427b9db53e2ac3842242ca7d6b00d9bad1969e1c8a40868edae53207d0d4af85

Analysis

user interaction
yes
max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 02:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
r6chams/RuntimeCacheHost-CrossPC-R2-Diagnostic.exe
Size 1.7MB
Sample261017-cwpyzagy6z
SHA256 427b9db53e2ac3842242ca7d6b00d9bad1969e1c8a40868edae53207d0d4af85
MD5 5fa6554e47eeef290afb69e66661f2a0
SHA1 49d8e5d7636cd620c9459046df5532e523450a21
SHA512 4ecf165a81b95365b87e103d16d7b99f96657ba309d440a311d66fbd4fc06053b7fa84808ef36aad337ddc1720587d359cda63331112300569ee95ce3250b70c
SSDEEP 49152:nazlABR14H+xhkQmtsLnvMWs3ZGkA79ieC92pjzkn9AapX:dBAH+zjap
TLSH
T12F855A9C303CE0FE79C998B6D3E3ECC54A3ADAB402A43A654564C2B475AB2F3DD15907
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1808	b9b6d0eab1e8d3ae.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1176	RuntimeCacheHost-CrossPC-R2-Diagnostic.exe
1176	RuntimeCacheHost-CrossPC-R2-Diagnostic.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1176	RuntimeCacheHost-CrossPC-R2-Diagnostic.exe
Token: SeDebugPrivilege	1808	b9b6d0eab1e8d3ae.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 1808	1176	RuntimeCacheHost-CrossPC-R2-Diagnostic.exe	87

C:\Users\Admin\AppData\Local\Temp\r6chams\RuntimeCacheHost-CrossPC-R2-Diagnostic.exe
"C:\Users\Admin\AppData\Local\Temp\r6chams\RuntimeCacheHost-CrossPC-R2-Diagnostic.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1176
- C:\ProgramData\32c85311c8626585\b9b6d0eab1e8d3ae.exe
  "C:\ProgramData\32c85311c8626585\b9b6d0eab1e8d3ae.exe" --launch --wait 600 --owner 1176 --stop-event "Local\c8483c77512245a2567f45ce2e6839b7-stop" --lease-mutex "Local\c8483c77512245a2567f45ce2e6839b7" --self-delete
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

b9b6d0eab1e8d3ae.exe

Path C:\ProgramData\32c85311c8626585\b9b6d0eab1e8d3ae.exe
Size 1.5MB
SHA256 e917dee14f33ac10c078d0e2233eff92a91c14524a2d5a1add010c2bd61e4998
MD5 33ef767694c98f92a4fb4fe8c7df1b65
SHA1 f3f5b283df395cd6a1d1a72a4e0b2544661785ab
SHA512 120fe29090ab4eb58750c0f8b20672b735cf06d6cc6f53aa6b48e7f06147fba4ea2c4944861f1254862c7d76c3d4b07c137dd67c5e3edd9f58f230d2f2523669
SSDEEP 12288:EfS9nCYYUP/3rEHdVrFZZQkCSlSjSNvsMuIiQU7zCU4VuBEsQBG/1LYHCQnO6:REHdVr2hSsUB2zCU4VuBEskZX
TLSH
T17B75DB4084B2E45F8DC61C3F52086C6888ECA4AF93622EC7D9E69554CD47BCF6D3BE64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\2a30bfd8650f8b3b\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 f1afc9f392144a4d511395abefd4066b06cc59be45771a2c2a008ae50c72fce5
MD5 ccaf93a3fd14d8bdbae792a8a1fc2110
SHA1 7e1a3ac004b6d5729b6ed955c8032c7621dc0e31
SHA512 5d318753a8a3a3d64aae9668dfaaa6efa867f96410253b8791038e776c29c70315485462cdaa3e5be526a388abc47c6e79442c933178724d6890f6484362b29f
SSDEEP 3:7HlGlll/l/lXp9ZjrPBY0HlOl/JaltZP:7H0dPBY0gG7
TLSH
T16F5322C023830E23C803033088CB0FA03E38A22803A308E283E282B0E8EEB0008A02C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\2a30bfd8650f8b3b\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
MD5 SHA1 SHA512

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Path C:\Users\Admin\AppData\Local\D3DSCache\2a30bfd8650f8b3b\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Size 992B
SHA256 7c05e2345592172479a671ba2fd0712d34126ccf861a09e130a8b05c2fc13ec6
MD5 0b558a56a9630a7dfb0b23d6ad489967
SHA1 d187e15d65f7c53453c62e0bddcb432b22efb38c
SHA512 be8cdd49ca09f8956028be220dc1f987d52b7543e03ad43e9bc0244fabe969c306e7eb58d0da1f5863d72d56ce0b4ea4a44d16f677c18f79b8c2f58a0a07f167
TLSH
T173118C293FC61CB0F2B35530C2B191A77613F2033AC05A0D44C396248A23B0BA942F4D
MD5 SHA1 SHA512 TLSH

Submit Download

RuntimeCacheHost-1176.log

Path C:\Users\Admin\AppData\Local\RuntimeCacheHost\RuntimeCacheHost-1176.log
Size 584B
SHA256 8a00bfaf3a5784048a8fee026e965b7b54ea93ecd5a53b7a13b6f422e0c2318f
MD5 ec9231a122afda852d9e1ef259212dec
SHA1 3c3bdb7cd750908e5e19cde84e230d7014bb8111
SHA512 24f5989c6a4b50fa1c8617ea6fd46d63303a4adb3aec313f096e6b83577498d717ee5e3effec9fc57892706edeb64a10f7e8115b263b4c7a2da250c7d24d7539
TLSH
T138F04F6C8CB2A8E800D1D512B99CAE0C5EB6F6726B4D18E8A97DDF50CC85E13F84A490
MD5 SHA1 SHA512 TLSH

Submit Download

RuntimeCacheHost-1176.log

Path C:\Users\Admin\AppData\Local\RuntimeCacheHost\RuntimeCacheHost-1176.log
Size 1KB
SHA256 034573a8752044444e6cbc2c72ca0cf10583770fef120bb468a42a2f4359b56c
MD5 3bc913f773e9798926ad2f5fdf157e77
SHA1 8a3a0e6096e67ecd1110f3617daa449fae02d265
SHA512 f3cad47d3ce9ba1dec7efc4e9f103ce01d1c72b6d071fc783d90980c270c529e50c7ab66fedccf3ef17bf04554d634f706d2d60f93c577188add67ffe5f5ce5e
TLSH
T14A21A07C4CF168E800929612BE5CAA0C5EB7F1721B5C24E87E7CDF54DC95E53F986480
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1808-19-0x000001DD897F0000-0x000001DD897F1000-memory.dmp

Download

memory/1808-30-0x000001DD897F0000-0x000001DD897F1000-memory.dmp

Download

memory/1808-29-0x000001DD897F0000-0x000001DD897F1000-memory.dmp

Download

memory/1808-28-0x000001DD897F0000-0x000001DD897F1000-memory.dmp

Download

memory/1808-27-0x000001DD897F0000-0x000001DD897F1000-memory.dmp

Download

memory/1808-26-0x000001DD897F0000-0x000001DD897F1000-memory.dmp

Download

memory/1808-31-0x000001DD897F0000-0x000001DD897F1000-memory.dmp

Download

memory/1808-25-0x000001DD897F0000-0x000001DD897F1000-memory.dmp

Download

memory/1808-20-0x000001DD897F0000-0x000001DD897F1000-memory.dmp

Download

memory/1808-21-0x000001DD897F0000-0x000001DD897F1000-memory.dmp

Download