Analysis
- user interaction
yes - max time kernel
105s - max time network
108s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
25/09/2026, 19:08
General
- Target agent-b868.exe
- Size 13.6MB
- Sample260925-xtfmqsha68
- SHA256 10ac0e6fc176c2ba7ace4f817500195a858e79aa6cd103c95580495aea2c04ae
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\agent-b868.exe"C:\Users\Admin\AppData\Local\Temp\agent-b868.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\w4yzuayqkzv2jd\2zvxx3t1df.exeC:\Users\Admin\AppData\Local\Temp\w4yzuayqkzv2jd\2zvxx3t1df.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WindowsUpdate\agent\jest.exe"C:\Users\Admin\AppData\Roaming\WindowsUpdate\agent\jest.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
-
-
-
C:\Users\Admin\AppData\Roaming\WindowsUpdate\agent\jest.exeC:\Users\Admin\AppData\Roaming\WindowsUpdate\agent\jest.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2zvxx3t1df.exe
id
memory/3084-28-0x00007FF6C6910000-0x00007FF6C9225000-memory.dmp
memory/3084-4-0x00000002A1770000-0x00000002A177E000-memory.dmp
memory/5392-160-0x00007FF73BE90000-0x00007FF73E7A5000-memory.dmp
memory/5392-166-0x00007FF73BE90000-0x00007FF73E7A5000-memory.dmp
memory/5392-40-0x000000029A970000-0x000000029A97D000-memory.dmp
memory/5392-60-0x0000000372200000-0x000000037220D000-memory.dmp
memory/5392-154-0x00007FF73BE90000-0x00007FF73E7A5000-memory.dmp
memory/5392-172-0x00007FF73BE90000-0x00007FF73E7A5000-memory.dmp
memory/5392-156-0x00007FF73BE90000-0x00007FF73E7A5000-memory.dmp
memory/5392-170-0x00007FF73BE90000-0x00007FF73E7A5000-memory.dmp
memory/5392-158-0x00007FF73BE90000-0x00007FF73E7A5000-memory.dmp
memory/5392-168-0x00007FF73BE90000-0x00007FF73E7A5000-memory.dmp
memory/5392-70-0x00000003A51D0000-0x00000003A51DD000-memory.dmp
memory/5392-30-0x0000000207610000-0x000000020761D000-memory.dmp
memory/5392-162-0x00007FF73BE90000-0x00007FF73E7A5000-memory.dmp
memory/5392-164-0x00007FF73BE90000-0x00007FF73E7A5000-memory.dmp
memory/5472-163-0x00007FF73BE90000-0x00007FF73E7A5000-memory.dmp
memory/5472-165-0x00007FF73BE90000-0x00007FF73E7A5000-memory.dmp
memory/5472-161-0x00007FF73BE90000-0x00007FF73E7A5000-memory.dmp
memory/5472-167-0x00007FF73BE90000-0x00007FF73E7A5000-memory.dmp
memory/5472-159-0x00007FF73BE90000-0x00007FF73E7A5000-memory.dmp
memory/5472-169-0x00007FF73BE90000-0x00007FF73E7A5000-memory.dmp
memory/5472-157-0x00007FF73BE90000-0x00007FF73E7A5000-memory.dmp
memory/5472-171-0x00007FF73BE90000-0x00007FF73E7A5000-memory.dmp
memory/5472-155-0x00007FF73BE90000-0x00007FF73E7A5000-memory.dmp
memory/5472-173-0x00007FF73BE90000-0x00007FF73E7A5000-memory.dmp