24099762P2024091901KYRQA.exe

Summary

Methodology

The sample was executed in an isolated, instrumented Windows VM (host-only networking with emulated C2 responses) while process, file-system, registry and network activity were recorded. The verdict is derived by correlating observed runtime behaviour with static indicators. No sample binary was uploaded or redistributed.

Child processes (1)

• C:\argus-vr-agent\quarantine\0a7f4f40ef3162ac80ae43794523e07095ddb6b26a539fe68897a44d6805598e_7z\24099762P2024091901KYRQA.exe

MITRE ATT&CK

YARA matches

Indicators of Compromise (defanged)

• aa6fe985cad16a72f80f8ff5d23d35cf
• afbf1713a312efaa5bae37c5763818a801cfb195

IOCs (JSON)Copy

{
  "sha256": "941a189bd84102c13255835bb2f4df77d9cb126be4e54faa179b9de469375fbe",
  "verdict": "suspicious",
  "confidence": 95,
  "signals": [
    "yara-match",
    "child-processes",
    "packed"
  ],
  "attack": [
    "T1059",
    "T1027.002"
  ],
  "children": [
    "C:\\argus-vr-agent\\quarantine\\0a7f4f40ef3162ac80ae43794523e07095ddb6b26a539fe68897a44d6805598e_7z\\24099762P2024091901KYRQA.exe"
  ]
}