1052cd8feba9809abbd2cc008e37420a6b287c423b4df5b0a1385a1ce34fcb11.exe

Summary

Methodology

The sample was executed in an isolated, instrumented Windows VM (host-only networking with emulated C2 responses) while process, file-system, registry and network activity were recorded. The verdict is derived by correlating observed runtime behaviour with static indicators. No sample binary was uploaded or redistributed.

Child processes (1)

• C:\argus-vr-agent\quarantine\1052cd8feba9809abbd2cc008e37420a6b287c423b4df5b0a1385a1ce34fcb11_extracted\1052cd8feba9809abbd2cc008e37420a6b287c423b4df5b0a1385a1ce34fcb11.exe

Dropped files (2)

• C:\Users\RESEAR~1\AppData\Local\Temp\aymrpvayuy.exe
• C:\Users\researcher\AppData\Local\Temp\aymrpvayuy.exe

MITRE ATT&CK

Indicators of Compromise (defanged)

• 368611703e0b6761324767673eba87a2f7120f11
• 4b1e04bd32f6f9616c76292e6431c690
• C:\Users\RESEAR~1\AppData\Local\Temp\aymrpvayuy.exe
• C:\Users\researcher\AppData\Local\Temp\aymrpvayuy.exe

IOCs (JSON)Copy

{
  "sha256": "1052cd8feba9809abbd2cc008e37420a6b287c423b4df5b0a1385a1ce34fcb11",
  "family": "Loki",
  "verdict": "suspicious",
  "confidence": 90,
  "signals": [
    "executable-drop",
    "child-processes"
  ],
  "attack": [
    "T1105",
    "T1059"
  ],
  "dropped": [
    "C:\\Users\\RESEAR~1\\AppData\\Local\\Temp\\aymrpvayuy.exe",
    "C:\\Users\\researcher\\AppData\\Local\\Temp\\aymrpvayuy.exe"
  ],
  "children": [
    "C:\\argus-vr-agent\\quarantine\\1052cd8feba9809abbd2cc008e37420a6b287c423b4df5b0a1385a1ce34fcb11_extracted\\1052cd8feba9809abbd2cc008e37420a6b287c423b4df5b0a1385a1ce34fcb11.exe"
  ]
}