Analysis
- user interaction
yes - max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/10/2026, 12:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Q1949114311.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
Q1949114311.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
Behavioral task
behavioral3
Sample
RiMe.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
RiMe.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
odexl32.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target Q1949114311.exe
- Size 1.9MB
- Sample261009-pvsppaex6j
- SHA256 c74f55247aa2c72001024bd977c869cb5adce6f8604a4d32329f015b73ae2a49
- MD5 711cd47d4524145f9c488afecc85ebc7
- SHA1 2f9e5368c039db49018ec41bbb20a3b085788b24
- SHA512 8bf03abb818d6d11f210e17a7e8c8f3c941774390cf0c5e679cb18331089341d43486cdc7af1203b29eac476f2f802f789f17ec6926d17fdd099d13172a79a15
- SSDEEP 24576:DitHbptR5UngkbfXXqO7jiugTdtHxVAuN9AGFwzojqnIXxXi2+QV8epwMGqtc:WtR5UngkzvyPtHxWzojqnIXtl+NeBGqq
- TLSH T105953A203942C13EEA9113718D78EAFA565DAD102F35D1CF63987A6A3B78DC31933627
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: beacon_report.exe File opened (read-only) \??\L: beacon_report.exe File opened (read-only) \??\Q: beacon_report.exe File opened (read-only) \??\S: beacon_report.exe File opened (read-only) \??\R: beacon_report.exe File opened (read-only) \??\B: beacon_report.exe File opened (read-only) \??\E: beacon_report.exe File opened (read-only) \??\G: beacon_report.exe File opened (read-only) \??\H: beacon_report.exe File opened (read-only) \??\M: beacon_report.exe File opened (read-only) \??\X: beacon_report.exe File opened (read-only) \??\I: beacon_report.exe File opened (read-only) \??\N: beacon_report.exe File opened (read-only) \??\O: beacon_report.exe File opened (read-only) \??\T: beacon_report.exe File opened (read-only) \??\Y: beacon_report.exe File opened (read-only) \??\Z: beacon_report.exe File opened (read-only) \??\J: beacon_report.exe File opened (read-only) \??\K: beacon_report.exe File opened (read-only) \??\P: beacon_report.exe File opened (read-only) \??\U: beacon_report.exe File opened (read-only) \??\V: beacon_report.exe - Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 45 api.ipify.org 46 api.ipify.org 49 ip-api.com - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation Q1949114311.exe - Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9 beacon_report.exe - Executes dropped EXE 1 IoCs
pid Process 4504 beacon_report.exe - Loads dropped DLL 2 IoCs
pid Process 4504 beacon_report.exe 1244 rundll32.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4844 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname beacon_report.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain beacon_report.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Q1949114311.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beacon_report.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Q1949114311.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe 4504 beacon_report.exe - Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeDebugPrivilege 4504 beacon_report.exe Token: SeLoadDriverPrivilege 4504 beacon_report.exe Token: SeTakeOwnershipPrivilege 4504 beacon_report.exe Token: SeIncBasePriorityPrivilege 4504 beacon_report.exe Token: SeTcbPrivilege 4504 beacon_report.exe Token: SeDebugPrivilege 4504 beacon_report.exe Token: SeCreateTokenPrivilege 4504 beacon_report.exe Token: SeAssignPrimaryTokenPrivilege 4504 beacon_report.exe Token: SeLockMemoryPrivilege 4504 beacon_report.exe Token: SeIncreaseQuotaPrivilege 4504 beacon_report.exe Token: SeMachineAccountPrivilege 4504 beacon_report.exe Token: SeTcbPrivilege 4504 beacon_report.exe Token: SeSecurityPrivilege 4504 beacon_report.exe Token: SeTakeOwnershipPrivilege 4504 beacon_report.exe Token: SeLoadDriverPrivilege 4504 beacon_report.exe Token: SeSystemProfilePrivilege 4504 beacon_report.exe Token: SeSystemtimePrivilege 4504 beacon_report.exe Token: SeProfSingleProcessPrivilege 4504 beacon_report.exe Token: SeIncBasePriorityPrivilege 4504 beacon_report.exe Token: SeCreatePagefilePrivilege 4504 beacon_report.exe Token: SeCreatePermanentPrivilege 4504 beacon_report.exe Token: SeBackupPrivilege 4504 beacon_report.exe Token: SeRestorePrivilege 4504 beacon_report.exe Token: SeShutdownPrivilege 4504 beacon_report.exe Token: SeDebugPrivilege 4504 beacon_report.exe Token: SeAuditPrivilege 4504 beacon_report.exe Token: SeSystemEnvironmentPrivilege 4504 beacon_report.exe Token: SeChangeNotifyPrivilege 4504 beacon_report.exe Token: SeRemoteShutdownPrivilege 4504 beacon_report.exe Token: SeUndockPrivilege 4504 beacon_report.exe Token: SeSyncAgentPrivilege 4504 beacon_report.exe Token: SeEnableDelegationPrivilege 4504 beacon_report.exe Token: SeManageVolumePrivilege 4504 beacon_report.exe Token: SeImpersonatePrivilege 4504 beacon_report.exe Token: SeCreateGlobalPrivilege 4504 beacon_report.exe Token: 31 4504 beacon_report.exe Token: 32 4504 beacon_report.exe Token: 33 4504 beacon_report.exe Token: 34 4504 beacon_report.exe Token: 35 4504 beacon_report.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4504 beacon_report.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4660 wrote to memory of 4504 4660 Q1949114311.exe 89 PID 4504 wrote to memory of 4844 4504 beacon_report.exe 103 PID 4844 wrote to memory of 1244 4844 cmd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\Q1949114311.exe"C:\Users\Admin\AppData\Local\Temp\Q1949114311.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\ProgramData\Z^@(+&+!&`'A\beacon_report.exe"C:\ProgramData\Z^@(+&+!&`'A\beacon_report.exe"2⤵
- Enumerates connected drives
- Enumerates video capture drivers
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start "" "C:\Windows\SysWOW64\rundll32.exe" "C:\ProgramData\Z^@(+&+!&`'A\RIME.dll",_vmclientcore@16 "C:\ProgramData\Z^@(+&+!&`'A\beacon_report.exe"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\ProgramData\Z^@(+&+!&`'A\RIME.dll",_vmclientcore@16 "C:\ProgramData\Z^@(+&+!&`'A\beacon_report.exe"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1244
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1712
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Z^@(+&+!&`'A\beacon_report.exe
- Size 1.9MB
- SHA256 c74f55247aa2c72001024bd977c869cb5adce6f8604a4d32329f015b73ae2a49
- MD5 711cd47d4524145f9c488afecc85ebc7
- SHA1 2f9e5368c039db49018ec41bbb20a3b085788b24
- SHA512 8bf03abb818d6d11f210e17a7e8c8f3c941774390cf0c5e679cb18331089341d43486cdc7af1203b29eac476f2f802f789f17ec6926d17fdd099d13172a79a15
- SSDEEP 24576:DitHbptR5UngkbfXXqO7jiugTdtHxVAuN9AGFwzojqnIXxXi2+QV8epwMGqtc:WtR5UngkzvyPtHxWzojqnIXtl+NeBGqq
- TLSH T105953A203942C13EEA9113718D78EAFA565DAD102F35D1CF63987A6A3B78DC31933627
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Z^@(+&+!&`'A\rime.dll
- Size 3.4MB
- SHA256 71774738fd6957b6e9efc344cd89b69918438d00b6d4d73560cb4ea430e9c05e
- MD5 fdc82d4ff7e988fb58e185a404231908
- SHA1 0dabd90d378eb00ac5a99b7ddf1f8a4d3e9138f3
- SHA512 0cc8cda6a81463f5cc2a0486778b5eafa2b5c9cb72ca74b911007afba59c858f53bf12849c5394ed24ca7678e09c2f36a93f3f36cc1cedfb04f56831f0cdcbf5
- SSDEEP 98304:+ifW4u9EvlxZ8lj+L569ywUn4XMNi6KsNAh00/vDp:LDyRKRi6KsNcH/vDp
- TLSH T148F5E1233DE580BAC25F02704A6F77AD76FDD1B14D3441A726C86F286DB09A2653CB63
- MD5 SHA1 SHA512 SSDEEP TLSH