Overview

overview

7

Static

static

5

8a8cc5bf00...67.exe

windows10-2004-x64

7

8a8cc5bf00...67.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/10/2026, 14:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    8a8cc5bf0031f400eae5123cd139db8dd3f092c8488d7e7d3fa52bee23485167.exe
  • Size 13.5MB
  • Sample261001-rm2nqszfra
  • SHA256 8a8cc5bf0031f400eae5123cd139db8dd3f092c8488d7e7d3fa52bee23485167
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistence

Malware Config

Signatures

  • Deletes itself 1 TTPs 1 IoCs
    defense_evasion
  • Executes dropped EXE 20 IoCs
  • Adds Run key to start application 2 TTPs 15 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 17 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Detect suspicious telegram bot 11 IoCs

    Detect suspicious telegram bot.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 42 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8a8cc5bf0031f400eae5123cd139db8dd3f092c8488d7e7d3fa52bee23485167.exe
    "C:\Users\Admin\AppData\Local\Temp\8a8cc5bf0031f400eae5123cd139db8dd3f092c8488d7e7d3fa52bee23485167.exe"
    1⤵
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3480
    • C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UpdateService.exe
      "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UpdateService.exe" --monitor
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4936
  • C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UpdateService.exe
    "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UpdateService.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5592
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsShell.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsShell.exe" --monitor
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:5944
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsShell.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsShell.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5080
    • C:\Users\Admin\AppData\Local\Temp\InputService.exe
      "C:\Users\Admin\AppData\Local\Temp\InputService.exe" --monitor
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1256
  • C:\Users\Admin\AppData\Local\Temp\InputService.exe
    "C:\Users\Admin\AppData\Local\Temp\\InputService.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4592
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\BackgroundTask.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\BackgroundTask.exe" --monitor
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1840
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\BackgroundTask.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\BackgroundTask.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4432
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe" --monitor
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:252
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1040
    • C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe" --monitor
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      PID:3188
  • C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3816
    • C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe
      "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe" --monitor
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      PID:4548
  • C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe
    "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2452
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe" --monitor
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      PID:5736
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1468
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemHost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemHost.exe" --monitor
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      PID:1116
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemHost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemHost.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3108
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe" --monitor
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      PID:4612
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:2080
    • C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe
      "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe" --monitor
      2⤵
        PID:5508

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          103621DE9CD5414CC2538780B4B75751
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
          • Size 808B
          • SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
          • Size 313B
          • SHA256 acb9d981851f4c3271fad627cdfda2a2d8599028a2b9b0f06fd24acd3767dcad
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
          • Size 2KB
          • SHA256 d44246f1e72024ac887ffe497e83fc073b50b0ca0221a7face0e33420dd3edf5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          421EC2E1E0F47FC59DB99BB19E16DA88
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
          • Size 280B
          • SHA256 b58f7696fc81ea50570304ba19a94ac07ef88f00cb18545c035b4dc13205bfef
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          49A7F8B8A2FD8A9E65352CD7C88B1D10
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
          • Size 180KB
          • SHA256 32f5af5e460ef5109236f44520aad24427a7e4469ce5b2e64acb8d4f6603c5b9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
          • Size 976B
          • SHA256 8c7602efe22cb85666dfca8b597ad0f33617fdd861c8bf7e951c305dfe59b3dc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
          • Size 2KB
          • SHA256 3cc2fe6a06d9a79d274bf83b927d649eb9647fed2c43a965e1148221023fd74d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          F15827BEC5BABE89C21DCDAE77464BF1
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
          • Size 701B
          • SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          103621DE9CD5414CC2538780B4B75751
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
          • Size 192B
          • SHA256 c04097e13eae72113e7e03881ad5b713704b83010f5e0627d5c9fd341d56856a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
          • Size 488B
          • SHA256 cc99b3341a7f7c5a6e519b4cbe5a52b28575d831441a78fe6252ca176bdbb8b3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
          • Size 450B
          • SHA256 466896dfdd80ae0a608c73ffdf5ae5dc8187dde971933e138fd1dc19dc597e2f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          421EC2E1E0F47FC59DB99BB19E16DA88
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
          • Size 484B
          • SHA256 17502425b649a9db57034b3f853eedb2e307ce655c12efe807676df865eeb8b3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          49A7F8B8A2FD8A9E65352CD7C88B1D10
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
          • Size 248B
          • SHA256 7cf3984662d485a3851e57e712a6c6b91f787024b44866104e0f1a84dca1b443
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
          • Size 488B
          • SHA256 4b6ad4775702724e1a7d81775135bb9b710a2939812c313666760f3a4bcac31a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
          • Size 474B
          • SHA256 b6df8600a4f3a20f818f94c9c58f30677240fb925cee1f50437d4cdc531569c5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          F15827BEC5BABE89C21DCDAE77464BF1
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
          • Size 192B
          • SHA256 a9e36916e18db20428d798d9b501da52d78da49a36db2eaee2cf911a12c2606c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ServiceHost.exe
          • Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe
          • Size 14.3MB
          • SHA256 8a840d604ff21a79c9e757c534b7b87cbc044afe4f075683fb5f393fc54538c8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ServiceHost.exe
          • Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe
          • Size 14.7MB
          • SHA256 7b897d7b24019e52ee432e55886a7a6e513547f2fed0906d60994c15bec86aa5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          UpdateService.exe
          • Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UpdateService.exe
          • Size 13.6MB
          • SHA256 49ef79079f777adcbc0c06bd3639e22b3b402ca14924e760e386a37822e13793
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          InputService.exe
          • Path C:\Users\Admin\AppData\Local\Temp\InputService.exe
          • Size 13.8MB
          • SHA256 bc05f4577cdbdf0b70ba0c24c53744cb0feeaf3b5c2165897bc40dc86b196acb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WindowsHost.exe
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsHost.exe
          • Size 14.2MB
          • SHA256 6af65d7030b5dcc997693c224bd70b065a49b8e8fe140bc71e934cad13ffea16
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SystemTrayHelper.exe
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\SystemTrayHelper.exe
          • Size 14.4MB
          • SHA256 7fd592bcbbe3e109f251390e445bc1b88b7189370222aad1c1c2600646932cd0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DesktopWindowManager.exe
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe
          • Size 14.1MB
          • SHA256 5812d82762e15d0fe78d9d8546331a9d2ca8241d8f3fd49041da2e36db924b13
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WindowsHost.exe
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsHost.exe
          • Size 14.6MB
          • SHA256 98edf645cf555379aa0fcf00400af6febe1b55309075bdfd413ed2aa4a4c4ffb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WindowsShell.exe
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\WindowsShell.exe
          • Size 13.7MB
          • SHA256 3c3df803e40faa31e3970b2f03f923455fbcfae908252503d44b4ce73c6bf91f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BackgroundTask.exe
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\BackgroundTask.exe
          • Size 13.9MB
          • SHA256 557d90fa3ff86918cf08b153933d8a9d811a81cdbb81f36425a6082b1926b8f6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SystemHost.exe
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SystemHost.exe
          • Size 14.5MB
          • SHA256 119911f095f5bcaeb13dc576afe13d2b5193ef0e7b3823b779ecb2d3f6f55404
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download