Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/11/2026, 13:25
Behavioral task
behavioral1
Sample
001.filmhd1080.me.exe
Resource
win10v2004-20260911-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
001.filmhd1080.me.exe
Resource
win11ltsc2024-20260911-en
6 signatures
150 seconds
General
- Target 001.filmhd1080.me.exe
- Size 143KB
- Sample261109-qpclysfg74
- SHA256 159954bcc1f3b9a45e414bc0183f638667d4fddcad98dca8d099965a6da0277f
- MD5 e10860cb34e5520e8e4de6c57d06f3e3
- SHA1 4b4d849eebeb9ea2b9312e4ced46714c9a96c5ab
- SHA512 f127e19fb8f1938995af5d735cce50513e2c8e87b768416f502de4f055219fedcc3a362df79ce9e923e7256d5bbac5f5f8a6fd8ee7599b100d0b60520232a5c5
- SSDEEP 3072:BsD2ADkpFGkTXlDJA6ba2esDetNxVgbTGV9X4:BplzpTVDVa2en/V6Mp
- TLSH T1A3E38C2279D0C032D06B11715AB9D7B6996AFA33177484C7F3840FBD6E612E09B7E34A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
vertexnet
C2
-
001.filmhd1080.me
Mutex
-
VN_MUTEX16
Attributes
-
C2Path
/login/
Signatures
- Detects VertexNET stealer 1 IoCs
resource yara_rule behavioral2/files/0x000a00000001b2c5-5.dat family_vertexnet - Executes dropped EXE 1 IoCs
pid Process 3432 001.filmhd1080.me - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\vnet = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\001.filmhd1080.me" 001.filmhd1080.me.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 001.filmhd1080.me.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 001.filmhd1080.me.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 001.filmhd1080.me.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 001.filmhd1080.me
Processes
-
C:\Users\Admin\AppData\Local\Temp\001.filmhd1080.me.exe"C:\Users\Admin\AppData\Local\Temp\001.filmhd1080.me.exe"1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:1072
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\001.filmhd1080.me"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\001.filmhd1080.me"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3432
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\001.filmhd1080.me
- Size 143KB
- SHA256 159954bcc1f3b9a45e414bc0183f638667d4fddcad98dca8d099965a6da0277f
- MD5 e10860cb34e5520e8e4de6c57d06f3e3
- SHA1 4b4d849eebeb9ea2b9312e4ced46714c9a96c5ab
- SHA512 f127e19fb8f1938995af5d735cce50513e2c8e87b768416f502de4f055219fedcc3a362df79ce9e923e7256d5bbac5f5f8a6fd8ee7599b100d0b60520232a5c5
- SSDEEP 3072:BsD2ADkpFGkTXlDJA6ba2esDetNxVgbTGV9X4:BplzpTVDVa2en/V6Mp
- TLSH T1A3E38C2279D0C032D06B11715AB9D7B6996AFA33177484C7F3840FBD6E612E09B7E34A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2NSAMQMS\tasks[1].htm
- Size 173B
- SHA256 5bd1cb20b56bb3ea06d9c3f0abe9223a38e93f3d833df496524dcdebfeb3b4ca
- MD5 bcd560eba80b849c980a5123047bc8f8
- SHA1 cfc17fc5f3743042a8e00ea8d8b2a1e17a739f89
- SHA512 1fcc48ff7443592fd8bc612d9625171563bc1c6a31d825fbf1fa888e4102b1ff0616a425f5d59bb7784a671d86bbf0cb637a98be95de8c94a98dfa9a13349a2b
- TLSH T176C0806D6B533C9874973B3950C39160E1DC503023D9041112704507F0CB1D78DC23D1
- MD5 SHA1 SHA512 TLSH