Analysis
- max time kernel
150s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/10/2026, 14:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Creative EAX Settings.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Creative EAX Settings.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target Creative EAX Settings.exe
- Size 7.0MB
- Sample261026-ryencatt3p
- SHA256 86d9f77cb460b9e8f049ff344f814fa4cd71bf73701a65ef123e32c28e3d07ab
- MD5 ee0e870ddeae89b7a462b0b764756bb3
- SHA1 f42e58c3d16788050dc7df492f513fa46bffa0c1
- SHA512 bb3556872188d21d5106620b943604365b22f326a57ab3533d60e6a746b804fc404a216a4996735ffa66ca4fd36b16053bdbeb34745c66e2588c55c06706dfb2
- SSDEEP 196608:tYwES/pRYy6H62j9Diyol4QwCVvbxIaQw:hpRYymhjxYl2qvNNN
- TLSH T17476012173E50952D3BF5F75E0B109018BB1B7533746E74F298295A91EA3B80FA12F2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Creative EAX Settings.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Creative EAX Settings.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe 6052 Creative EAX Settings.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 6052 Creative EAX Settings.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 6052 wrote to memory of 4200 6052 Creative EAX Settings.exe 89 PID 4200 wrote to memory of 3264 4200 csc.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\Creative EAX Settings.exe"C:\Users\Admin\AppData\Local\Temp\Creative EAX Settings.exe"1⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\Creative EAX Settings.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_9e66287a936c460a8cc052d6a3133abd.cs"2⤵
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF306.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC97A1FCCC2D3443E48CF443F41523C48.TMP"3⤵PID:3264
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\.net\Creative EAX Settings\Hrqkp01comoaZrSEHPNWNWSdYvuIbfY=\Creative EAX Settings.dll
- Size 5.9MB
- SHA256 11d7ac9e8dc6d86db4bce99452d2d6712cbaba21927606946d1f3edfc332f113
- MD5 6e658862ac80ac47c15652a832399611
- SHA1 41cda27220677c8177fc8b14d6377ce87bbdafc5
- SHA512 7a5ef303e2e3763ce48c0b90e402648fd6f861222dd850af6e6b6898757e191f0d005519836039de90f20129b8eafad3958b4e4c3dbc638ed98163c3b81f436a
- SSDEEP 98304:xcpGXPPq0iwEAf/UaRYJ0s1DH62d9C4Xla67+y34sve14QwmaAVZRb0qzIXp:lYwES/pRYy6H62j9Diyol4QwCVvbxI
- TLSH T1DD561235B7E70C42D3AF1F76E1714A159AB6B7532781A74F204380690EA3B94FA02F6D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RESF306.tmp
- Size 1KB
- SHA256 2e34dcd3fb3fb660e77b2bf66974727f1cf57b1b21027234f3cec9f2900331d6
- MD5 bd0f1251e9e38d521a4376e9e9eb8028
- SHA1 d23e2ea72220614da21cc483012e616776d4578c
- SHA512 6ac7f76f0af7d77961c677e84dcd24547292e40260c3b6f5527715af718a5841652aa1e0990ead807053c8bbfb7de791bd17eb345473aec915e6cc6d375035cf
- TLSH T16B41304183E88B1AF1B2433169F75319A674BE459EAA974D7584032E1F12740CEC37B1
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\CSC97A1FCCC2D3443E48CF443F41523C48.TMP
- Size 1KB
- SHA256 b415296044fdec40b92a7bcf1b2df43f3ecb7a8ee0f464dc830001ba42937789
- MD5 0d908bcfeab9734734ffdfc67915b5cb
- SHA1 5b3235bab4ef9a31b20e3cc822b682ce50807048
- SHA512 70499ed40a843bbe22592c0ef25b485f76ede6456c7a724e0025a2bab9b79b8b00d766474788f9057710447d3a26f7916a0db8114394406a39bc7e7d53d55e13
- TLSH T17C21C04693E8461DF1F3577079F6C3629168BE56CC7A83DC34C8135F1B2560085937B1
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_9e66287a936c460a8cc052d6a3133abd.cs
- Size 4KB
- SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
- MD5 b7d40eb7e1328728d647678e1ea0a4dc
- SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
- SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
- SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
- TLSH T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
- MD5 SHA1 SHA512 SSDEEP TLSH