Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/10/2026, 13:59
Behavioral task
behavioral1
Sample
Server.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
Server.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target Server.exe
- Size 93KB
- Sample261008-radfdahv2s
- SHA256 ef05f7143bbbbbf9be500498b670a9c0c19763db11910a82be97394163249268
- MD5 dc92e1f4812259c917d4ea67c76196d6
- SHA1 7aa101f753a9f87f1dba308697e4915ddca4d271
- SHA512 3d1f453c1c6b89967929431defb427f2edde0f387db7531b8ce8540f3928d82e58b34a50f474ab84987cbf37e029a11c1eb69333a54125c1f40fae9f7ba6e6a7
- SSDEEP 768:QY3CInD7O/pBcxYsbae6GIXb9pDX2t98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk3QsGx:KIvOx6baIa9RZj00ljEwzGi1dDoDVgS
- TLSH T1F693E84977E52524E4BF56F79871F2004E34B48B1602E39D48F219AA1B33AC44F89FEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Disables Task Manager via registry modification
- Modifies Windows Firewall 2 TTPs 3 IoCs
pid Process 5432 netsh.exe 5172 netsh.exe 4228 netsh.exe - Creates a file in the Startup directory 1 TTPs 4 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d27445eb0c4c21a8b6c0f4204de42b98Windows Update.exe Server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe Server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe Server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d27445eb0c4c21a8b6c0f4204de42b98Windows Update.exe Server.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Server.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Server.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe 1188 Server.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1188 Server.exe - Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 1188 Server.exe Token: 33 1188 Server.exe Token: SeIncBasePriorityPrivilege 1188 Server.exe Token: 33 1188 Server.exe Token: SeIncBasePriorityPrivilege 1188 Server.exe Token: 33 1188 Server.exe Token: SeIncBasePriorityPrivilege 1188 Server.exe Token: 33 1188 Server.exe Token: SeIncBasePriorityPrivilege 1188 Server.exe Token: 33 1188 Server.exe Token: SeIncBasePriorityPrivilege 1188 Server.exe Token: 33 1188 Server.exe Token: SeIncBasePriorityPrivilege 1188 Server.exe Token: 33 1188 Server.exe Token: SeIncBasePriorityPrivilege 1188 Server.exe Token: 33 1188 Server.exe Token: SeIncBasePriorityPrivilege 1188 Server.exe Token: 33 1188 Server.exe Token: SeIncBasePriorityPrivilege 1188 Server.exe Token: 33 1188 Server.exe Token: SeIncBasePriorityPrivilege 1188 Server.exe Token: 33 1188 Server.exe Token: SeIncBasePriorityPrivilege 1188 Server.exe Token: 33 1188 Server.exe Token: SeIncBasePriorityPrivilege 1188 Server.exe Token: 33 1188 Server.exe Token: SeIncBasePriorityPrivilege 1188 Server.exe Token: 33 1188 Server.exe Token: SeIncBasePriorityPrivilege 1188 Server.exe Token: 33 1188 Server.exe Token: SeIncBasePriorityPrivilege 1188 Server.exe Token: 33 1188 Server.exe Token: SeIncBasePriorityPrivilege 1188 Server.exe Token: 33 1188 Server.exe Token: SeIncBasePriorityPrivilege 1188 Server.exe Token: 33 1188 Server.exe Token: SeIncBasePriorityPrivilege 1188 Server.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1188 wrote to memory of 5432 1188 Server.exe 90 PID 1188 wrote to memory of 5172 1188 Server.exe 92 PID 1188 wrote to memory of 4228 1188 Server.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"1⤵
- Creates a file in the Startup directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:5432
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe"2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:5172
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4228
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1