d6b586d8967ee00d64b424528b3646cad98ab2b704bf9b60ff4e14be8a83ea93

Analysis

user interaction
yes
max time kernel
46s
max time network
24s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 19:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
agent-5920.exe
Size 13.1MB
Sample260925-xpj5csvw5p
SHA256 d6b586d8967ee00d64b424528b3646cad98ab2b704bf9b60ff4e14be8a83ea93
MD5 35b2c13d160446751a1ef84e0295b2d1
SHA1 78f2310d405efa57e88b6ac9aa57d8c57499b11f
SHA512 a824b6af8718f9d3dff7359867bcf46894ecfb28b082e4fa67a07d9e4602250f1e6dde5fceb739ce669ec6786b51c1918762923e6e3fddb8b8ce088337a4f072
SSDEEP 49152:3wrrhkHXXkHtsMksMu8gOvq++JCNpTwvU6nzJJup34eX5p9MONzz5Rvf1ZZH286y:3wnm3W/1
TLSH
T180D61207BCA12AFAC4ADA231497755567BB1BC841F3263D72A90B2782F77BC05C79B04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 4 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	a2igydaq5c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	a2igydaq5c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	a2igydaq5c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	a2igydaq5c.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	a2igydaq5c.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	a2igydaq5c.exe

Looks for VMWare services registry key. 1 TTPs 1 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	a2igydaq5c.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a2igydaq5c.exe

Executes dropped EXE 1 IoCs

pid	Process
5024	a2igydaq5c.exe

Checks SCSI registry key(s) 3 TTPs 1 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S	a2igydaq5c.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5024	a2igydaq5c.exe
5024	a2igydaq5c.exe
5024	a2igydaq5c.exe
5024	a2igydaq5c.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 5024	2180	agent-5920.exe	90

C:\Users\Admin\AppData\Local\Temp\agent-5920.exe
"C:\Users\Admin\AppData\Local\Temp\agent-5920.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Local\Temp\acxs4d7c74ch7y\a2igydaq5c.exe
  C:\Users\Admin\AppData\Local\Temp\acxs4d7c74ch7y\a2igydaq5c.exe
  2⤵
  - Enumerates VirtualBox registry keys
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Looks for VMWare services registry key.
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:5024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a2igydaq5c.exe

Path C:\Users\Admin\AppData\Local\Temp\acxs4d7c74ch7y\a2igydaq5c.exe
Size 8.3MB
SHA256 cdd4a828b20c278798d66df0d22e28cc2bfc08fb71630bdb8f7ffbe82d9625f6
MD5 b76ff420fa9ed80674d55eb4a119bec3
SHA1 33ec37054e2bca4f5ed24bf90ff6566065aca01e
SHA512 bcc586a4c86ca3114b951aa2ac6a23faa494d19fad8654d1653f8b292070c672ebafe618445c354ce53255fb97753125ffe218c2023f386b7fc544ff0f780a82
SSDEEP 98304:wx7PJvunBwgdeEAJe7uCCIY/2JZfR3Yu4UBRWd/ub:wFV4dbf0IY/2JZfR3Yuod/
TLSH
T1C8966A03ECA959E9C1AED1308AA69553BF71BC490B2123D31F90F6283F76BD06DB9354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5024-4-0x00000001D3CA0000-0x00000001D3CAD000-memory.dmp

Download

memory/5024-14-0x00007FF6F40F0000-0x00007FF6F69A8000-memory.dmp

Download