3f745a446fd1242f0303c2220acc931136acdef1200090eb783a09dec1457a29

Analysis

user interaction
yes
max time kernel
46s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/10/2026, 20:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rex_sp.dll
Size 2.6MB
Sample261020-yr6a2set6w
SHA256 3f745a446fd1242f0303c2220acc931136acdef1200090eb783a09dec1457a29
MD5 9d4ba42772bc2df855813ed9a651d025
SHA1 5b441fe7f8225b8d77bff895ba22cd452f2b3896
SHA512 41448ba57a80eb8cb4801075f34c65494a8200cbd22de3b896a2b73cc752393bb63909179d38d00a5201a682c637d2bbcf703109fe5417198ea6d5427ac97375
SSDEEP 49152:m4O6fKbBUAykgLg3iWl3nnL1GD9EZM9O2fOuSiAUVe/Hkmd:JfK9ek2g3iWl3nRGD9D95ECOHkO
TLSH
T10AD53356779F4152E6AFD47887591BC3A76139CA42C03BC6B3340DD60AA2EDCBDBA304
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1264	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4736	chrome.exe
4736	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 3376	4736	chrome.exe	100
PID 4736 wrote to memory of 3940	4736	chrome.exe	102
PID 4736 wrote to memory of 1264	4736	chrome.exe	101
PID 4736 wrote to memory of 3940	4736	chrome.exe	102
PID 4736 wrote to memory of 2296	4736	chrome.exe	103
PID 4736 wrote to memory of 2296	4736	chrome.exe	103
PID 4736 wrote to memory of 3700	4736	chrome.exe	104
PID 4736 wrote to memory of 3700	4736	chrome.exe	104
PID 4736 wrote to memory of 5028	4736	chrome.exe	105
PID 4736 wrote to memory of 5028	4736	chrome.exe	105
PID 4736 wrote to memory of 1060	4736	chrome.exe	107
PID 4736 wrote to memory of 1060	4736	chrome.exe	107
PID 4736 wrote to memory of 4828	4736	chrome.exe	109

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\rex_sp.dll,#1
1⤵
PID:3920

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3232

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0x118,0x128,0x7ff8573cc728,0x7ff8573cc734,0x7ff8573cc740
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2140,i,17307145344464855682,5922267775981884466,524288 --field-trial-handle=2040,i,4271779734541592951,2505922357559513603,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,7297120122259819607,16051197600773488019,262144 --field-trial-handle=2040,i,4271779734541592951,2505922357559513603,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:3940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,15499197815703204415,8855761679982312790,524288 --field-trial-handle=2040,i,4271779734541592951,2505922357559513603,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2528 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,10960566038592075664,14722300813611501645,2097152 --field-trial-handle=2040,i,4271779734541592951,2505922357559513603,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,11367011835882182599,10688800073116125581,2097152 --field-trial-handle=2040,i,4271779734541592951,2505922357559513603,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4184,i,10990523940429566977,2130511348675117510,2097152 --field-trial-handle=2040,i,4271779734541592951,2505922357559513603,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5344,i,4806703238227922852,12327537738840034295,524288 --field-trial-handle=2040,i,4271779734541592951,2505922357559513603,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:4828

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 4d0c5fbc12a875642429b0dd2daa46ea463d1c2b1482abf3f14cd122bba54191
MD5 d588345da3672470b53c54f52ba4c7ae
SHA1 a4a09d4dfe1f7232a6aee942ed8ba9fafacc4c81
SHA512 8fdce53fcf159847b327d3aea853aff1923b0786fdc362c79ba5e9c4a508f118e8dd193e48658133923b5b97a69d4cf2f94ecc2a52de56b372a393039e32aff8
MD5 SHA1 SHA512

Submit Download

2f9d7941-1015-46a2-84da-98fd8d4a2fa4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2f9d7941-1015-46a2-84da-98fd8d4a2fa4.tmp
Size 414B
SHA256 425d5c25353f3eb1d22bdc075575a9f6603c2eca71ea1bed3c28e44ae230e162
MD5 5275887d82781c272331079a14966c40
SHA1 dec8da3844e1e2e233ad87b02be0da4797e1a5b8
SHA512 d9e5cc91722dd87e7e8af49adf66ede6cd8c5d33981e2087ae2f869d88da0143a8ca194113b1dc70793cb07737ecbf00f1e9cea509092befe2440edd66d74730
TLSH
T1CCE02BA5C951EC6719FC072C14644746E69113973741465F373C99098FF923A018586C
MD5 SHA1 SHA512 TLSH

Submit Download

32fc0905-0d17-4c7c-8faf-651af1b0b000.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\32fc0905-0d17-4c7c-8faf-651af1b0b000.tmp
Size 10KB
SHA256 355fdbb3d014b9a3494867b457846bca4e8df8c1d418449549650c7e30ef953b
MD5 969592e6349cbfc73400ec41b46e3c54
SHA1 ac765fa57cd8da63c98fea8a0f98af5eb2853eec
SHA512 5a09cf1bc0a07a42780cd331b83d056d7b0d33308f79d3a5fae9ad1d7cbd1b0fc3f5174f31554c50230e5c619831072ece855968f37ea390e90c81fc8bf7cf21
SSDEEP 192:rROc1w8/Jv7UpAPRp2v9/Hsb+WNniTl0OsPyIsnAUge:rROU1JAUXchwc0xe
TLSH
T13322512DAD54A97B5CCBC21AFA267B63E7F5203124902E84E6FC893C29E75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4a0967fe-51a2-4dd0-8a1b-c79b837681b2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4a0967fe-51a2-4dd0-8a1b-c79b837681b2.tmp
Size 13KB
SHA256 cbff59adc7b520f0de2985ad921ee12da5b00aa0aaadd64b2862a8b11ece7f19
MD5 8620b09f169758aa6d92f2e7b8a4c29c
SHA1 c265bb3d46a3af238c08a66240583a655be69a0e
SHA512 017bb2738ebc633e2b1824b1fe90215df48c3e3ec2d222610a597c250ca9b406bd8560dd6e15c6ddcea319cc301407ec464c4569fc29dfb4f74923aa99fdceb8
SSDEEP 384:s2jGN7KxkXqKf/pUZNCgVLH2Hfgsl1/XODGN+ErU3pxHG4xHk4V4:s2GN7KxkXqKf/pUZNCgVLH2HfgszvO61
TLSH
T1C4520A27A88C9A3F0FD8C54DD8177F4FADF101566268492452FB9C1903A5BDB114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

15111984-883b-4c81-bd76-6b718397fcf9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\15111984-883b-4c81-bd76-6b718397fcf9.tmp
Size 523B
SHA256 baa7b24df7d34299b0fcf840819ea63727cdf984e0752842c98d482f7210fa40
MD5 67998b9d208abae4cd8757866ce76939
SHA1 9c372c01fb8ec775e51cfbb2364fd50f75fa5202
SHA512 11089ff1ac8429fab02f1c6c751a3b492f69dbbd0d10a48e33ebbfa9b71328299471a241cb62f1c2a0b7dd3fc817e6423dc41df48de8c495a55c1db163c37591
TLSH
T156F00EA7E33DB027407A256B0E00B80959BAA8340181A8F4CEAA836CF0C10F71F12407
MD5 SHA1 SHA512 TLSH

Submit Download

ec00a5a0-e124-4a44-9a28-250a07954c42.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ec00a5a0-e124-4a44-9a28-250a07954c42.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

fd2fa79b-4869-4538-89f7-6745ccd2bdf1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\fd2fa79b-4869-4538-89f7-6745ccd2bdf1.tmp
Size 1KB
SHA256 60cefa01d90884cc10c129c3e60c9bdf4d2ac4e05faf85e3c12463c9e867b802
MD5 d2215efbcd78f2fa50dee78b996e3216
SHA1 15b04d693d3d68354a6952f6a827d0107dc40d2d
SHA512 aee80fac14203185e8cd3d7d700f0b3d3cfa718ff6f84efd0347c3a2965cd115ef4fd18a457d217acab7dcee256a4b83c36eb5563aa8d3120256103128660983
TLSH
T1C53158F783E4997D895192F4EB156F1FCE690A18131C3C62C9D4AE1B53E2872D20028F
MD5 SHA1 SHA512 TLSH

Submit Download

ccba117f-f5ed-467c-a467-e1fcf730bdab.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ccba117f-f5ed-467c-a467-e1fcf730bdab.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

ae9b83a4-d3e7-42aa-8308-8b4c970d2fca.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ae9b83a4-d3e7-42aa-8308-8b4c970d2fca.tmp
Size 268KB
SHA256 47259da8f1dc01bb4d87cf0805c7e3afbdb46d05e0725665c8c5e547995c5351
MD5 42db42ceaa7f49c55831e44f8b608a1a
SHA1 1a64f1b4c6b3a1b7951375871a4d32d99ff6960c
SHA512 28d14aec6355d4e801f6b71556d63211fbb44cdb067ba7759c32c74693f86a1c4e8dc01e4ead5ec5b8c8c3f61d420f3031e9220698fab51800a69758ff77c12c
SSDEEP 6144:GF1My3ufSzz8vNfh1i0HX6Nj+hFD+7t56OD9ZfSApprN:GIzo8xBX8jyFSXD9ZfS4z
TLSH
T1854423316B6BC9BF8AF56216D25A42466D709DFC80DA590944EA1FCB809FD0903B3F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe9352ff-e5cf-4481-ad8d-b3866f5dbe3e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\fe9352ff-e5cf-4481-ad8d-b3866f5dbe3e.tmp
Size 130KB
SHA256 11dbdcd9244fd85fcfd3d8ccd1647331742536a7fe505ef9aa94a6d1ae116578
MD5 22a2686e5fd003905c6ed43dbb51baea
SHA1 439349ec09cab092ebf064c3cd32a0e6073a4653
SHA512 6fc678ff182141c01f6196f2e2bf2c9a36192ce3c56d8fb3bbfe082fba4d1699f2d5d79e51d9d7f8d9398a8b976660147522ec46700f5190ba13f86f3f11d572
SSDEEP 3072:x+V+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:cV+hFD+7t56OD9ZfSApprE
TLSH
T105D31232AA95D8BBC9FC6541B157A300DE766CED41DE2A09444A9F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH