of 3540	1936	AutoIt3.exe	95

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\ModifiableWindowsApps\hydraueroocts.txt	AutoIt3.exe
File opened for modification	C:\Program Files\stevedore\irtyiunn.dat	AutoIt3.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AutoIt3.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1936	AutoIt3.exe
1936	AutoIt3.exe
1936	AutoIt3.exe
1936	AutoIt3.exe
1936	AutoIt3.exe
1936	AutoIt3.exe
1936	AutoIt3.exe
1936	AutoIt3.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3488	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3488	Explorer.EXE
Token: SeCreatePagefilePrivilege	3488	Explorer.EXE
Token: SeShutdownPrivilege	3488	Explorer.EXE
Token: SeCreatePagefilePrivilege	3488	Explorer.EXE
Token: SeShutdownPrivilege	3488	Explorer.EXE
Token: SeCreatePagefilePrivilege	3488	Explorer.EXE

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1936	AutoIt3.exe
1936	AutoIt3.exe
1936	AutoIt3.exe
3540	AutoIt3.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1936	AutoIt3.exe
1936	AutoIt3.exe
1936	AutoIt3.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 1988	4184	583435_CharlottePlastic.exe	84
PID 4184 wrote to memory of 1936	4184	583435_CharlottePlastic.exe	86
PID 1936 wrote to memory of 3540	1936	AutoIt3.exe	95
PID 1936 wrote to memory of 3540	1936	AutoIt3.exe	95
PID 1936 wrote to memory of 3540	1936	AutoIt3.exe	95
PID 3540 wrote to memory of 3488	3540	AutoIt3.exe	57

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3488
- C:\Users\Admin\AppData\Local\Temp\583435_CharlottePlastic.exe
  "C:\Users\Admin\AppData\Local\Temp\583435_CharlottePlastic.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Windows\SYSTEM32\at.exe
    at.exe /sjhdnmzbcv7932489572dkjlfla3
    3⤵
    PID:1988
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Expected.a3x
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1936
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
Size 1.1MB
SHA256 5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7
MD5 80cdd5f19d704a001589976bae277bab
SHA1 96bb030389ac938c5ebc6bd2e9fcc86a10e5f2fd
SHA512 03fbfd02d348c2b54af3eeb022ae2f1be4e4f9b30352ceb2c7589233275a914ec4fd81ff8c1544bebf96a87e28c75fd81811e658f092536367395048a82bf8fa
SSDEEP 24576:HsTBc4JYoji1a2gOI6fQJ77jkD1KV3wKct4frNFOB:MTC4a4p+E72SwRcrK
TLSH
T1DA356C0673A4419EFEA7F1329607C60BD6B17C4A07779A6F02646B626F337711A2E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Expected.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Expected.a3x
Size 1.8MB
SHA256 e244153766573ff699fa2f53db6acb3ac65d6aec840f63e45504f346b0a860e2
MD5 e1b61510ec3fbe77b6609239a090067d
SHA1 f2905af20b33b99457e6ae020f87d967c5e3cdf9
SHA512 d57946954b6107d921c2688cb4c4b109ddc86f7d4c55372dba43608a1c0f709975c800f2d2449dd1c8996e7859232461364748c4f8b2209775ec8f5a20b0fea2
SSDEEP 49152:xKQO3e9XjcMEbwSXjLFzrbsmu/OIoXp/NNfSUIkHN5Qy:oO9XoMEbwSTZzrbsd/e/NlSUjHPN
TLSH
T14885330267E353B37D65A78AF8A3794E2DCB51C4152D3AF7F942732686EB8470A05C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1936-7-0x00007FF830EF0000-0x00007FF8310E8000-memory.dmp

Download

memory/1936-8-0x000001336E920000-0x000001336E921000-memory.dmp

Download

memory/3488-18-0x0000000009670000-0x0000000009707000-memory.dmp

Download

memory/3488-23-0x0000000009670000-0x0000000009707000-memory.dmp

Download

memory/3488-19-0x0000000009670000-0x0000000009707000-memory.dmp

Download

memory/3540-11-0x0000000140000000-0x00000001400C8000-memory.dmp

Download

memory/3540-13-0x0000000140000000-0x00000001400C8000-memory.dmp

Download

memory/3540-17-0x0000000140000000-0x00000001400C8000-memory.dmp

Download

memory/3540-22-0x0000000140000000-0x00000001400C8000-memory.dmp

Download

memory/3540-21-0x0000000140000000-0x00000001400C8000-memory.dmp

Download

memory/3540-10-0x0000000140000000-0x00000001400C8000-memory.dmp

Download

memory/3540-16-0x0000000140000000-0x00000001400C8000-memory.dmp

Download

memory/3540-15-0x0000000140000000-0x00000001400C8000-memory.dmp

Download

memory/3540-14-0x0000000140000000-0x00000001400C8000-memory.dmp

Download