3dd18766ce04fb157b0323e5302cfc09257f0856d6eb8e6452392c6adbd17cd4.exe

Summary

Methodology

The sample was executed in an isolated, instrumented Windows VM (host-only networking with emulated C2 responses) while process, file-system, registry and network activity were recorded. The verdict is derived by correlating observed runtime behaviour with static indicators. No sample binary was uploaded or redistributed.

Child processes (1)

• C:\argus-vr-agent\quarantine\3dd18766ce04fb157b0323e5302cfc09257f0856d6eb8e6452392c6adbd17cd4_extracted\3dd18766ce04fb157b0323e5302cfc09257f0856d6eb8e6452392c6adbd17cd4.exe

Dropped files (1)

• C:\Users\lab\AppData\Local\Temp\nsc5804.tmp\System.dll

MITRE ATT&CK

Indicators of Compromise (defanged)

• 173c335224f8f4b26a8803e03445150101e1602c
• 1abe66e1e17395e8bc9aee5f1e4223fb
• C:\Users\lab\AppData\Local\Temp\nsc5804.tmp\System.dll

IOCs (JSON)Copy

{
  "sha256": "3dd18766ce04fb157b0323e5302cfc09257f0856d6eb8e6452392c6adbd17cd4",
  "verdict": "suspicious",
  "confidence": 90,
  "signals": [
    "executable-drop",
    "child-processes"
  ],
  "attack": [
    "T1105",
    "T1059"
  ],
  "dropped": [
    "C:\\Users\\lab\\AppData\\Local\\Temp\\nsc5804.tmp\\System.dll"
  ],
  "children": [
    "C:\\argus-vr-agent\\quarantine\\3dd18766ce04fb157b0323e5302cfc09257f0856d6eb8e6452392c6adbd17cd4_extracted\\3dd18766ce04fb157b0323e5302cfc09257f0856d6eb8e6452392c6adbd17cd4.exe"
  ]
}