e4f583412f4e68f2c6491b6e3f23e5ddb4ea3e7c40afd6c52c78c47a39bd78ee

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 14:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
agent.exe
Size 1.3MB
Sample261107-r8fcmafb88
SHA256 e4f583412f4e68f2c6491b6e3f23e5ddb4ea3e7c40afd6c52c78c47a39bd78ee
MD5 dd34adbe7df9a34a1ae56f1bb846c34f
SHA1 aba18d72812c539ee0ec02aadfe641482f8c8dc0
SHA512 ae8090b95cd7e1f62de4385f58dae50d06a6235260741310b72592a7b30d3a8bbc371cf78e178e89c98b4afe942bd08556644c48afa70eb8727be2f91f77a33c
SSDEEP 24576:LlUjo276h8RsyxhBe9UMiyv1dHf5Rbcz6QaLSS:Cjo276hByxDeWU1Vf5R4+jGS
TLSH
T174556D5AB3A402E4D5FE9278ED924942E731B0970B3497CB16D563261F236F19FBF220
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	agent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	agent.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
5072	agent.exe

C:\Users\Admin\AppData\Local\Temp\agent.exe
"C:\Users\Admin\AppData\Local\Temp\agent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads