8c154e9bea754faad5e8557fbe10cfe38750d9f0a19ffd4f28c631defa114452

Analysis

max time kernel
150s
max time network
201s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 13:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
English/evil_recruit_1.exe
Size 99.8MB
Sample261107-qva1bact3s
SHA256 8c154e9bea754faad5e8557fbe10cfe38750d9f0a19ffd4f28c631defa114452
MD5 90eb16bd6f887e301a95e27569b8a449
SHA1 23fde8aff275f7e8622c0dd79053c332ed211cdf
SHA512 3bc2152d75b36b25b2237f6a76d0b8795a0b09d57e117e49c2faef50293a0a68041d9aa7b3293fc3f5f6e97e9226870ec84ba86b096f010f310e5f017c83698b
SSDEEP 1572864:V7DcMx/CTjnkIgPvx3b28aaUNyAlMjxcDoNc:V3B1xze
TLSH
T15A387C03E2A610EDC05DC2B49B1B9526EEB1F8450734B6EF26A457222F76FE45B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	evil_recruit_1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	evil_recruit_1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	evil_recruit_1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	evil_recruit_1.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
764	evil_recruit_1.exe
764	evil_recruit_1.exe
5820	evil_recruit_1.exe
5820	evil_recruit_1.exe
3344	evil_recruit_1.exe
3344	evil_recruit_1.exe
2748	evil_recruit_1.exe
2748	evil_recruit_1.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 1928	1108	evil_recruit_1.exe	89
PID 1108 wrote to memory of 1928	1108	evil_recruit_1.exe	89
PID 1108 wrote to memory of 764	1108	evil_recruit_1.exe	90
PID 1108 wrote to memory of 5820	1108	evil_recruit_1.exe	91
PID 1108 wrote to memory of 3344	1108	evil_recruit_1.exe	93
PID 1108 wrote to memory of 2748	1108	evil_recruit_1.exe	95

C:\Users\Admin\AppData\Local\Temp\English\evil_recruit_1.exe
"C:\Users\Admin\AppData\Local\Temp\English\evil_recruit_1.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Users\Admin\AppData\Local\Temp\English\evil_recruit_1.exe
  "C:\Users\Admin\AppData\Local\Temp\English\evil_recruit_1.exe" --type=gpu-process --field-trial-handle=1736,8536105292707254296,16356175598401314974,131072 --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=7502130371836886127 --mojo-platform-channel-handle=1748 --ignored=" --type=renderer " /prefetch:2
  2⤵
  PID:1928
- C:\Users\Admin\AppData\Local\Temp\English\evil_recruit_1.exe
  "C:\Users\Admin\AppData\Local\Temp\English\evil_recruit_1.exe" --type=utility --field-trial-handle=1736,8536105292707254296,16356175598401314974,131072 --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --service-request-channel-token=10805930168166313752 --mojo-platform-channel-handle=2196 /prefetch:8
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:764
- C:\Users\Admin\AppData\Local\Temp\English\evil_recruit_1.exe
  "C:\Users\Admin\AppData\Local\Temp\English\evil_recruit_1.exe" --type=renderer --field-trial-handle=1736,8536105292707254296,16356175598401314974,131072 --disable-features=SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\English\resources\app.asar" --node-integration --no-sandbox --no-zygote --background-color=#fff --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=4411513502635797569 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2244 /prefetch:1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5820
- C:\Users\Admin\AppData\Local\Temp\English\evil_recruit_1.exe
  "C:\Users\Admin\AppData\Local\Temp\English\evil_recruit_1.exe" --type=utility --field-trial-handle=1736,8536105292707254296,16356175598401314974,131072 --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=audio --service-request-channel-token=9754073711639299685 --mojo-platform-channel-handle=2960 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3344
- C:\Users\Admin\AppData\Local\Temp\English\evil_recruit_1.exe
  "C:\Users\Admin\AppData\Local\Temp\English\evil_recruit_1.exe" --type=gpu-process --field-trial-handle=1736,8536105292707254296,16356175598401314974,131072 --disable-features=SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADoAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=1366789472219078997 --mojo-platform-channel-handle=2416 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

evil_recruit_1_sf.sav

Path C:\Users\Admin\AppData\Local\Temp\English\evil_recruit_1_sf.sav
Size 243B
SHA256 cb7434599b6621ea379c122384b0dc2f1e521e27c5b1cb79d4f99ec421bfad8d
MD5 9e24771bdc0101b83c363300f8aff2c8
SHA1 22064f6268d79f7c443260f7ed7e2af81bfaa31d
SHA512 45ba85888407db937847d89d256d5e98cd70c69222e2f94ed8c7870cd2b82eed5a63408739f5be2bf0838d8fa8b8400b385cebfdf6475e99c5941125da62b29a
TLSH
T1C7D09E446A361C1F1C82A423E1CE735513287C87E0D07350489D64D5B539DF71136726
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\tyranogame\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

memory/1928-3-0x00007FFD2DB10000-0x00007FFD2DB11000-memory.dmp

Download

memory/1928-41-0x000001EC7B3C0000-0x000001EC7B467000-memory.dmp

Download