59d051af0c4d076d889902098368af7043fe23571ea7cc6f7009eb142758680c

Analysis

user interaction
yes
max time kernel
14s
max time network
17s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
22/10/2026, 20:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
matrixhub.exe
Size 1.1MB
Sample261022-yssrcafs51
SHA256 59d051af0c4d076d889902098368af7043fe23571ea7cc6f7009eb142758680c
MD5 46d9d65ad866ec8b29f211afe204655c
SHA1 7697f53d592319b3bc491cb9250b3ac0dde05409
SHA512 36c1c987fa05bcba407cdd998ab21250ba6832a5d593ccac5f77739d3d9c771e8f958795fcba84641a2b7d0320b6e998ff1ea35074bb56f3ff98ede3802c4055
SSDEEP 12288:Cbs/m0E54jwaFXGc8lEBBBHGBKq2IZwD2vfqItNqdg:CbOVE5ifGPRZwSvf3fd
TLSH
T151357C83E7A385D8C116C9B5534BF137F9627C8E4B157197ABC41E633A67BA4E22CB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	matrixhub.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	matrixhub.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	matrixhub.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	matrixhub.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 760	3300	matrixhub.exe	83

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	10	curl/8.7.1

C:\Users\Admin\AppData\Local\Temp\matrixhub.exe
"C:\Users\Admin\AppData\Local\Temp\matrixhub.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\SYSTEM32\curl.exe
  "curl" "-k" "-L" "-s" "-o" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.zip.downloading" "https://www.python.org/ftp/python/3.12.7/python-3.12.7-embed-amd64.zip"
  2⤵
  PID:760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads