Analysis

  • max time kernel
    150s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 15:45

General

  • Target
    SorryRKN/check-network.exe
  • Size 6.5MB
  • Sample261102-s637cabs4y
  • SHA256 519f0186ad47f577780410de74e2392a2da177efacc09d4f6fa3cb966a942ea5
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • Modifies system certificate store 2 TTPs 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SorryRKN\check-network.exe
    "C:\Users\Admin\AppData\Local\Temp\SorryRKN\check-network.exe"
    1⤵
    • Modifies trusted root certificate store through registry
    • Reads the TCP/IP host and domain name from the registry
    • Modifies system certificate store
    PID:1084

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        F0B2CB9C11CFD091DCC143A9C3B857B3

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0B2CB9C11CFD091DCC143A9C3B857B3
        • Size 657B
        • SHA256 3417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc65
        • MD5 SHA1 SHA512 TLSH

        F0B2CB9C11CFD091DCC143A9C3B857B3

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0B2CB9C11CFD091DCC143A9C3B857B3
        • Size 304B
        • SHA256 14d4111f4a26af0f379d11971bde7afd9a92a40bcc7f5fb80a1ce24cf50579e5
        • MD5 SHA1 SHA512 TLSH