fcaca36217718a4ba509ca3e46190051b78bd75a8b2e06aff07822b599f1f93d

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 20:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
svcmon.exe
Size 66.3MB
Sample261006-ytabdsv1e1
SHA256 fcaca36217718a4ba509ca3e46190051b78bd75a8b2e06aff07822b599f1f93d
MD5 c33df24864abbbcbb7ae2cbdefeeedbc
SHA1 aa67dda3279089a4ffd9d36ad32dd0d8b538586b
SHA512 17bd81998442323a62f8a9155be88863ef0865b73741b6a6d2782b91d61a675302269b73aad556beda0bc2d2ca55c53111ed20655324443dc37fd0bea38404b9
SSDEEP 393216:jge9saBAVhdltnuXiOcy/SG9Zl4hmfMn1HtgIIlMvzEr2MsVDwJ69LXufWj:Me9cVhQiOb/SAEJIlMLEiRR
TLSH
T1C3E7AD11A7E80B06E63FC27DC6639252E7B1B4430351C6CF0198DA993F53BE19A772B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svcmon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svcmon.exe

C:\Users\Admin\AppData\Local\Temp\svcmon.exe
"C:\Users\Admin\AppData\Local\Temp\svcmon.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:4672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CS16Protection_Debug.log

Path C:\Users\Admin\AppData\Local\Temp\CS16Protection_Debug.log
Size 524B
SHA256 eb91e625cca226308caaf333be34de2edaa9d66801613fcdcd0e3a6f8033cc28
MD5 e1dfdbc0a4757337ad1861be80cbd4cc
SHA1 470a8d1690ef829ae4c241186ebf090e02e7ce46
SHA512 d5d434b549eb025d9ec696a93c600e54a6a21e9ef5b1bf899900b2f1b3da3b83cd47e69ff1e732cd8973610715ffb08d379b6aea4b00c9749a2114f394ceceee
TLSH
T161F02B4C17CFE72A14491675795E4C2854B06CEA5E830CFC5B34E6481978F189FE3392
MD5 SHA1 SHA512 TLSH

Submit Download