86d9f77cb460b9e8f049ff344f814fa4cd71bf73701a65ef123e32c28e3d07ab

Analysis

max time kernel
2s
max time network
2s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
24/10/2026, 00:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Creative EAX Settings.exe
Size 7.0MB
Sample261024-ag4sgagy2n
SHA256 86d9f77cb460b9e8f049ff344f814fa4cd71bf73701a65ef123e32c28e3d07ab
MD5 ee0e870ddeae89b7a462b0b764756bb3
SHA1 f42e58c3d16788050dc7df492f513fa46bffa0c1
SHA512 bb3556872188d21d5106620b943604365b22f326a57ab3533d60e6a746b804fc404a216a4996735ffa66ca4fd36b16053bdbeb34745c66e2588c55c06706dfb2
SSDEEP 196608:tYwES/pRYy6H62j9Diyol4QwCVvbxIaQw:hpRYymhjxYl2qvNNN
TLSH
T17476012173E50952D3BF5F75E0B109018BB1B7533746E74F298295A91EA3B80FA12F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Control Panel\International\Geo\Nation	Creative EAX Settings.exe

Loads dropped DLL 2 IoCs

pid	Process
5608	Creative EAX Settings.exe
5608	Creative EAX Settings.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
5608	Creative EAX Settings.exe
5608	Creative EAX Settings.exe
5608	Creative EAX Settings.exe
5608	Creative EAX Settings.exe
5608	Creative EAX Settings.exe
5608	Creative EAX Settings.exe
5608	Creative EAX Settings.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5608	Creative EAX Settings.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5608 wrote to memory of 4664	5608	Creative EAX Settings.exe	82
PID 4664 wrote to memory of 4624	4664	csc.exe	84

C:\Users\Admin\AppData\Local\Temp\Creative EAX Settings.exe
"C:\Users\Admin\AppData\Local\Temp\Creative EAX Settings.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5608
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\Creative EAX Settings.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_6a7da8e0c2654c149989515d5700c650.cs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8596.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC10E18D29C5234D94B995F0DA19A4899.TMP"
    3⤵
    PID:4624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Creative EAX Settings.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Creative EAX Settings\Hrqkp01comoaZrSEHPNWNWSdYvuIbfY=\Creative EAX Settings.dll
Size 5.9MB
SHA256 11d7ac9e8dc6d86db4bce99452d2d6712cbaba21927606946d1f3edfc332f113
MD5 6e658862ac80ac47c15652a832399611
SHA1 41cda27220677c8177fc8b14d6377ce87bbdafc5
SHA512 7a5ef303e2e3763ce48c0b90e402648fd6f861222dd850af6e6b6898757e191f0d005519836039de90f20129b8eafad3958b4e4c3dbc638ed98163c3b81f436a
SSDEEP 98304:xcpGXPPq0iwEAf/UaRYJ0s1DH62d9C4Xla67+y34sve14QwmaAVZRb0qzIXp:lYwES/pRYy6H62j9Diyol4QwCVvbxI
TLSH
T1DD561235B7E70C42D3AF1F76E1714A159AB6B7532781A74F204380690EA3B94FA02F6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES8596.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8596.tmp
Size 1KB
SHA256 46b02b9fe538c8be25aec6928961edcc66f1369594e957802811690d937422cf
MD5 38ed19330ea863c0794a64ad01f63ec4
SHA1 a55aa8165997c526a320ef49d0aa4fbde092e101
SHA512 ca0343be043614bfb2073f3b3de7a0a2ec673af085f0364885b1dd9c5ffb67e848be6bc4d7d1deaacd07101312ce6943b3ae40a807c4fdd49454313b0ffdd9f5
TLSH
T12B41224183DC4B1EF1B2173169F7532AA674FE55EEAA875DB184022E1F12740CDC36B2
MD5 SHA1 SHA512 TLSH

Submit Download

CSC10E18D29C5234D94B995F0DA19A4899.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC10E18D29C5234D94B995F0DA19A4899.TMP
Size 1KB
SHA256 b415296044fdec40b92a7bcf1b2df43f3ecb7a8ee0f464dc830001ba42937789
MD5 0d908bcfeab9734734ffdfc67915b5cb
SHA1 5b3235bab4ef9a31b20e3cc822b682ce50807048
SHA512 70499ed40a843bbe22592c0ef25b485f76ede6456c7a724e0025a2bab9b79b8b00d766474788f9057710447d3a26f7916a0db8114394406a39bc7e7d53d55e13
TLSH
T17C21C04693E8461DF1F3577079F6C3629168BE56CC7A83DC34C8135F1B2560085937B1
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_6a7da8e0c2654c149989515d5700c650.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_6a7da8e0c2654c149989515d5700c650.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5608-23-0x0000027912B10000-0x0000027912C23000-memory.dmp

Download