Resubmissions
30/09/2026, 06:36
260930-hdc5cavfje930/09/2026, 06:35
260930-hcc3ys1w6l330/09/2026, 06:34
260930-hbs3sa1we1930/09/2026, 06:31
260930-g911lsvcrg9Analysis
- user interaction
yes - max time kernel
8s - max time network
8s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 06:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
DirectX11 base.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
DirectX11 base.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target DirectX11 base.exe
- Size 8.6MB
- Sample260930-hbs3sa1we1
- SHA256 c17b6ec247adeb960f677071e403a1a6ef5775a5c5446804ec8931294c04486b
- MD5 5430c44f3e2cdcaaec0fb0433aaaf073
- SHA1 5eea0a33cc82adb4e31e90db4f3955a1bdf57622
- SHA512 df662f220cebdfca3ca8fcef3a993805f88c2b779b9e04bf91ea295f7817a524611835ff0addc2445413a9d6efd8beebeab62ff7988a97c42b01c5defe854143
- SSDEEP 98304:zOtTR3j2raPgmcbOex85RPgYqfAGNcF2723qt6Wb2+KcgSZTWRWrM72yqYqOc:zOXT2kc6RPVGNtDyfcgbRWcNqO
- TLSH T1E996E139558B02D9E2F2D2B8D75E8107E3B33D4983219BEF4BDC8D589E42EE9413E521
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions DirectX11 base.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools DirectX11 base.exe - Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum DirectX11 base.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 DirectX11 base.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 4 IoCs
pid Process 3264 DirectX11 base.exe 3264 DirectX11 base.exe 3264 DirectX11 base.exe 3264 DirectX11 base.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2536 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname DirectX11 base.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain DirectX11 base.exe - Checks SCSI registry key(s) 3 TTPs 2 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DirectX11 base.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DirectX11 base.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3264 DirectX11 base.exe 3264 DirectX11 base.exe 3264 DirectX11 base.exe 3264 DirectX11 base.exe 3264 DirectX11 base.exe 3264 DirectX11 base.exe 3264 DirectX11 base.exe 3264 DirectX11 base.exe 3264 DirectX11 base.exe 3264 DirectX11 base.exe 3264 DirectX11 base.exe 3264 DirectX11 base.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe Token: SeDebugPrivilege 3264 DirectX11 base.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3264 wrote to memory of 2536 3264 DirectX11 base.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\DirectX11 base.exe"C:\Users\Admin\AppData\Local\Temp\DirectX11 base.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
- Executes a command shell one-liner
PID:2536
-