a6eb7f69df025bf0229d9d3a9754cf687e8165978fd2fcf3accd30c6afa67562.exe

Summary

Methodology

The sample was executed in an isolated, instrumented Windows VM (host-only networking with emulated C2 responses) while process, file-system, registry and network activity were recorded. The verdict is derived by correlating observed runtime behaviour with static indicators. No sample binary was uploaded or redistributed.

Child processes (1)

• C:\argus-vr-agent\quarantine\a6eb7f69df025bf0229d9d3a9754cf687e8165978fd2fcf3accd30c6afa67562_extracted\a6eb7f69df025bf0229d9d3a9754cf687e8165978fd2fcf3accd30c6afa67562.exe

MITRE ATT&CK

YARA matches

Indicators of Compromise (defanged)

• 74ee9a25dc26ec7d1d14cc5d6e10f15800b6c60e
• 9eab119e1a445bdb9276dc76d572e20b

IOCs (JSON)Copy

{
  "sha256": "a6eb7f69df025bf0229d9d3a9754cf687e8165978fd2fcf3accd30c6afa67562",
  "verdict": "suspicious",
  "confidence": 95,
  "signals": [
    "yara-match",
    "child-processes"
  ],
  "attack": [
    "T1059"
  ],
  "children": [
    "C:\\argus-vr-agent\\quarantine\\a6eb7f69df025bf0229d9d3a9754cf687e8165978fd2fcf3accd30c6afa67562_extracted\\a6eb7f69df025bf0229d9d3a9754cf687e8165978fd2fcf3accd30c6afa67562.exe"
  ]
}