Overview

overview

7

Static

static

5

a42a2049fe...91.exe

windows10-2004-x64

7

a42a2049fe...91.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 13:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a42a2049fe94e23b43a79f8721f7922b03b6959c832bd35884b58cd46ce6b991.exe
  • Size 7.7MB
  • Sample260930-q1dndsgf43
  • SHA256 a42a2049fe94e23b43a79f8721f7922b03b6959c832bd35884b58cd46ce6b991
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistence

Malware Config

Signatures

  • Deletes itself 1 TTPs 1 IoCs
    defense_evasion
  • Executes dropped EXE 22 IoCs
  • Adds Run key to start application 2 TTPs 11 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 15 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Detect suspicious telegram bot 11 IoCs

    Detect suspicious telegram bot.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 46 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a42a2049fe94e23b43a79f8721f7922b03b6959c832bd35884b58cd46ce6b991.exe
    "C:\Users\Admin\AppData\Local\Temp\a42a2049fe94e23b43a79f8721f7922b03b6959c832bd35884b58cd46ce6b991.exe"
    1⤵
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:440
    • C:\Users\Admin\AppData\Local\Temp\Diagnostics\SystemHost.exe
      "C:\Users\Admin\AppData\Local\Temp\Diagnostics\SystemHost.exe" --monitor
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:6004
  • C:\Users\Admin\AppData\Local\Temp\Diagnostics\SystemHost.exe
    "C:\Users\Admin\AppData\Local\Temp\\Diagnostics\SystemHost.exe"
    1⤵
    • Deletes itself
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4544
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe" --monitor
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2224
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:3900
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe"
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2280
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemTrayHelper.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemTrayHelper.exe" --monitor
        2⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:5820
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemTrayHelper.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemTrayHelper.exe"
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2176
      • C:\Users\Admin\AppData\Local\Temp\Diagnostics\NetworkHelper.exe
        "C:\Users\Admin\AppData\Local\Temp\Diagnostics\NetworkHelper.exe" --monitor
        2⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:6044
    • C:\Users\Admin\AppData\Local\Temp\Diagnostics\NetworkHelper.exe
      "C:\Users\Admin\AppData\Local\Temp\\Diagnostics\NetworkHelper.exe"
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3164
      • C:\Users\Admin\AppData\Local\Temp\SecurityCore.exe
        "C:\Users\Admin\AppData\Local\Temp\SecurityCore.exe" --monitor
        2⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2768
    • C:\Users\Admin\AppData\Local\Temp\SecurityCore.exe
      "C:\Users\Admin\AppData\Local\Temp\\SecurityCore.exe"
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3464
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe" --monitor
        2⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        PID:3528
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe"
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2880
      • C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\BackgroundTask.exe
        "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\BackgroundTask.exe" --monitor
        2⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        PID:4788
    • C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\BackgroundTask.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\BackgroundTask.exe"
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5648
      • C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemHost.exe
        "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemHost.exe" --monitor
        2⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        PID:2156
    • C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemHost.exe
      "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemHost.exe"
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4896
      • C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UpdateService.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UpdateService.exe" --monitor
        2⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        PID:1272
    • C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UpdateService.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UpdateService.exe"
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2888
      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe
        "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe" --monitor
        2⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        PID:2372
    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe
      "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe"
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:604
      • C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsShell.exe
        "C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsShell.exe" --monitor
        2⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        PID:5144
    • C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsShell.exe
      "C:\Users\Admin\AppData\Local\Temp\\Diagnostics\WindowsShell.exe"
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      PID:3008

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          103621DE9CD5414CC2538780B4B75751
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
          • Size 808B
          • SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
          • Size 313B
          • SHA256 acb9d981851f4c3271fad627cdfda2a2d8599028a2b9b0f06fd24acd3767dcad
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
          • Size 2KB
          • SHA256 714842d12308ec0508c43b1dd6552bf8dc987d1602cc840daa4b561e150e8e23
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          421EC2E1E0F47FC59DB99BB19E16DA88
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
          • Size 280B
          • SHA256 b58f7696fc81ea50570304ba19a94ac07ef88f00cb18545c035b4dc13205bfef
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          49A7F8B8A2FD8A9E65352CD7C88B1D10
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
          • Size 183KB
          • SHA256 78632193e49fce32c641fee87ff625185c11786a199959c356fbe019ac5fa932
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
          • Size 976B
          • SHA256 e0e7336a1c7c64caa65ecd69b0c3a40929a71e78b54170a9296636677e6bd991
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
          • Size 2KB
          • SHA256 132c75bfd291b9f783c174e8598359524c23f8e68b8fc9ad44071b2d508cf669
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          F15827BEC5BABE89C21DCDAE77464BF1
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
          • Size 701B
          • SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          103621DE9CD5414CC2538780B4B75751
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
          • Size 192B
          • SHA256 74d2968e52abfb211abef1d38811a3ae92a9ba327dc0e9ebdb6a0474f6202388
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
          • Size 488B
          • SHA256 a9e543ecdcec1dfeacab8ba009184e726788fdf0379118e6b14a2640f1ef1f0e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
          • Size 450B
          • SHA256 5b7da287b322cf24bf0ec05272f7f4ab73c0a752aff73d219f16b865a3036fde
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          421EC2E1E0F47FC59DB99BB19E16DA88
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
          • Size 484B
          • SHA256 c83a0d837d9e20c2ab19ea832c3377f97c0117e65a6f75ad0bd9351a155c45b9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          49A7F8B8A2FD8A9E65352CD7C88B1D10
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
          • Size 248B
          • SHA256 1daaaf05e3f88e082ea68196794ed0573944e2dc4eb0f3d7fba627c762f36e4a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
          • Size 488B
          • SHA256 b85df9db0a55a5195ed16f61cf485dc129a649d9f70827ca79596828ac2c31fd
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
          • Size 474B
          • SHA256 b7051c0fc2e1e3c2ad6e4187b68dfd3f3f4db8abd103ddb8a72909baec3bb9c6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          F15827BEC5BABE89C21DCDAE77464BF1
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
          • Size 192B
          • SHA256 cc838e1d907ec3b89050045708c308764694229cde7458fd3f527fad6e6a194a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          SystemHost.exe
          • Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemHost.exe
          • Size 8.6MB
          • SHA256 7ffbd27cc8f00fa5d5147b07c1f7872d2c094ec600dbfdcafe243d6fab224d9e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BackgroundTask.exe
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\BackgroundTask.exe
          • Size 8.5MB
          • SHA256 f5ed94ac626c96b5d55e306e53c4197ec0a3374945394fc04bae0951b5c5f3e9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WindowsHost.exe
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsHost.exe
          • Size 8.9MB
          • SHA256 1827e527c3157a8605cba02a93f0c3396ef20f5a0a6a7a94ecbb2f1050fd974b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NetworkHelper.exe
          • Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\NetworkHelper.exe
          • Size 8.2MB
          • SHA256 bdde567f00652e0e419e41cc01ec5a353370fc29cb16aa31bde377b59763c9db
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SystemHost.exe
          • Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\SystemHost.exe
          • Size 7.8MB
          • SHA256 3940778319c326e0d6a8db49880d11802d18f1291fc8c8275319fe4f05925c98
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WindowsShell.exe
          • Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsShell.exe
          • Size 9.0MB
          • SHA256 b6395c2ef18806f25c31ddc39a835882f355ef14a0b8181e0254523612352168
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SecurityCore.exe
          • Path C:\Users\Admin\AppData\Local\Temp\SecurityCore.exe
          • Size 8.3MB
          • SHA256 79fa04b9b07ca30c3f1e43d17df5d3e00b424e4bf5d0242917c3ebff44b51538
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          UpdateService.exe
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\UpdateService.exe
          • Size 8.7MB
          • SHA256 aeae4ad9b27c4d30f14c7ab3d9fc16cdb0ebb05757d27904c9fe5c286420d6b0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SystemTrayHelper.exe
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe
          • Size 8.4MB
          • SHA256 a5f148b2c445afa1f0e5b18e13b179879f311e5d8931c3e5ecb2e5851bfe37eb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WindowsShell.exe
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsShell.exe
          • Size 7.9MB
          • SHA256 3858e59f6046af26b9037a5a63d057b4307d7c99e9dab7c8bd1d306b23876f4c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SystemTrayHelper.exe
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SystemTrayHelper.exe
          • Size 8.1MB
          • SHA256 017516c3a9b2a9b8825d8af4175061252c6e8f42fe1d5ff623e7b68b737a88dd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download