Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/10/2026, 12:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Q1949114311.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
Q1949114311.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
Behavioral task
behavioral3
Sample
RiMe.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
RiMe.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
odexl32.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target Q1949114311.exe
- Size 1.9MB
- Sample261009-pvsppaex6j
- SHA256 c74f55247aa2c72001024bd977c869cb5adce6f8604a4d32329f015b73ae2a49
- MD5 711cd47d4524145f9c488afecc85ebc7
- SHA1 2f9e5368c039db49018ec41bbb20a3b085788b24
- SHA512 8bf03abb818d6d11f210e17a7e8c8f3c941774390cf0c5e679cb18331089341d43486cdc7af1203b29eac476f2f802f789f17ec6926d17fdd099d13172a79a15
- SSDEEP 24576:DitHbptR5UngkbfXXqO7jiugTdtHxVAuN9AGFwzojqnIXxXi2+QV8epwMGqtc:WtR5UngkzvyPtHxWzojqnIXtl+NeBGqq
- TLSH T105953A203942C13EEA9113718D78EAFA565DAD102F35D1CF63987A6A3B78DC31933627
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: beacon_report.exe File opened (read-only) \??\X: beacon_report.exe File opened (read-only) \??\Y: beacon_report.exe File opened (read-only) \??\R: beacon_report.exe File opened (read-only) \??\G: beacon_report.exe File opened (read-only) \??\I: beacon_report.exe File opened (read-only) \??\J: beacon_report.exe File opened (read-only) \??\L: beacon_report.exe File opened (read-only) \??\M: beacon_report.exe File opened (read-only) \??\B: beacon_report.exe File opened (read-only) \??\D: beacon_report.exe File opened (read-only) \??\O: beacon_report.exe File opened (read-only) \??\V: beacon_report.exe File opened (read-only) \??\Z: beacon_report.exe File opened (read-only) \??\H: beacon_report.exe File opened (read-only) \??\N: beacon_report.exe File opened (read-only) \??\P: beacon_report.exe File opened (read-only) \??\U: beacon_report.exe File opened (read-only) \??\K: beacon_report.exe File opened (read-only) \??\Q: beacon_report.exe File opened (read-only) \??\S: beacon_report.exe File opened (read-only) \??\T: beacon_report.exe - Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 13 api.ipify.org 1 api.ipify.org 1 ip-api.com - Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9 beacon_report.exe - Executes dropped EXE 1 IoCs
pid Process 5468 beacon_report.exe - Loads dropped DLL 2 IoCs
pid Process 5468 beacon_report.exe 5936 rundll32.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2968 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname beacon_report.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain beacon_report.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beacon_report.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Q1949114311.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe 5468 beacon_report.exe - Suspicious behavior: LoadsDriver 64 IoCs
pid Process 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeDebugPrivilege 5468 beacon_report.exe Token: SeLoadDriverPrivilege 5468 beacon_report.exe Token: SeTakeOwnershipPrivilege 5468 beacon_report.exe Token: SeIncBasePriorityPrivilege 5468 beacon_report.exe Token: SeTcbPrivilege 5468 beacon_report.exe Token: SeDebugPrivilege 5468 beacon_report.exe Token: SeCreateTokenPrivilege 5468 beacon_report.exe Token: SeAssignPrimaryTokenPrivilege 5468 beacon_report.exe Token: SeLockMemoryPrivilege 5468 beacon_report.exe Token: SeIncreaseQuotaPrivilege 5468 beacon_report.exe Token: SeMachineAccountPrivilege 5468 beacon_report.exe Token: SeTcbPrivilege 5468 beacon_report.exe Token: SeSecurityPrivilege 5468 beacon_report.exe Token: SeTakeOwnershipPrivilege 5468 beacon_report.exe Token: SeLoadDriverPrivilege 5468 beacon_report.exe Token: SeSystemProfilePrivilege 5468 beacon_report.exe Token: SeSystemtimePrivilege 5468 beacon_report.exe Token: SeProfSingleProcessPrivilege 5468 beacon_report.exe Token: SeIncBasePriorityPrivilege 5468 beacon_report.exe Token: SeCreatePagefilePrivilege 5468 beacon_report.exe Token: SeCreatePermanentPrivilege 5468 beacon_report.exe Token: SeBackupPrivilege 5468 beacon_report.exe Token: SeRestorePrivilege 5468 beacon_report.exe Token: SeShutdownPrivilege 5468 beacon_report.exe Token: SeDebugPrivilege 5468 beacon_report.exe Token: SeAuditPrivilege 5468 beacon_report.exe Token: SeSystemEnvironmentPrivilege 5468 beacon_report.exe Token: SeChangeNotifyPrivilege 5468 beacon_report.exe Token: SeRemoteShutdownPrivilege 5468 beacon_report.exe Token: SeUndockPrivilege 5468 beacon_report.exe Token: SeSyncAgentPrivilege 5468 beacon_report.exe Token: SeEnableDelegationPrivilege 5468 beacon_report.exe Token: SeManageVolumePrivilege 5468 beacon_report.exe Token: SeImpersonatePrivilege 5468 beacon_report.exe Token: SeCreateGlobalPrivilege 5468 beacon_report.exe Token: 31 5468 beacon_report.exe Token: 32 5468 beacon_report.exe Token: 33 5468 beacon_report.exe Token: 34 5468 beacon_report.exe Token: 35 5468 beacon_report.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5468 beacon_report.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 256 wrote to memory of 5468 256 Q1949114311.exe 89 PID 5468 wrote to memory of 2968 5468 beacon_report.exe 92 PID 2968 wrote to memory of 5936 2968 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\Q1949114311.exe"C:\Users\Admin\AppData\Local\Temp\Q1949114311.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:256 -
C:\ProgramData\j`%,@{({%[[V\beacon_report.exe"C:\ProgramData\j`%,@{({%[[V\beacon_report.exe"2⤵
- Enumerates connected drives
- Enumerates video capture drivers
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start "" "C:\Windows\SysWOW64\rundll32.exe" "C:\ProgramData\j`%,@{({%[[V\RIME.dll",_vmclientcore@16 "C:\ProgramData\j`%,@{({%[[V\beacon_report.exe"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\ProgramData\j`%,@{({%[[V\RIME.dll",_vmclientcore@16 "C:\ProgramData\j`%,@{({%[[V\beacon_report.exe"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5936
-
-
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\j`%,@{({%[[V\Rime.Dll
- Size 3.4MB
- SHA256 71774738fd6957b6e9efc344cd89b69918438d00b6d4d73560cb4ea430e9c05e
- MD5 fdc82d4ff7e988fb58e185a404231908
- SHA1 0dabd90d378eb00ac5a99b7ddf1f8a4d3e9138f3
- SHA512 0cc8cda6a81463f5cc2a0486778b5eafa2b5c9cb72ca74b911007afba59c858f53bf12849c5394ed24ca7678e09c2f36a93f3f36cc1cedfb04f56831f0cdcbf5
- SSDEEP 98304:+ifW4u9EvlxZ8lj+L569ywUn4XMNi6KsNAh00/vDp:LDyRKRi6KsNcH/vDp
- TLSH T148F5E1233DE580BAC25F02704A6F77AD76FDD1B14D3441A726C86F286DB09A2653CB63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\j`%,@{({%[[V\beacon_report.exe
- Size 1.9MB
- SHA256 c74f55247aa2c72001024bd977c869cb5adce6f8604a4d32329f015b73ae2a49
- MD5 711cd47d4524145f9c488afecc85ebc7
- SHA1 2f9e5368c039db49018ec41bbb20a3b085788b24
- SHA512 8bf03abb818d6d11f210e17a7e8c8f3c941774390cf0c5e679cb18331089341d43486cdc7af1203b29eac476f2f802f789f17ec6926d17fdd099d13172a79a15
- SSDEEP 24576:DitHbptR5UngkbfXXqO7jiugTdtHxVAuN9AGFwzojqnIXxXi2+QV8epwMGqtc:WtR5UngkzvyPtHxWzojqnIXtl+NeBGqq
- TLSH T105953A203942C13EEA9113718D78EAFA565DAD102F35D1CF63987A6A3B78DC31933627
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\5,($+%}'#'`6\4%=+'&]{.426
- Size 16KB
- SHA256 6b208ce68ba3f6c788bd89ba677ebf1c2407a55f9f43a42ea7207635634baf66
- MD5 1569d08f94cca34993ae1ccb763de7d0
- SHA1 590df795c95b229360abb5cd1d83c1eaef755e01
- SHA512 ab289c6cf43c36f2f704caf327acb7c7833c50bb8120edca01ba1ee20a9e95eccd385e005146c6c94dfba6f483b470c5183cfff40e1cf2ee7b38d3600f822b36
- SSDEEP 192:cvuYacCCpQIw9l0HaLs0jbxVWnYe+PjP8srcQqwBjtlArMsoX:QuoCCpQIY0HaLs0JVWnYPL1tqOUc
- TLSH T179724A8B471A305AFAD7CA75C2B6866BEC30BAD0B76609FF0169C1911D81FE05B3D309
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\5,($+%}'#'`6\4%=+'&]{.426.mds
- Size 16KB
- SHA256 da0f8109d4b7bd2577f4f4b63a48aa0ea774a332378a3aec0407e3bc5fee59d0
- MD5 ba6a467bf951d6497751cb966ca20f24
- SHA1 c6bd28913e70ba3d2f2b39e98211ebed6855e35a
- SHA512 681d46e6e5b47b2bfb0e6e0703c58f25d9538f4090e40b53bacb655a32bf9303fec43320c142564924da22292f6522607d8e5b91116379a9fd1baad55ade362c
- SSDEEP 384:ltgqFBE86oO2AfPCTskEGtMbYiZxeUf944iYPddvjL/LGf:ltgWi2AX6sfiOra4iYHjXi
- TLSH T1C072CF362FEF99B4CF11EA4E18271EAE64C8DE1B1B71060456079E641ECD62CC3E126E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\5,($+%}'#'`6\6)}+=(`+.639
- Size 91KB
- SHA256 46883bc25c77678f60c1b836f4c438d87158c9af6b229f533522f635a0d5276e
- MD5 d751a1ebc49ecd3ce75ef683878057db
- SHA1 8887fc3afcdf48721312d8df9865c6c8234b8614
- SHA512 f0565d8b7c92877327bc8939cf09d21010dbb0498200f358f7d060ae70839a2349a0a2bc6d080be531400b47529d5e7fe0e7a425929096e22c77760f8a498e4d
- SSDEEP 1536:AtFSIfIlTfynQGkaeEa69TXdZSip9M+PccXX6G+2+z2q:pIfIlT6QGK69TrDDMSzX+2+2q
- TLSH T1CF935B83D35615C6D6AACAB9C1AA9223EF71BC09172553CF4E60B6501F32FE19F39306
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\5,($+%}'#'`6\6)}+=(`+.639.mds
- Size 91KB
- SHA256 1dbd2881e28f249c8bd0cfa5b30f63c95edf62e974e04dc4567708c876b34fe3
- MD5 bede0423171aae58447b3f5ff94fe5ea
- SHA1 e7e428b00977121a777c9c0b03892a932d6e8c2b
- SHA512 9ddf0aec88df4d3163b04d7ac66063e7a72f0163e46460bf7588de776fd03934ea9fe6ac029a82eb0cf0b759aa7c2ee55944dd3e5f5df45cc9eecdac062bb1f1
- SSDEEP 1536:VRceaO48FeU6yql0zskVvnvfHXiRG77Y4/Wpu8uM9ebGvRD2yVavSO8RDASvYuS:VRJ4RzD0vpXXiO7FN8yb8D2yVISTFVS
- TLSH T1BD931223BBD7BD45BA0BF0E63727DDB91DC2BE7100F6ECA99213DA510961C1061D69E0
- MD5 SHA1 SHA512 SSDEEP TLSH