4e22ba8c4b860ecf98fb32b64f89a0dad37ce9e2ad1d1c6f06dfb93c238c9a46

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 13:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AutoUpdater.exe
Size 4.3MB
Sample261110-qwsazsys6q
SHA256 4e22ba8c4b860ecf98fb32b64f89a0dad37ce9e2ad1d1c6f06dfb93c238c9a46
MD5 50e50b0f8846017ff08505759a276f22
SHA1 d6af77fed081d250b8685ce963588a93340cd7bb
SHA512 996dbfa4b17bb5d93db6d71e31375eb2d15ed32b5b66e634dd0960bbd9553b48d9781f46322f2e854c4bba9fcff75505dd5824ecb3e1139ce88543c479e37c41
SSDEEP 49152:mInSEN2yIG8KkEI1Sa2PFQcrDImzr05HfYv8cB2iKeRpz6iar9FsEkLS2OgrT:xDr6rY0w2itptaZFh+r
TLSH
T1C426BE03F39686F8D53E937485B74607E736B9025B215BCB1A90A62D6F13BF15E3A320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AutoUpdater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AutoUpdater.exe

C:\Users\Admin\AppData\Local\Temp\AutoUpdater.exe
"C:\Users\Admin\AppData\Local\Temp\AutoUpdater.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:2072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

re4ZkfISy[1].txt

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2T8DCGKW\re4ZkfISy[1].txt
Size 106B
SHA256 b881b753f7432dab5ce67b0b76f378ab782c74f627205fc640f5fd6b16fb0f43
MD5 f9a208efb76d744f581f42278a8a0c9b
SHA1 9075175ac6d759ed0ec062866210f726a71123f9
SHA512 4dc434f39b7d8c033c60f6e03d6ecf2d14f7a0c75b0895c6543fcb25854a98049f6c5450df76266557349986ea99ec43a2855c81638d30ad7a7c8cb7e4ff5a4b
TLSH
T131B0928BDA414463822016922578E254514A96990FB3AB048A9AA1969C04AA8884F142
MD5 SHA1 SHA512 TLSH

Submit Download

vvv[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2T8DCGKW\vvv[1].htm
Size 47KB
SHA256 9254882948a449ddb13168756f7ce1b9866a3b4e8a8ad8cdbd7cbaa8b80e4dfa
MD5 f8db90a455fbfa1820178ca09a87065a
SHA1 d4e1add5d75753f300d7ce4c18abec5fd5c2613b
SHA512 984c094171b094083b9a7359a5a39cc57cd014580dca6930ca325717fb9a4c4a09d71a0ab424eb6b0852575539804af46499f56b6858bad2bf14d9068265fdc3
SSDEEP 768:oGeqpADhUgMbSdbtV/HSvuHQOkCkf3Q2NdP7vRxtGEqpADhaMVsHbKSPIOJXhexW:5hg6SptBHSTOkCkfPx3SjusHeSP+W
TLSH
T127237CBDB204753EC82382E4A7D172AC703B5186AB47451CE41ECB604BE7AEA5D6F5CC
MD5 SHA1 SHA512 SSDEEP TLSH