Overview

overview

7

Static

static

5

ea2af496ce...06.exe

windows10-2004-x64

7

ea2af496ce...06.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 13:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ea2af496ce8c541c7dca3dc8a96b39b9ebcffccd6951933c14a77b8ced12c506.exe
  • Size 12.3MB
  • Sample260930-qz3acsseqd
  • SHA256 ea2af496ce8c541c7dca3dc8a96b39b9ebcffccd6951933c14a77b8ced12c506
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistence

Malware Config

Signatures

  • Deletes itself 1 TTPs 1 IoCs
    defense_evasion
  • Executes dropped EXE 20 IoCs
  • Adds Run key to start application 2 TTPs 11 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 12 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Detect suspicious telegram bot 11 IoCs

    Detect suspicious telegram bot.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 42 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ea2af496ce8c541c7dca3dc8a96b39b9ebcffccd6951933c14a77b8ced12c506.exe
    "C:\Users\Admin\AppData\Local\Temp\ea2af496ce8c541c7dca3dc8a96b39b9ebcffccd6951933c14a77b8ced12c506.exe"
    1⤵
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1344
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsInternal.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsInternal.exe" --monitor
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4836
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsInternal.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsInternal.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:368
    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\DesktopWindowManager.exe
      "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\DesktopWindowManager.exe" --monitor
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2492
  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\DesktopWindowManager.exe
    "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\DesktopWindowManager.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1500
    • C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\ServiceHost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\ServiceHost.exe" --monitor
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:5048
  • C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\ServiceHost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\ServiceHost.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4736
    • C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe" --monitor
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2668
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3984
    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\UpdateService.exe
      "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\UpdateService.exe" --monitor
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4160
  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\UpdateService.exe
    "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\UpdateService.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5896
    • C:\Users\Admin\AppData\Local\Temp\Diagnostics\CoreSystem.exe
      "C:\Users\Admin\AppData\Local\Temp\Diagnostics\CoreSystem.exe" --monitor
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      PID:2064
  • C:\Users\Admin\AppData\Local\Temp\Diagnostics\CoreSystem.exe
    "C:\Users\Admin\AppData\Local\Temp\\Diagnostics\CoreSystem.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2692
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\NetworkHelper.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\NetworkHelper.exe" --monitor
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      PID:404
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\NetworkHelper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\NetworkHelper.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5692
    • C:\Users\Admin\AppData\Local\Temp\WindowsShell.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsShell.exe" --monitor
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      PID:4780
  • C:\Users\Admin\AppData\Local\Temp\WindowsShell.exe
    "C:\Users\Admin\AppData\Local\Temp\\WindowsShell.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5956
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\CoreSystem.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\CoreSystem.exe" --monitor
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      PID:3692
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\CoreSystem.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\CoreSystem.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5140
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe" --monitor
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      PID:4676
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:1316
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsInternal.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsInternal.exe" --monitor
      2⤵
        PID:844

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          103621DE9CD5414CC2538780B4B75751
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
          • Size 808B
          • SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
          • Size 313B
          • SHA256 acb9d981851f4c3271fad627cdfda2a2d8599028a2b9b0f06fd24acd3767dcad
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
          • Size 2KB
          • SHA256 714842d12308ec0508c43b1dd6552bf8dc987d1602cc840daa4b561e150e8e23
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          421EC2E1E0F47FC59DB99BB19E16DA88
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
          • Size 280B
          • SHA256 b58f7696fc81ea50570304ba19a94ac07ef88f00cb18545c035b4dc13205bfef
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          49A7F8B8A2FD8A9E65352CD7C88B1D10
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
          • Size 183KB
          • SHA256 78632193e49fce32c641fee87ff625185c11786a199959c356fbe019ac5fa932
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
          • Size 976B
          • SHA256 e0e7336a1c7c64caa65ecd69b0c3a40929a71e78b54170a9296636677e6bd991
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
          • Size 2KB
          • SHA256 132c75bfd291b9f783c174e8598359524c23f8e68b8fc9ad44071b2d508cf669
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          F15827BEC5BABE89C21DCDAE77464BF1
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
          • Size 701B
          • SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          103621DE9CD5414CC2538780B4B75751
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
          • Size 192B
          • SHA256 67fb82781199dce30a66f45a7aeb66ebd130aa38334eb9791344a5953d31ccbd
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
          • Size 488B
          • SHA256 5cfb49b71ce4821cdfbcbcf594bd6f8cebc4fb12f1c6800d57f2fb90dd15a79c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
          • Size 450B
          • SHA256 6fac99c340fbc4d487a085dc7865a410b0f63ca8e362b698e04516a416b3b7fb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          421EC2E1E0F47FC59DB99BB19E16DA88
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
          • Size 484B
          • SHA256 f4dfa7cfce22168fbbdef6e4b5cb0e6fb46eb8de1073e96f3042b358a0803819
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          49A7F8B8A2FD8A9E65352CD7C88B1D10
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
          • Size 248B
          • SHA256 b4098054ee16d4dddadf5754169ac750cc77337c63d27afc15b76b3bdf489267
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
          • Size 488B
          • SHA256 a8d921dc1b4396b3cbf13621e439c3434fb153810f48f39bc10ba823b3484750
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
          • Size 474B
          • SHA256 422fa6d75ac8b3ea47ee45f6e77947f988267246b8ecfd94a8d7dbb9b7947513
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          F15827BEC5BABE89C21DCDAE77464BF1
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
          • Size 192B
          • SHA256 754431b3c4aac8cf84a30cb710b2b3fffa524aadcda8edbdf89b200cd5437cfa
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          DesktopWindowManager.exe
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\DesktopWindowManager.exe
          • Size 12.7MB
          • SHA256 da3f7b416ad93ec3ea00a4ad8cfdbfd664e26ac889387ae69c71a02cac4dd5a6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DesktopWindowManager.exe
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\DesktopWindowManager.exe
          • Size 12.5MB
          • SHA256 40a2f9b9a7bfb6d2b8450f84995db870115e070c54c023b8253b6aef814d012b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          UpdateService.exe
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\UpdateService.exe
          • Size 12.8MB
          • SHA256 7285426d37de256f823c121c61fa4820d9539283470196737eb16468aad60e56
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CoreSystem.exe
          • Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\CoreSystem.exe
          • Size 12.9MB
          • SHA256 2576e13b98e2c1d802863057756085dbce22b0823bc3e3c1fa10e5f5a9344f28
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WindowsShell.exe
          • Path C:\Users\Admin\AppData\Local\Temp\WindowsShell.exe
          • Size 13.2MB
          • SHA256 c7af7abf3fe242544f937805c1be97674556ba7b6f90325a5840627c0a00716a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ServiceHost.exe
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\ServiceHost.exe
          • Size 12.6MB
          • SHA256 7dc84018ddfbb9cce59b939f1eaca4b687d450aab3901059eb25ef29cb4722be
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BackgroundTask.exe
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe
          • Size 13.4MB
          • SHA256 3a2d8fe7130a7b9b5e7c52caa9e35d70ceadc98767dafef8f19f6a0c34c4bc39
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NetworkHelper.exe
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\NetworkHelper.exe
          • Size 13.0MB
          • SHA256 6b630997111a751bfa2a276f7fcaf385259108a9fdc2cbbe52aa793d112d1eac
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CoreSystem.exe
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\CoreSystem.exe
          • Size 13.3MB
          • SHA256 629a38a8bafd50eaa5ef0adb129537e391216853c7d916d4080d8401867be91d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WindowsInternal.exe
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsInternal.exe
          • Size 12.4MB
          • SHA256 6fafc18fe16178e34c4296fc5dad30563ebc0c85da3a675b996424947222fca9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WindowsInternal.exe
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsInternal.exe
          • Size 13.5MB
          • SHA256 f0d7bdb8fbafb04dbe86ad7ee4a9409095c9729f6885cf33332b6941dab5afa7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download