31a762fdce1008e635a5e6486d7bc50b4bce671c9232006216e70cd8f2a4a7fb.exe

Summary

Methodology

The sample was executed in an isolated, instrumented Windows VM (host-only networking with emulated C2 responses) while process, file-system, registry and network activity were recorded. The verdict is derived by correlating observed runtime behaviour with static indicators. No sample binary was uploaded or redistributed.

Child processes (1)

• C:\argus-vr-agent\quarantine\31a762fdce1008e635a5e6486d7bc50b4bce671c9232006216e70cd8f2a4a7fb_extracted\31a762fdce1008e635a5e6486d7bc50b4bce671c9232006216e70cd8f2a4a7fb.exe

MITRE ATT&CK

Indicators of Compromise (defanged)

• 0b905aa2442d333f5c3bccc3724a5d7a
• bcb6ff58f5bda59e4f119d76f7ef21f7d55e9a2e

IOCs (JSON)Copy

{
  "sha256": "31a762fdce1008e635a5e6486d7bc50b4bce671c9232006216e70cd8f2a4a7fb",
  "verdict": "suspicious",
  "confidence": 80,
  "signals": [
    "child-processes",
    "packed"
  ],
  "attack": [
    "T1059",
    "T1027.002"
  ],
  "children": [
    "C:\\argus-vr-agent\\quarantine\\31a762fdce1008e635a5e6486d7bc50b4bce671c9232006216e70cd8f2a4a7fb_extracted\\31a762fdce1008e635a5e6486d7bc50b4bce671c9232006216e70cd8f2a4a7fb.exe"
  ]
}