7b2a28e5ecbdeb4e608026e8c548ef5f50e4aad5da5ae7bfcc5e9ee05e91e80a.exe

Summary

Methodology

The sample was executed in an isolated, instrumented Windows VM (host-only networking with emulated C2 responses) while process, file-system, registry and network activity were recorded. The verdict is derived by correlating observed runtime behaviour with static indicators. No sample binary was uploaded or redistributed.

Child processes (2)

• C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe
• C:\argus-vr-agent\quarantine\7b2a28e5ecbdeb4e608026e8c548ef5f50e4aad5da5ae7bfcc5e9ee05e91e80a_extracted\7b2a28e5ecbdeb4e608026e8c548ef5f50e4aad5da5ae7bfcc5e9ee05e91e80a.exe

MITRE ATT&CK

YARA matches

Indicators of Compromise (defanged)

• 6b1a870bc9aa0a5d88931278f4375f50
• 9139a0817ef5a3c0f4e97e562c22b2bb878d981a

IOCs (JSON)Copy

{
  "sha256": "7b2a28e5ecbdeb4e608026e8c548ef5f50e4aad5da5ae7bfcc5e9ee05e91e80a",
  "verdict": "suspicious",
  "confidence": 95,
  "signals": [
    "yara-match",
    "child-processes",
    "packed"
  ],
  "attack": [
    "T1059",
    "T1027.002"
  ],
  "children": [
    "C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
    "C:\\argus-vr-agent\\quarantine\\7b2a28e5ecbdeb4e608026e8c548ef5f50e4aad5da5ae7bfcc5e9ee05e91e80a_extracted\\7b2a28e5ecbdeb4e608026e8c548ef5f50e4aad5da5ae7bfcc5e9ee05e91e80a.exe"
  ]
}