f0884102362412aa950b9a1efc4199633a7fd72c8efb8f00d554960ecdeef622

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 296KB
Sample261024-krt15agy71
SHA256 f0884102362412aa950b9a1efc4199633a7fd72c8efb8f00d554960ecdeef622
MD5 c0383319a9b891f618489a338a632ee4
SHA1 2bb4ab437db7fe6533bef2350e4eb856cfc72a33
SHA512 073afc2da584735595caa18e24d56b8df989e36c353f363f7abf140a0c87c4f03e9c5e238ae179639f024fe9044288d15a01b2fc3a426ace457f81521b8e7c9c
SSDEEP 6144:LpMsrE6Y8BlLCiJCeapBJBTCsvd15UXl5HOS3mWdGHXQEoA8M60qQtnx:LpMwHui4pBf90jH/mwG3Qa8vK
TLSH
T12F5423C1907F1140C538C4B09783F8EA7225152E5A8FBD68650387CA67759A2BEF2F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4868-0-0x00007FF7A6690000-0x00007FF7A676B000-memory.dmp	upx
behavioral1/memory/4868-1-0x00007FF7A6690000-0x00007FF7A676B000-memory.dmp	upx

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	file.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	file.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4868	file.exe
4868	file.exe
4868	file.exe
4868	file.exe
4868	file.exe
4868	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4868-0-0x00007FF7A6690000-0x00007FF7A676B000-memory.dmp

Download

memory/4868-1-0x00007FF7A6690000-0x00007FF7A676B000-memory.dmp

Download