Analysis

  • user interaction
    yes
  • max time kernel
    58s
  • max time network
    25s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/10/2026, 18:33

General

  • Target
    Vertex Recode.exe
  • Size 212.5MB
  • Sample261029-w7glhsft8r
  • SHA256 75b021a91cb798e5b0cb28a393686c44675969c9d87f5b19a0954b5e5647d54a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 34 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Vertex Recode.exe
    "C:\Users\Admin\AppData\Local\Temp\Vertex Recode.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3904

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        DirectWriteForwarder.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\DirectWriteForwarder.dll
        • Size 470KB
        • SHA256 fc065f3fe00941465596396cb51fc927ed9f9b03a2ffd18498ca0eba42ab29d8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Microsoft.Win32.Registry.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\Microsoft.Win32.Registry.dll
        • Size 114KB
        • SHA256 62064d17a313640f4dfb7b7f8116ccbb70b0b9f5b9643a821c99b6a544b8d8a3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PresentationCore.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\PresentationCore.dll
        • Size 7.9MB
        • SHA256 605fd26a2d1df0d81b3de3cb233365dc6091ec7c72c48b22fb805819c8f57654
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PresentationFramework.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\PresentationFramework.dll
        • Size 15.1MB
        • SHA256 8588aa2d06566d6b4ea1bb9e094384d3584b2ce085ce79395179a09481727ed5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PresentationNative_cor3.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\PresentationNative_cor3.dll
        • Size 1.2MB
        • SHA256 28e0f19f20f8cb6a5e558c674f3ae5dd88b62ea0bc0a890d95a33bc9b90667f2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Collections.Concurrent.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\System.Collections.Concurrent.dll
        • Size 290KB
        • SHA256 d1b550678fb1ef26d2dd0efdd9e2c72b3c4ac16cb22272b8494716e9def83e30
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Collections.Immutable.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\System.Collections.Immutable.dll
        • Size 858KB
        • SHA256 e6c6c20f5435b80be6cf2024f5279d823e73b537541cc74cbef10a54eb1ada9e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Collections.NonGeneric.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\System.Collections.NonGeneric.dll
        • Size 102KB
        • SHA256 1f4d13e03ecdaf1c1d4f0c8b14c13dde2e9bc06b9945a06d6d2207bfa3ef2958
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Collections.Specialized.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\System.Collections.Specialized.dll
        • Size 102KB
        • SHA256 3072922333368e079e861529faf49d2d5c29a64f2488637330a765bba55a9adb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Collections.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\System.Collections.dll
        • Size 290KB
        • SHA256 bf5bba7a132e68ae67fd0b53ecfb1d836e2801501917b4bbe691d1ecbe0a57f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.ComponentModel.Primitives.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\System.ComponentModel.Primitives.dll
        • Size 78KB
        • SHA256 ce31bc8a28036523ed7e5383ef115cf8e5fd7c0040c898e455a8a38d7772ecf6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.ComponentModel.TypeConverter.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\System.ComponentModel.TypeConverter.dll
        • Size 750KB
        • SHA256 bfe600605a704258c07a61765eb2bd1826be160d9a9f2c8c0e144a7c2667f3a0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.ComponentModel.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\System.ComponentModel.dll
        • Size 30KB
        • SHA256 67166101dae5ab4799f3882210c82dfa732d294861a2947529893dbdbb0f0a04
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Configuration.ConfigurationManager.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\System.Configuration.ConfigurationManager.dll
        • Size 1022KB
        • SHA256 9df7db26586bc78c301cdc5a04db47fda8275e07cc8d7d11f03299c1363aaad6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Diagnostics.Process.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\System.Diagnostics.Process.dll
        • Size 322KB
        • SHA256 f610d4dfbea961582cce987ac0f254910ef590bc089ce75a7e2e5e3d6a1dd4e3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Diagnostics.StackTrace.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\System.Diagnostics.StackTrace.dll
        • Size 42KB
        • SHA256 ffc96fa0ac97d86b6fe93bd1af4449d1bc40fe160cb7e68e5bec2c19386c6f1c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Diagnostics.TraceSource.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\System.Diagnostics.TraceSource.dll
        • Size 138KB
        • SHA256 b74622c72a922f424d01807df7f56dff143a142d1bcbd447d65e6f0c27091d41
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.IO.Packaging.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\System.IO.Packaging.dll
        • Size 314KB
        • SHA256 4eb0c02e89e92d35eb41384cdb41421060840c51b920766bce7e18ecb7b13135
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Memory.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\System.Memory.dll
        • Size 158KB
        • SHA256 34b3475af3a7b4c16a9215f15e8abb39d8474fb77f9355c029c3599e3ab0e471
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Net.WebClient.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\System.Net.WebClient.dll
        • Size 162KB
        • SHA256 3251bbef435940bc313fa7f7b5fda3036aa0621115cb2fd74fd8c6bffe81b6ae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.ObjectModel.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\System.ObjectModel.dll
        • Size 78KB
        • SHA256 7d58a7e50990046663b7ddf83a3cfc9ed706b6c3cf78b3bc7779de988df2164d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Private.CoreLib.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\System.Private.CoreLib.dll
        • Size 15.3MB
        • SHA256 3d7f95a986304b99f5f7b00f88d755f215716f2a85c6f41d8a772367bac92d51
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Private.Uri.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\System.Private.Uri.dll
        • Size 250KB
        • SHA256 486860152a651e5b8467477821e3534ebc5b2e3ea9d716c1d187e2ca914b1fcc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Private.Xml.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\System.Private.Xml.dll
        • Size 7.4MB
        • SHA256 6ded5188c91af1f54095b384c7bf6d8662987ae79c2329d66f8126910c264fb8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Reflection.Metadata.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\System.Reflection.Metadata.dll
        • Size 1.1MB
        • SHA256 e55347de508011ab04d3f89df0d66eea2fe45113b90b96cdc2fb6b6334da0002
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Runtime.CompilerServices.VisualC.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\System.Runtime.CompilerServices.VisualC.dll
        • Size 30KB
        • SHA256 d4d23491a9e98ad7747aa02869044d1d1bb864b6699971b6184e54106bbcad27
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Runtime.InteropServices.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\System.Runtime.InteropServices.dll
        • Size 110KB
        • SHA256 f7859e1c452b38782db9cae3d92d3b8cc4070b9db0cd3f9538ddffd6eeb1890d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Threading.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\System.Threading.dll
        • Size 82KB
        • SHA256 b2a0a558cf090b57e00fb1b16796d25d48ff557765c585e7b4c5dd881dab354c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Windows.Extensions.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\System.Windows.Extensions.dll
        • Size 118KB
        • SHA256 93d3ae796e6097a1dbfb380333d7fa7f14985f29d4f73baac6e03a163fdf37b3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Xaml.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\System.Xaml.dll
        • Size 1.3MB
        • SHA256 b2f10239bb8fb234d5d841855e3fb3a4297ab3d05f444658d36af40989debba7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WindowsBase.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\WindowsBase.dll
        • Size 2.1MB
        • SHA256 a7bdc35ec37c1deb33d24d97213ba1077e3051abb66250913c9c1fa735b0d3bc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cs-vertex.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\cs-vertex.dll
        • Size 251KB
        • SHA256 ecb8e36f87308711580fb35b25dd5a6681a10ddbb97f906757c4a71f1e0100b3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcruntime140_cor3.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\Vertex Recode\0rMNQgx7FmY6\vcruntime140_cor3.dll
        • Size 121KB
        • SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
        • MD5 SHA1 SHA512 SSDEEP TLSH