Overview

overview

7

Static

static

5

fcada593e6...99.exe

windows10-2004-x64

7

fcada593e6...99.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 18:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    fcada593e66c0dcc097a6a741b8a1c1ed8be3dfbbd23f6dada128695cba7ea99.exe
  • Size 12.4MB
  • Sample261102-ww233set4r
  • SHA256 fcada593e66c0dcc097a6a741b8a1c1ed8be3dfbbd23f6dada128695cba7ea99
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistence

Malware Config

Signatures

  • Deletes itself 1 TTPs 1 IoCs
    defense_evasion
  • Executes dropped EXE 19 IoCs
  • Adds Run key to start application 2 TTPs 12 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 18 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Detect suspicious telegram bot 10 IoCs

    Detect suspicious telegram bot.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 40 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fcada593e66c0dcc097a6a741b8a1c1ed8be3dfbbd23f6dada128695cba7ea99.exe
    "C:\Users\Admin\AppData\Local\Temp\fcada593e66c0dcc097a6a741b8a1c1ed8be3dfbbd23f6dada128695cba7ea99.exe"
    1⤵
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4160
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe" --monitor
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:616
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:4224
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe"
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1336
      • C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\ServiceHost.exe
        "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\ServiceHost.exe" --monitor
        2⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        PID:2372
    • C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\ServiceHost.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\ServiceHost.exe"
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2996
      • C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsInternal.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsInternal.exe" --monitor
        2⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1384
    • C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsInternal.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsInternal.exe"
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1604
      • C:\Users\Admin\AppData\Local\Temp\CoreSystem.exe
        "C:\Users\Admin\AppData\Local\Temp\CoreSystem.exe" --monitor
        2⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4068
    • C:\Users\Admin\AppData\Local\Temp\CoreSystem.exe
      "C:\Users\Admin\AppData\Local\Temp\\CoreSystem.exe"
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4260
      • C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemHost.exe
        "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemHost.exe" --monitor
        2⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1236
    • C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemHost.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemHost.exe"
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3780
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe" --monitor
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        PID:6020
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe"
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1164
      • C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\BackgroundTask.exe
        "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\BackgroundTask.exe" --monitor
        2⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        PID:5776
    • C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\BackgroundTask.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\BackgroundTask.exe"
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1128
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SecurityCore.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SecurityCore.exe" --monitor
        2⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        PID:4056
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SecurityCore.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SecurityCore.exe"
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4052
      • C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\InputService.exe
        "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\InputService.exe" --monitor
        2⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        PID:5384
    • C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\InputService.exe
      "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\InputService.exe"
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1464
      • C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\BackgroundTask.exe
        "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\BackgroundTask.exe" --monitor
        2⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        PID:2176

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          09A184963DB18218E7969055927ED546
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\09A184963DB18218E7969055927ED546
          • Size 279B
          • SHA256 30bf9e443363caee061b86be58112778c9f3dcde80c66ac4c60fdf8c866af235
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          103621DE9CD5414CC2538780B4B75751
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
          • Size 808B
          • SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
          • Size 314B
          • SHA256 65cc31e83cd11721336228a00a70c171ef4c49a10eab5f13f1a7bc5a739be077
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
          • Size 2KB
          • SHA256 e8943bcb3672d4f98d010fab9661877db1852f9d731f5bd06ff01ec80a2166cb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          56E83C5857C173AD065FC47EB887B239
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\56E83C5857C173AD065FC47EB887B239
          • Size 201KB
          • SHA256 339ae121f0cdc284aea823a8cb26ba074b3ab2d8c50a3ea7811e764dbf69f155
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
          • Size 975B
          • SHA256 22917f0998a115ad62abcf80585186d3491654ffe8e03750561436cac45be474
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
          • Size 2KB
          • SHA256 7ac5032244be42364474770c2d0cf4050af153432229d6cc3496fe65100c781e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          F15827BEC5BABE89C21DCDAE77464BF1
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
          • Size 701B
          • SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          09A184963DB18218E7969055927ED546
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\09A184963DB18218E7969055927ED546
          • Size 484B
          • SHA256 8fad002a3f5dbc4437270e6d5d11c82efaa252cdc2de480fac7e75fdb12bb2a7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          103621DE9CD5414CC2538780B4B75751
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
          • Size 192B
          • SHA256 66c2d99fa3419a3f4556d46b7d60f7cf403e399d7578c8d75435a5d09e5020a9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
          • Size 488B
          • SHA256 64a60c24b237da65e3f7b806ce5066ae621822a6fcb3defd17c0e418b6d9fde2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
          • Size 450B
          • SHA256 601970c2ef8d84de28cce6f563183708d31445bddbede4fb170fea53552869d6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          56E83C5857C173AD065FC47EB887B239
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\56E83C5857C173AD065FC47EB887B239
          • Size 246B
          • SHA256 6d2c1c1cf472177ff3123624466b6871d6bc20c486779e976454752f4cf952fa
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
          • Size 488B
          • SHA256 62ec5fdb7e1ec788cee383f37eee92db55ba5258ec3239872331cdb8e3a6b83f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
          • Size 474B
          • SHA256 7f3b65f52f807e51c5f8e728bbad72ce1ca24b57d40cc15005fda589f81882d0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          F15827BEC5BABE89C21DCDAE77464BF1
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
          • Size 192B
          • SHA256 59a064f99906320e67b3a39ef459b12f7b47b3390d466908a1d00e45c048d835
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          InputService.exe
          • Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\InputService.exe
          • Size 13.4MB
          • SHA256 714c8f7f34bb932b67b3d53f6ad4d772893cdefa113ea8f61973e9062f73c8bc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BackgroundTask.exe
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\BackgroundTask.exe
          • Size 13.6MB
          • SHA256 a28415eb78c7c91692ab9f4377c349c491047f6bf919f52a23a6579f2a53e864
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BackgroundTask.exe
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\BackgroundTask.exe
          • Size 13.2MB
          • SHA256 126513ee68ba827d72d74a9645fa4e365bb10eee72f9f34c4a299844b07ba3ca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ServiceHost.exe
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\ServiceHost.exe
          • Size 12.6MB
          • SHA256 b0bf6da90d65736ed981d2d8685d45069469190b9838df10361c5a3b9ddfe70d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SystemHost.exe
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SystemHost.exe
          • Size 13.0MB
          • SHA256 2e6eb96c382754f5b7c00b62a3849f6f5ca8be6d5159968295cefcafa2a6b844
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CoreSystem.exe
          • Path C:\Users\Admin\AppData\Local\Temp\CoreSystem.exe
          • Size 12.9MB
          • SHA256 6142ba07ff9a9a7e6268da83b4ae87e8094613cae3762acc00152293cfa94339
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WindowsInternal.exe
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsInternal.exe
          • Size 12.8MB
          • SHA256 498b097785d921f8475550edd2779c12278f04e8d55af86f5d554814e9584554
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SecurityCore.exe
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SecurityCore.exe
          • Size 13.3MB
          • SHA256 a80e8c9e0a20acf27d763aae7381d51383513ffb14e30dc65048405276294d59
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WindowsHost.exe
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\WindowsHost.exe
          • Size 12.5MB
          • SHA256 e81e66ba5791c237b0b0e476a2d3c11dcac1dac0b1d5479aebbdfb29c944b0f7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ServiceHost.exe
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe
          • Size 13.1MB
          • SHA256 ec20a43ab68275de5413f2704a80668a6c9737e23060fe85cc29718f11792ef0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download