d9ee437293e1ff55f3102bdfb4ec7adafb784652a9b6fc8e84101f1de066b624

Analysis

max time kernel
150s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 20:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Remoted.exe
Size 1.6MB
Sample261023-zgp2rade99
SHA256 d9ee437293e1ff55f3102bdfb4ec7adafb784652a9b6fc8e84101f1de066b624
MD5 8c5c14e6075da100c2266689915cda73
SHA1 5d99789e723599ede2bceddc28b98cfc5bfbdcfd
SHA512 97cc06bc3d867d18342d978171bfe7ec995aaa060bd0bd0432cabe70ebed7973907c63485f16c8345ad65df5e1df44ccba6a199f03648fbf7c1655e421f44874
SSDEEP 24576:PFOaoclG/nUjonvnZGNaSdyJOjoJ4i0nZDcl9tzUfzWeROU/r8IJ:tSsjovncNaSdSQob0nV4ef84
TLSH
T17875BE12F3A001FDD47282B48D66D717FB3178850B209ACB63D56A452FB36D06EBB366
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence

Malware Config

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 7 IoCs

pid	Process
5948	remoted.exe
5864	remoted.exe
1680	icsys.icn.exe
4684	explorer.exe
4568	spoolsv.exe
4672	svchost.exe
5972	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
5948	remoted.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	Remoted.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Remoted.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	remoted.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	remoted.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	remoted.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3816	Remoted.exe
3816	Remoted.exe
3816	Remoted.exe
3816	Remoted.exe
3816	Remoted.exe
3816	Remoted.exe
3816	Remoted.exe
3816	Remoted.exe
3816	Remoted.exe
3816	Remoted.exe
3816	Remoted.exe
3816	Remoted.exe
3816	Remoted.exe
3816	Remoted.exe
3816	Remoted.exe
3816	Remoted.exe
3816	Remoted.exe
3816	Remoted.exe
3816	Remoted.exe
3816	Remoted.exe
3816	Remoted.exe
3816	Remoted.exe
3816	Remoted.exe
3816	Remoted.exe
3816	Remoted.exe
3816	Remoted.exe
3816	Remoted.exe
3816	Remoted.exe
3816	Remoted.exe
3816	Remoted.exe
3816	Remoted.exe
3816	Remoted.exe
5948	remoted.exe
5948	remoted.exe
5948	remoted.exe
5948	remoted.exe
5948	remoted.exe
5948	remoted.exe
1680	icsys.icn.exe
1680	icsys.icn.exe
1680	icsys.icn.exe
1680	icsys.icn.exe
1680	icsys.icn.exe
1680	icsys.icn.exe
1680	icsys.icn.exe
1680	icsys.icn.exe
1680	icsys.icn.exe
1680	icsys.icn.exe
1680	icsys.icn.exe
1680	icsys.icn.exe
1680	icsys.icn.exe
1680	icsys.icn.exe
1680	icsys.icn.exe
1680	icsys.icn.exe
1680	icsys.icn.exe
1680	icsys.icn.exe
1680	icsys.icn.exe
1680	icsys.icn.exe
1680	icsys.icn.exe
1680	icsys.icn.exe
1680	icsys.icn.exe
1680	icsys.icn.exe
1680	icsys.icn.exe
1680	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
5948	remoted.exe
4684	explorer.exe
4672	svchost.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
3816	Remoted.exe
3816	Remoted.exe
5948	remoted.exe
1680	icsys.icn.exe
1680	icsys.icn.exe
4684	explorer.exe
4684	explorer.exe
4568	spoolsv.exe
4568	spoolsv.exe
4672	svchost.exe
4672	svchost.exe
5972	spoolsv.exe
5972	spoolsv.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 5948	3816	Remoted.exe	89
PID 5948 wrote to memory of 5864	5948	remoted.exe	90
PID 3816 wrote to memory of 1680	3816	Remoted.exe	91
PID 1680 wrote to memory of 4684	1680	icsys.icn.exe	92
PID 4684 wrote to memory of 4568	4684	explorer.exe	93
PID 4568 wrote to memory of 4672	4568	spoolsv.exe	94
PID 4672 wrote to memory of 5972	4672	svchost.exe	95

C:\Users\Admin\AppData\Local\Temp\Remoted.exe
"C:\Users\Admin\AppData\Local\Temp\Remoted.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3816
- \??\c:\users\admin\appdata\local\temp\remoted.exe
  c:\users\admin\appdata\local\temp\remoted.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5948
- - \??\c:\users\admin\appdata\local\temp\remoted.exe
    "c:\users\admin\appdata\local\temp\remoted.exe " --watchdog 5948
    3⤵
    - Executes dropped EXE
    PID:5864
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1680
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4568
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visibility of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4672
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Debugger Evasion

T1622

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Debugger Evasion

T1622

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

remoted.exe

Path C:\Users\Admin\AppData\Local\Temp\remoted.exe
Size 1.5MB
SHA256 a526f53833c3115ab77643cb49e5bbd4698b33eeb797a7628aba9e900b329181
MD5 315d0171aa0436e22aa6d08e4bd23848
SHA1 9945ef8588de700bbf2b8fc99fbcb2b1bce9b504
SHA512 e68b3c9be0795810e31d3f1bb87eb8ff729bc1d1862e6d2de007bfc5d71e9d62a50080fa439e00b4e23b018c39cdb8e48c6c4ff57bbc7584b66c2147ec858b1a
SSDEEP 24576:3clG/nUjonvnZGNaSdyJOjoJ4i0nZDcl9tzUfzWeROU/r8I:rsjovncNaSdSQob0nV4ef8
TLSH
T16475BF12F3F501ECD17292788966D707EB3178850B209BCF63D56A891F636E05EBB362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Windows\Resources\Themes\explorer.exe
Size 135KB
SHA256 5cfca71865813c94ad2fc28b812fb9b610b5c556e499b24d225ad2e9f9539a4f
MD5 49d91b13a27aec0f52aa2ce6fa8e2d72
SHA1 ad620787d236ae6f9284b8c2faaeddedd5d47842
SHA512 31c46cde3f73217ae36ba56a5a9913c35bc8439ac7dd192875c3f7ece717d41625b5b6ee52dae213465632ba2239464922386c88af5aaead20da52558646c49c
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVhpal6fffffffffD:UVqoCl/YgjxEufVU0TbTyDDalQlI
TLSH
T126D3FA27BD102C3ED82189F128B6C629BE221E3A1BF0EC1B72A6FB45247564375F451F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Windows\Resources\Themes\icsys.icn.exe
Size 135KB
SHA256 5f1b29101b306761956ab8f6875bb90c8b630c03ecb45921fced8bc6e15bb91d
MD5 9991e664c251c627b28ce68acbe69da2
SHA1 1201060a34944aceb299ff3b3fbc76af61504f27
SHA512 4a5954a87be4dd3d25fe4dbdd32f6feb9128e8d47d88873f6c5e486cf13f49f3eb3f2825666fd4718856dbba492fe68bcd7a623080e28415110b14935f2353db
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVhpal3:UVqoCl/YgjxEufVU0TbTyDDalQl3
TLSH
T1FED3F813AE001C3AD8368AF13C65DA9EBA362E365F91AD0B715AF70066B1547B5F130F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\Resources\spoolsv.exe
Size 135KB
SHA256 dee2b19625c165e74d054246544fd9adb411260e01fb21c7d6e3a19f1082f9dc
MD5 150040e28a300c8945c1457fa42811e0
SHA1 1c357c12b15dd4eb1aea9fb56ed3cbcfd1f8f1aa
SHA512 0a5461e41eb8ba156c61843d6467d1c0713878b158112d7f159269665f7ba99955aa634c8560bbfedb72910e4c15e8d5af29b0fa5cf08871281be85e3a13c6c4
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVhpalS:UVqoCl/YgjxEufVU0TbTyDDalQlS
TLSH
T1BCD3F923BF405C7EE815C5F028A8EA6ABD211F321BA16D4B3326BB1439B550776F471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\Resources\svchost.exe
Size 135KB
SHA256 7d718dce9a43823b1bf40e94dea3330030222a9f6819ff7d47f2782ff0f76cfc
MD5 8da4e4e6d81cc776edc0fd6bc7171025
SHA1 d665b5870e4b2a9dbe8b93768fb0244fce393e76
SHA512 8e30d4242e7e437c1a5b8e3d84ef9ecc512a39f634bd037415d80a39de4c959cb7544e56c098da043002f53dda2ace5dd44719c29bd41474347858befd75cfc4
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVhpal1:UVqoCl/YgjxEufVU0TbTyDDalQl1
TLSH
T175D3D727BE005D3AE41289F168B5E66EBA611E351BE5AC076393FB1035B2543B9F031F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1680-51-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3816-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3816-52-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4568-50-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4672-54-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4684-53-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5972-49-0x0000000000400000-0x000000000041F000-memory.dmp

Download