Overview
overview
8Static
static
3Oxymorphaz...4).exe
windows10-2004-x64
1Oxymorphaz...6).exe
windows10-2004-x64
Oxymorphaz...4).exe
windows10-2004-x64
1Oxymorphaz...6).exe
windows10-2004-x64
3zararlı/h...86.exe
windows10-2004-x64
salinewin1...ty.exe
windows10-2004-x64
3salinewin1.5.exe
windows10-2004-x64
Analysis
- max time kernel
431s - max time network
399s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/10/2026, 14:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Oxymorphazone (x64).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
Oxymorphazone (x86).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
900 seconds
Behavioral task
behavioral3
Sample
Oxymorphazone-safety (x64).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral4
Sample
Oxymorphazone-safety (x86).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral5
Sample
zararlı/hydrogenx86.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
900 seconds
Behavioral task
behavioral6
Sample
salinewin1.5-safety.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral7
Sample
salinewin1.5.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
900 seconds
Errors
Reason
Machine shutdown
General
- Target zararlı/hydrogenx86.exe
- Size 108KB
- Sample261018-rlrgdabc89
- SHA256 fdb3dbba544d167c7b21bff4ca7277a90cd98b75e64fa03513c7ce55be33d1dd
- MD5 775aa2d429165e5b4e74385f1d163c31
- SHA1 b8657078e1fdc5583bceb4bc0bd89278e9c3ac35
- SHA512 55ab88d7029fa0046257b3ac8c30305b86bd9b73077519082a38c1bfc546296e189a754867fc5bf039e837acf54f28004108780808f4a9d65df71ac741089396
- SSDEEP 3072:bmPwlRm8c/92DeUSUQ2ZWsVnkxmdBwqvN:iPwlRmUDxQIDwqvN
- TLSH T1E1B36C01B6D08472F9B3193615B0EAB58A7FF9711F509DEB23A40A6A0F381D09D73A77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 hydrogenx86.exe - Program crash 1 IoCs
pid pid_target Process procid_target 2592 4072 WerFault.exe 85 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hydrogenx86.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe Token: SeTakeOwnershipPrivilege 4072 hydrogenx86.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\zararlı\hydrogenx86.exe"C:\Users\Admin\AppData\Local\Temp\zararlı\hydrogenx86.exe"1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4072 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 9002⤵
- Program crash
PID:2592
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4072 -ip 40721⤵PID:4776