Analysis
- max time kernel
899s - max time network
902s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
25/09/2026, 14:49
General
- Target agent-595c.exe
- Size 13.6MB
- Sample260925-r6559svsay
- SHA256 5b2b7c98e1a082940b85483c28bd57ec75dacd8a4ad305bed514fac2550293af
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Drops file in Windows directory 2 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\agent-595c.exe"C:\Users\Admin\AppData\Local\Temp\agent-595c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0xdmfco2iwbqra\atlroz39vi.exeC:\Users\Admin\AppData\Local\Temp\0xdmfco2iwbqra\atlroz39vi.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WindowsUpdate\agent\My Agent.exe"C:\Users\Admin\AppData\Roaming\WindowsUpdate\agent\My Agent.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\reagentc.exereagentc.exe /info4⤵
- Drops file in Windows directory
-
-
-
-
C:\Users\Admin\AppData\Roaming\WindowsUpdate\agent\My Agent.exe"C:\Users\Admin\AppData\Roaming\WindowsUpdate\agent\My Agent.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\reagentc.exereagentc.exe /info2⤵
- Drops file in Windows directory
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C8 0x00000000000004F81⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
atlroz39vi.exe
id
ReAgent.log
memory/1896-397-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/1896-40-0x000000029A970000-0x000000029A97D000-memory.dmp
memory/1896-30-0x0000000207610000-0x000000020761D000-memory.dmp
memory/1896-415-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/1896-60-0x0000000372200000-0x000000037220D000-memory.dmp
memory/1896-154-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/1896-413-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/1896-411-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/1896-236-0x00000002FAB60000-0x00000002FAB6D000-memory.dmp
memory/1896-409-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/1896-407-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/1896-403-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/1896-401-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/1896-399-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/1896-70-0x00000003A51D0000-0x00000003A51DD000-memory.dmp
memory/1896-381-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/1896-395-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/1896-339-0x00000002DEF10000-0x00000002DEF26000-memory.dmp
memory/1896-360-0x00000002DEF10000-0x00000002DEF26000-memory.dmp
memory/1896-359-0x00000002DEF10000-0x00000002DEF26000-memory.dmp
memory/1896-393-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/1896-383-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/1896-361-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/1896-389-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/1896-375-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/1896-387-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/1896-377-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/1896-385-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/1896-379-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/1896-391-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/3312-298-0x00000001D8510000-0x00000001D851D000-memory.dmp
memory/3312-398-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/3312-380-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/3312-382-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/3312-378-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/3312-386-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/3312-376-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/3312-388-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/3312-374-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/3312-390-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/3312-363-0x00000002DEF10000-0x00000002DEF26000-memory.dmp
memory/3312-392-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/3312-362-0x00000002DEF10000-0x00000002DEF26000-memory.dmp
memory/3312-394-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/3312-308-0x0000000201FC0000-0x0000000201FCD000-memory.dmp
memory/3312-396-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/3312-416-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/3312-384-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/3312-156-0x0000000317FA0000-0x0000000317FAD000-memory.dmp
memory/3312-400-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/3312-206-0x00000002A4B30000-0x00000002A4B3D000-memory.dmp
memory/3312-167-0x00000001DF250000-0x00000001DF25D000-memory.dmp
memory/3312-404-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/3312-406-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/3312-186-0x0000000295B50000-0x0000000295B5D000-memory.dmp
memory/3312-408-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/3312-196-0x00000002E2DC0000-0x00000002E2DCD000-memory.dmp
memory/3312-410-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/3312-176-0x0000000296A40000-0x0000000296A4D000-memory.dmp
memory/3312-412-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/3312-155-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/3312-414-0x00007FF7CFDD0000-0x00007FF7D26E5000-memory.dmp
memory/4180-29-0x00007FF7F39D0000-0x00007FF7F62E5000-memory.dmp
memory/4180-4-0x00000002A1770000-0x00000002A177E000-memory.dmp