979d56a59be9dd236936bbd18e2c9d9221be958624a9b529f9c36d1b413841f6

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
176.65.144.144_sample.exe
Size 1.9MB
Sample261017-psc68afs7k
SHA256 979d56a59be9dd236936bbd18e2c9d9221be958624a9b529f9c36d1b413841f6
MD5 92e5a8c47623ed40a22a06bf70a5c5e7
SHA1 616cdb3709ea86a5650466ee86ff142b235ccf13
SHA512 bd0d1600825d6d91f0e6542363c1caa1ccbb2cecc066cdd966d005e4d7283b8056728da5d9aab4d906200a352da74770a4237494e254d98dd1556dcb801a180f
SSDEEP 24576:PRfqQaFbnTwprZMo9wxGmUGJZ4bkFFJ8dtAGcMVTvHdOmdVIH06iy9FMsYX:PoQaVqrZMoob4bkFJ8oGrVBbIU6isvW
TLSH
T120956D03F69580FCC55EC1788347A632EA22BC8E092576EB27D09B253E76F915F0DB19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\System Monitor 726 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\176.65.144.144_sample.exe"	176.65.144.144_sample.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\Security Service 812 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\176.65.144.144_sample.exe"	176.65.144.144_sample.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
3	api.ipify.org
8	api.ipify.org

Executes a command shell one-liner 1 TTPs 28 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3344	cmd.exe
784	cmd.exe
2640	cmd.exe
2764	cmd.exe
4704	cmd.exe
5844	cmd.exe
1108	cmd.exe
2336	cmd.exe
5848	cmd.exe
5484	cmd.exe
3292	cmd.exe
944	cmd.exe
2392	cmd.exe
792	cmd.exe
3816	cmd.exe
4292	cmd.exe
932	cmd.exe
6132	cmd.exe
5200	cmd.exe
1572	cmd.exe
4516	cmd.exe
5792	cmd.exe
2376	cmd.exe
1980	cmd.exe
2964	cmd.exe
2512	cmd.exe
4244	cmd.exe
4952	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	176.65.144.144_sample.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	176.65.144.144_sample.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	176.65.144.144_sample.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	176.65.144.144_sample.exe

Gathers network information 2 TTPs 28 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4144	ipconfig.exe
3216	ipconfig.exe
3112	ipconfig.exe
1184	ipconfig.exe
3272	ipconfig.exe
2128	ipconfig.exe
4188	ipconfig.exe
1060	ipconfig.exe
1536	ipconfig.exe
3012	ipconfig.exe
5896	ipconfig.exe
2612	ipconfig.exe
3440	ipconfig.exe
3956	ipconfig.exe
4832	ipconfig.exe
1308	ipconfig.exe
3736	ipconfig.exe
2596	ipconfig.exe
2884	ipconfig.exe
3760	ipconfig.exe
1376	ipconfig.exe
6124	ipconfig.exe
5652	ipconfig.exe
2844	ipconfig.exe
712	ipconfig.exe
1092	ipconfig.exe
5400	ipconfig.exe
4372	ipconfig.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 3344	4584	176.65.144.144_sample.exe	90
PID 3344 wrote to memory of 2884	3344	cmd.exe	91
PID 5392 wrote to memory of 784	5392	176.65.144.144_sample.exe	94
PID 784 wrote to memory of 5400	784	cmd.exe	95
PID 4584 wrote to memory of 6132	4584	176.65.144.144_sample.exe	96
PID 6132 wrote to memory of 4188	6132	cmd.exe	97
PID 5392 wrote to memory of 5200	5392	176.65.144.144_sample.exe	98
PID 5200 wrote to memory of 3760	5200	cmd.exe	99
PID 4584 wrote to memory of 2640	4584	176.65.144.144_sample.exe	100
PID 2640 wrote to memory of 1060	2640	cmd.exe	101
PID 5392 wrote to memory of 1572	5392	176.65.144.144_sample.exe	102
PID 1572 wrote to memory of 4372	1572	cmd.exe	103
PID 4584 wrote to memory of 2764	4584	176.65.144.144_sample.exe	104
PID 2764 wrote to memory of 2612	2764	cmd.exe	105
PID 5392 wrote to memory of 4704	5392	176.65.144.144_sample.exe	106
PID 4704 wrote to memory of 3440	4704	cmd.exe	107
PID 4584 wrote to memory of 5848	4584	176.65.144.144_sample.exe	109
PID 5848 wrote to memory of 1536	5848	cmd.exe	110
PID 5392 wrote to memory of 932	5392	176.65.144.144_sample.exe	111
PID 932 wrote to memory of 1376	932	cmd.exe	112
PID 4584 wrote to memory of 1980	4584	176.65.144.144_sample.exe	113
PID 1980 wrote to memory of 4144	1980	cmd.exe	114
PID 5392 wrote to memory of 2964	5392	176.65.144.144_sample.exe	115
PID 2964 wrote to memory of 6124	2964	cmd.exe	116
PID 4584 wrote to memory of 5484	4584	176.65.144.144_sample.exe	117
PID 5484 wrote to memory of 3956	5484	cmd.exe	118
PID 5392 wrote to memory of 3292	5392	176.65.144.144_sample.exe	119
PID 3292 wrote to memory of 3216	3292	cmd.exe	120
PID 4584 wrote to memory of 4516	4584	176.65.144.144_sample.exe	121
PID 4516 wrote to memory of 4832	4516	cmd.exe	122
PID 5392 wrote to memory of 2512	5392	176.65.144.144_sample.exe	123
PID 2512 wrote to memory of 5652	2512	cmd.exe	124
PID 4584 wrote to memory of 944	4584	176.65.144.144_sample.exe	125
PID 944 wrote to memory of 2844	944	cmd.exe	126
PID 5392 wrote to memory of 5844	5392	176.65.144.144_sample.exe	127
PID 5844 wrote to memory of 1308	5844	cmd.exe	128
PID 4584 wrote to memory of 5792	4584	176.65.144.144_sample.exe	129
PID 5792 wrote to memory of 712	5792	cmd.exe	130
PID 5392 wrote to memory of 1108	5392	176.65.144.144_sample.exe	131
PID 1108 wrote to memory of 1092	1108	cmd.exe	132
PID 4584 wrote to memory of 2336	4584	176.65.144.144_sample.exe	133
PID 2336 wrote to memory of 3112	2336	cmd.exe	134
PID 5392 wrote to memory of 4244	5392	176.65.144.144_sample.exe	135
PID 4244 wrote to memory of 1184	4244	cmd.exe	136
PID 4584 wrote to memory of 2392	4584	176.65.144.144_sample.exe	137
PID 2392 wrote to memory of 3012	2392	cmd.exe	138
PID 5392 wrote to memory of 792	5392	176.65.144.144_sample.exe	139
PID 792 wrote to memory of 3272	792	cmd.exe	140
PID 4584 wrote to memory of 2376	4584	176.65.144.144_sample.exe	141
PID 2376 wrote to memory of 2128	2376	cmd.exe	142
PID 5392 wrote to memory of 3816	5392	176.65.144.144_sample.exe	143
PID 3816 wrote to memory of 3736	3816	cmd.exe	144
PID 4584 wrote to memory of 4292	4584	176.65.144.144_sample.exe	145
PID 4292 wrote to memory of 5896	4292	cmd.exe	146
PID 5392 wrote to memory of 4952	5392	176.65.144.144_sample.exe	147
PID 4952 wrote to memory of 2596	4952	cmd.exe	148

C:\Users\Admin\AppData\Local\Temp\176.65.144.144_sample.exe
"C:\Users\Admin\AppData\Local\Temp\176.65.144.144_sample.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3344
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2884
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6132
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4188
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1060
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2612
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5848
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1536
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4144
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5484
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3956
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4832
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:944
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2844
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5792
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:712
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3112
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3012
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2128
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5896

C:\Users\Admin\AppData\Local\Temp\176.65.144.144_sample.exe
C:\Users\Admin\AppData\Local\Temp\176.65.144.144_sample.exe
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:5392
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:784
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5400
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5200
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3760
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4372
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3440
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1376
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:6124
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3216
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5652
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5844
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1308
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1092
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1184
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:792
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3272
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3736
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4584-6-0x00007FF64BE60000-0x00007FF64C046000-memory.dmp

Download

memory/4584-12-0x00007FF64BE60000-0x00007FF64C046000-memory.dmp

Download

memory/4584-2-0x00007FF64BE60000-0x00007FF64C046000-memory.dmp

Download

memory/4584-24-0x00007FF64BE60000-0x00007FF64C046000-memory.dmp

Download

memory/4584-4-0x00007FF64BE60000-0x00007FF64C046000-memory.dmp

Download

memory/4584-22-0x00007FF64BE60000-0x00007FF64C046000-memory.dmp

Download

memory/4584-8-0x00007FF64BE60000-0x00007FF64C046000-memory.dmp

Download

memory/4584-14-0x00007FF64BE60000-0x00007FF64C046000-memory.dmp

Download

memory/4584-26-0x00007FF64BE60000-0x00007FF64C046000-memory.dmp

Download

memory/4584-20-0x00007FF64BE60000-0x00007FF64C046000-memory.dmp

Download

memory/4584-10-0x00007FF64BE60000-0x00007FF64C046000-memory.dmp

Download

memory/4584-18-0x00007FF64BE60000-0x00007FF64C046000-memory.dmp

Download

memory/4584-0-0x00007FF64BE60000-0x00007FF64C046000-memory.dmp

Download

memory/4584-16-0x00007FF64BE60000-0x00007FF64C046000-memory.dmp

Download

memory/5392-7-0x00007FF64BE60000-0x00007FF64C046000-memory.dmp

Download

memory/5392-15-0x00007FF64BE60000-0x00007FF64C046000-memory.dmp

Download

memory/5392-13-0x00007FF64BE60000-0x00007FF64C046000-memory.dmp

Download

memory/5392-17-0x00007FF64BE60000-0x00007FF64C046000-memory.dmp

Download

memory/5392-11-0x00007FF64BE60000-0x00007FF64C046000-memory.dmp

Download

memory/5392-19-0x00007FF64BE60000-0x00007FF64C046000-memory.dmp

Download

memory/5392-9-0x00007FF64BE60000-0x00007FF64C046000-memory.dmp

Download

memory/5392-21-0x00007FF64BE60000-0x00007FF64C046000-memory.dmp

Download

memory/5392-5-0x00007FF64BE60000-0x00007FF64C046000-memory.dmp

Download

memory/5392-23-0x00007FF64BE60000-0x00007FF64C046000-memory.dmp

Download

memory/5392-3-0x00007FF64BE60000-0x00007FF64C046000-memory.dmp

Download

memory/5392-25-0x00007FF64BE60000-0x00007FF64C046000-memory.dmp

Download

memory/5392-1-0x00007FF64BE60000-0x00007FF64C046000-memory.dmp

Download

memory/5392-27-0x00007FF64BE60000-0x00007FF64C046000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads