Overview
overview
7Static
static
3TiRex-Bypasser.exe
windows10-2004-x64
7TiRex-Bypasser.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows11-ltsc_2024-x64
3LICENSES.c...m.html
windows10-2004-x64
3LICENSES.c...m.html
windows11-ltsc_2024-x64
3TiRex Bypasser.exe
windows10-2004-x64
7d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows10-2004-x64
1resources/...ep.dll
windows10-2004-x64
1resources/...ep.dll
windows11-ltsc_2024-x64
1resources/...dex.js
windows10-2004-x64
3resources/...dex.js
windows11-ltsc_2024-x64
3resources/...est.js
windows10-2004-x64
3resources/...est.js
windows11-ltsc_2024-x64
3resources/elevate.exe
windows10-2004-x64
3resources/elevate.exe
windows11-ltsc_2024-x64
3vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3$PLUGINSDI...7z.dll
windows11-ltsc_2024-x64
3$R0/Uninst...er.exe
windows10-2004-x64
7Analysis
- max time kernel
149s - max time network
163s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 23:25
Static task
static1
Behavioral task
behavioral1
Sample
TiRex-Bypasser.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
TiRex-Bypasser.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
LICENSES.chromium.html
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
LICENSES.chromium.html
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
TiRex Bypasser.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
d3dcompiler_47.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
ffmpeg.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
libEGL.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
libGLESv2.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
resources/app.asar.unpacked/node_modules/sleep/build/Release/node_sleep.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
resources/app.asar.unpacked/node_modules/sleep/build/Release/node_sleep.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral20
Sample
resources/app.asar.unpacked/node_modules/sleep/index.js
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
resources/app.asar.unpacked/node_modules/sleep/index.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral22
Sample
resources/app.asar.unpacked/node_modules/sleep/test.js
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
resources/app.asar.unpacked/node_modules/sleep/test.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral24
Sample
resources/elevate.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
resources/elevate.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral26
Sample
vk_swiftshader.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
vulkan-1.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral30
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
General
- Target TiRex Bypasser.exe
- Size 201.5MB
- Sample260930-3enyfswfpg
- SHA256 0d69038e5648521894a25ba29cb0c37df2752d444b5b750491529a9d3c0b5164
- MD5 fc57ca8f8c0a762271211f3a0113a3c0
- SHA1 6e4b1585e095df87fc2d0c00fede1ad8de5d0606
- SHA512 8e1957e6bd155c62bbdbc9ae542fdb63e286dd3d71ac5726b18b7b69c803eef797d4d7916c188946f488e03e2828bb40a482c140b5a3aa2ff38b3ae842761b69
- SSDEEP 1572864:QjO3d+HTPc9eDaxayId+tUcbGxq+TA5htqiQNvF1rtVxa5XLmgYtVHbI5op/cObb:COISeEyNRqVOb/ZUmLg
- TLSH T15AA88C13E29601D9E05DD175974A9733FE72B8094B28A2DF2B5407522F77EE82B3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation TiRex Bypasser.exe Key value queried \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation TiRex Bypasser.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain TiRex Bypasser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname TiRex Bypasser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain TiRex Bypasser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname TiRex Bypasser.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4888 TiRex Bypasser.exe 4888 TiRex Bypasser.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 240 TiRex Bypasser.exe Token: SeCreatePagefilePrivilege 240 TiRex Bypasser.exe Token: SeShutdownPrivilege 240 TiRex Bypasser.exe Token: SeCreatePagefilePrivilege 240 TiRex Bypasser.exe Token: SeShutdownPrivilege 240 TiRex Bypasser.exe Token: SeCreatePagefilePrivilege 240 TiRex Bypasser.exe Token: SeShutdownPrivilege 240 TiRex Bypasser.exe Token: SeCreatePagefilePrivilege 240 TiRex Bypasser.exe Token: SeShutdownPrivilege 240 TiRex Bypasser.exe Token: SeCreatePagefilePrivilege 240 TiRex Bypasser.exe Token: SeShutdownPrivilege 240 TiRex Bypasser.exe Token: SeCreatePagefilePrivilege 240 TiRex Bypasser.exe Token: SeShutdownPrivilege 240 TiRex Bypasser.exe Token: SeCreatePagefilePrivilege 240 TiRex Bypasser.exe Token: SeShutdownPrivilege 240 TiRex Bypasser.exe Token: SeCreatePagefilePrivilege 240 TiRex Bypasser.exe Token: SeShutdownPrivilege 240 TiRex Bypasser.exe Token: SeCreatePagefilePrivilege 240 TiRex Bypasser.exe Token: SeShutdownPrivilege 240 TiRex Bypasser.exe Token: SeCreatePagefilePrivilege 240 TiRex Bypasser.exe Token: SeShutdownPrivilege 240 TiRex Bypasser.exe Token: SeCreatePagefilePrivilege 240 TiRex Bypasser.exe Token: SeShutdownPrivilege 240 TiRex Bypasser.exe Token: SeCreatePagefilePrivilege 240 TiRex Bypasser.exe Token: SeShutdownPrivilege 240 TiRex Bypasser.exe Token: SeCreatePagefilePrivilege 240 TiRex Bypasser.exe Token: SeShutdownPrivilege 240 TiRex Bypasser.exe Token: SeCreatePagefilePrivilege 240 TiRex Bypasser.exe Token: SeShutdownPrivilege 240 TiRex Bypasser.exe Token: SeCreatePagefilePrivilege 240 TiRex Bypasser.exe Token: SeShutdownPrivilege 240 TiRex Bypasser.exe Token: SeCreatePagefilePrivilege 240 TiRex Bypasser.exe Token: SeShutdownPrivilege 240 TiRex Bypasser.exe Token: SeCreatePagefilePrivilege 240 TiRex Bypasser.exe Token: SeShutdownPrivilege 240 TiRex Bypasser.exe Token: SeCreatePagefilePrivilege 240 TiRex Bypasser.exe Token: SeShutdownPrivilege 240 TiRex Bypasser.exe Token: SeCreatePagefilePrivilege 240 TiRex Bypasser.exe Token: SeShutdownPrivilege 240 TiRex Bypasser.exe Token: SeCreatePagefilePrivilege 240 TiRex Bypasser.exe Token: SeShutdownPrivilege 240 TiRex Bypasser.exe Token: SeCreatePagefilePrivilege 240 TiRex Bypasser.exe Token: SeShutdownPrivilege 240 TiRex Bypasser.exe Token: SeCreatePagefilePrivilege 240 TiRex Bypasser.exe Token: SeShutdownPrivilege 240 TiRex Bypasser.exe Token: SeCreatePagefilePrivilege 240 TiRex Bypasser.exe Token: SeShutdownPrivilege 240 TiRex Bypasser.exe Token: SeCreatePagefilePrivilege 240 TiRex Bypasser.exe Token: SeShutdownPrivilege 240 TiRex Bypasser.exe Token: SeCreatePagefilePrivilege 240 TiRex Bypasser.exe Token: SeShutdownPrivilege 240 TiRex Bypasser.exe Token: SeCreatePagefilePrivilege 240 TiRex Bypasser.exe Token: SeShutdownPrivilege 240 TiRex Bypasser.exe Token: SeCreatePagefilePrivilege 240 TiRex Bypasser.exe Token: SeShutdownPrivilege 240 TiRex Bypasser.exe Token: SeCreatePagefilePrivilege 240 TiRex Bypasser.exe Token: SeShutdownPrivilege 240 TiRex Bypasser.exe Token: SeCreatePagefilePrivilege 240 TiRex Bypasser.exe Token: SeShutdownPrivilege 240 TiRex Bypasser.exe Token: SeCreatePagefilePrivilege 240 TiRex Bypasser.exe Token: SeShutdownPrivilege 240 TiRex Bypasser.exe Token: SeCreatePagefilePrivilege 240 TiRex Bypasser.exe Token: SeShutdownPrivilege 240 TiRex Bypasser.exe Token: SeCreatePagefilePrivilege 240 TiRex Bypasser.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 240 wrote to memory of 3172 240 TiRex Bypasser.exe 91 PID 240 wrote to memory of 3172 240 TiRex Bypasser.exe 91 PID 240 wrote to memory of 2524 240 TiRex Bypasser.exe 92 PID 240 wrote to memory of 2064 240 TiRex Bypasser.exe 93 PID 240 wrote to memory of 4888 240 TiRex Bypasser.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\TiRex Bypasser.exe"C:\Users\Admin\AppData\Local\Temp\TiRex Bypasser.exe"1⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Local\Temp\TiRex Bypasser.exe"C:\Users\Admin\AppData\Local\Temp\TiRex Bypasser.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\tirex-bypasser" --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1756,i,13365227433276167464,2317942057487627947,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1752 /prefetch:22⤵PID:3172
-
-
C:\Users\Admin\AppData\Local\Temp\TiRex Bypasser.exe"C:\Users\Admin\AppData\Local\Temp\TiRex Bypasser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\tirex-bypasser" --field-trial-handle=1756,i,13365227433276167464,2317942057487627947,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:32⤵
- Reads the TCP/IP host and domain name from the registry
PID:2524
-
-
C:\Users\Admin\AppData\Local\Temp\TiRex Bypasser.exe"C:\Users\Admin\AppData\Local\Temp\TiRex Bypasser.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\tirex-bypasser" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1756,i,13365227433276167464,2317942057487627947,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:12⤵
- Checks computer location settings
PID:2064
-
-
C:\Users\Admin\AppData\Local\Temp\TiRex Bypasser.exe"C:\Users\Admin\AppData\Local\Temp\TiRex Bypasser.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\tirex-bypasser" --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1756,i,13365227433276167464,2317942057487627947,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4888
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\tirex-bypasser\GPUCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\tirex-bypasser\GPUCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\tirex-bypasser\GPUCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\tirex-bypasser\GPUCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\tirex-bypasser\Preferences
- Size 57B
- SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
- MD5 58127c59cb9e1da127904c341d15372b
- SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
- SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
- TLSH T101900297652634755E1F1D65400B889B5CF905704E0B5E0641D032969A2A45D088705F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\tirex-bypasser\Preferences~RFe593406.TMP
- Size 93B
- SHA256 529b6595a4727a6b2d6cc154ae51f426216c01fc7fda02de2460abfb3de118a4
- MD5 322f01bb491180333c338526d93f115a
- SHA1 554d5e43d5e46774b8f2a6b3682243a289927754
- SHA512 69f8e980f44b1465cee8c0485598fa00be163db0fe88598e45ab2f817f9bea36a2b70dbb9d25d5214174ea9c198b9641bb3d5a86c18b1a4ea4493c00e2e95eb2
- TLSH T103B01253B810A0324B1B09E5000BC94F2CBE00340E475A0510D4F39D492DD4D088702B
- MD5 SHA1 SHA512 TLSH