APTMembersNov 7, 2026, 09:41 (UTC+9)DLL loader tests coincide with logger write, but attribution is unresolved
A sandbox report for a Windows DLL records a write of 0 to the Status value under Circular Kernel Context Logger. The same report shows a DLL-testing process launching rundll32.exe with named functions from the submitted file. That combination raises a consequential question: did the DLL interfere with system logging, or does the report contain two observations whose relationship remains unresolved?
#WindowsDLL#sandboxanalysis#DLLfunctioninvocation#registrymodification#systemlogging#possiblelogginginterferenceActorsSafePayIOCf1 · i3 · d0 · u8MITRE18RegionsPK
FILEMembersNov 7, 2026, 09:35 (UTC+9)DLL sandbox traffic links four hosts to API-shaped indicators
A DLL analysis recorded TCP traffic to four IP addresses that also appear in newly listed, API-shaped network indicators. In that same sandbox report, rundll32.exe was invoked against TmopphDns.dll, with ctfmon.exe appearing beneath it in the process tree. The overlap raises a concrete question: does the file explain how those apparent API endpoints were used?
#DLLanalysis#Sandboxanalysis#API-shapedindicators#TCPtraffic#Networkalerts#WindowsErrorReportingActorsSafePayIOCf1 · i3 · d0 · u8MITRE13RegionsPK
C&CMembersNov 6, 2026, 17:41 (UTC+9)upWire analysis shows attempts to delete two named firewall rules
Two Windows process-creation events record commands to delete firewall rules named upWire and wire. Both invoke netsh.exe through cmd.exe, and both record the new process running at High integrity. The immediate question is not simply whether a firewall command ran, but what removing those particular rules would change: was this software maintaining its own network settings, or interfering with a host’s protection?
#WindowsFirewall#firewallruledeletion#netsh#processcreation#codesigning#serviceartifactActorsCactus · Cactus Ransomware GroupIOCf19 · i25 · d17 · u2MITRE20
APTMembersNov 6, 2026, 17:41 (UTC+9)Registration calls wrote COM values despite a separate DLL error
Three COM class registrations were set to point to funoictl.dll on a sandbox desktop. In the same sandbox report, a separate invocation of that DLL produced a Windows error-reporting process. Did the component fail to do anything useful, or had it already made a consequential change? The evidence supports a more specific answer: the DLL’s registration-related invocations produced concrete registry writes, while a different invocation encountered an error.
#COMregistration#InprocServer32#registrywrites#DLLself-registration#sandboxanalysis#WindowsErrorReportingActorsInfy · Prince of PersiaIOCf22 · i7 · d1 · u0RegionsUSIndustriesRetail
C&CMembersNov 6, 2026, 01:37 (UTC+9)Matching TLS services across networks do not establish shared attack control
Two IP addresses in different autonomous systems expose the same HTTPS certificate and the same JARM service fingerprint. The pairing of 101.198.2.228 and 101.91.111.170 raises a useful question: does that match identify common attack infrastructure, or a shared service presentation? The records supplied to CTX Threat Intelligence support the narrower finding. They connect the addresses through specific TLS characteristics, rather than merely through geography or a telecommunications provider.
#TLScertificates#JARMfingerprints#HTTPSservices#Autonomoussystems#Sharedhosting#Server-nameindication#InfrastructureanalysisIOCf1 · i12 · d0 · u0MITRE29
APTMembersNov 6, 2026, 01:36 (UTC+9)Missing pages still reveal a recurring destination for a Windows executable
A Windows executable’s sandbox reports repeatedly recorded requests to area.wthelpdesk.com, using changing directory names and .htm filenames. Yet the responses differed sharply: one report showed missing pages, another redirects mixed with HTML responses, and a third a successful HTTP response with a cookie. What, exactly, was this host doing for the file? The evidence assembled by CTX Threat Intelligence establishes a recurring network destination, not a demonstrated command channel.
#Windowsexecutable#Sandboxanalysis#HTTPrequests#DNSresolution#WebcacheartifactsActorsRed Apollo · PotassiumIOCf1 · i0 · d1 · u7MITRE8RegionsMYIndustriesGovernment
FILEMembersNov 5, 2026, 09:40 (UTC+9)Recurring POST requests met redirects, including a domain-sale page
A Windows executable’s sandbox record contains POST requests to /b3/order.php on two hosts. One returned redirects to the same path; the other directed the client to a domain-sale page. In the same Lastline report, AdobeAcrobat entries appeared under Windows startup registry keys. The combination raises a more useful question than whether the domains are suspicious: what did the executable try to establish locally, and what service actually answered its outbound requests?
#Windowsexecutable#Startupregistrykeys#Persistence#HTTPPOSTrequests#HTTPredirects#SandboxanalysisActorsRATicateIOCf1 · i0 · d7 · u0MITRE24RegionsMYIndustriesGovernment
C&CMembersNov 5, 2026, 09:39 (UTC+9)Same-hash executable ran as svchost.exe and gained a logon launch setting
A file recorded as C:\121972984215590\svchost.exe had the same SHA-256 as the executable under examination, appeared beneath that sample in a sandbox process tree, and was named in a registry setting for launch at logon. The combination changes the meaning of the familiar filename: this was not simply a reference to a Windows service host, but the examined executable’s content operating under that name. The same analysis also recorded an HTTP request to 185.215.113.10.
#Phorpiex/Botx#svchost.exedisguise#Runkeypersistence#HTTPrequests#Defenderpolicywrite#securitynotificationchangesIOCf8 · i2 · d0 · u13MITRE32RegionsPK
APTMembersNov 5, 2026, 09:29 (UTC+9)Created SysWOW64 executable runs under services.exe at System integrity
An executable created under C:\Windows\SysWOW64 appears in a process-creation event with services.exe as its parent and System integrity. In sandbox reports for the submitted sample, requests also reach a resolver’s web interface to ask for TXT records beneath two .xyz domains. These observations raise a more useful question than whether the domains look suspicious: what does the executable actually establish on the host, and what information does it seek from DNS?
#SysWOW64execution#Service-contextexecution#DNSqueries#TXTrecords#Webresolver#SandboxanalysisActorsGold Evergreen · Business ClubIOCf5 · i1 · d7 · u2RegionsUS
FILEMembersNov 4, 2026, 17:36 (UTC+9)Excel launches an executable; a separate payload request lacks delivery proof
An Excel spreadsheet’s sandbox record contains a request for an executable at www.bagsrad.com and traffic to a different host’s configured TCP endpoint on port 5203. Are these two parts of one delivery-and-control sequence? The evidence establishes distinct roles for the destinations, but not every link between them. CTX Threat Intelligence’s records show Excel launching a local executable, a matching executable appearing under another name, and a logon launch setting pointing to that second…
#maliciousspreadsheet#executablerequest#processexecution#Runkeypersistence#Warzone-familyconfiguration#DNStraffic#TCPtrafficActorsMuddyWater · TEMP.ZagrosIOCf1 · i0 · d1 · u2RegionsAU · CH · DE · DKIndustriesBusiness Associations · Energy · Retail
C&CMembersNov 4, 2026, 17:36 (UTC+9)DNS links two domains to IPs; TLS fingerprints add service context
reihtec.com resolves to 174.138.186.11, and both carry the same recorded JARM TLS-service fingerprint. A second pair, kalteng.net and 45.126.43.3, shows the same combination of an exact DNS relationship and matching fingerprints. These are concrete connections—but do they identify malicious infrastructure, or simply the services behind the names?
#DNSrecords#TLSservices#JARMfingerprints#Hostinginfrastructure#Digitalcertificates#WindowsexecutableActorsPinchy Spider · SodinokibiIOCf2 · i9 · d13 · u9RegionsUS
FILEMembersNov 4, 2026, 02:12 (UTC+9)Executable imports reveal a shared DLL architecture, not verified execution
A Windows executable submitted as spoolsrv.exe names three unusually specific dependencies: coli-0.dll.coli_setID, trch-1.dll.Parameter_hasValue and tucl-1.dll.TcLog. A second executable, submitted as svschost.exe, requests the same DLLs alongside several others. Those names recur among the files profiled by CTX Threat Intelligence. The question is not simply whether the files have similar malware labels, but whether their internal references reveal a connected software design.
#Windowsexecutables#DLLimports#Modulartoolset#Softwarepacking#UPX#PEanalysisActorsRaspite · LeafminerIOCf47 · i0 · d1 · u2MITRE11RegionsUSIndustriesRetail
C&CMembersNov 4, 2026, 02:02 (UTC+9)Two Kryptex entry points converge on one address
Two Kryptex hostnames that appear to offer different entry points lead to the same recorded address. prl.kryptex.network and prl-eu.kryptex.network both resolve to 23.88.2.85, and their profiles contain the same TLS certificate and JARM service fingerprint. That overlap raises a practical question: does the wider collection describe separate servers, regional access points to a service, or a single connected attack infrastructure?
#Crypto-miningservices#DNSrecords#TLScertificates#Regionalendpoints#MiningscriptsIOCf37 · i5 · d9 · u0RegionsAR · BE · BH · BNIndustriesConstruction · Education & Research · Technology
FILEMembersNov 3, 2026, 09:41 (UTC+9)Uninstall request carries an identifier matching local registry state
A signed uninst.exe sent an HTTP request announcing type=uninstall&action=start&app=c_disk_clean. The request also carried an opaque identifier that exactly matched a value recorded in the Windows registry during the same sandbox analysis. That combination raises a more useful question than whether the executable contacted the internet: what local state was being represented in the uninstall report, and how does that help explain the destination’s role?
#uninstaller#HTTPreporting#registryidentifiers#sandboxanalysis#signedexecutable#cleaningutilityActorsFIN6 · Skeleton SpiderIOCf24 · i0 · d0 · u0MITRE15RegionsCN · HK · SGIndustriesFinancial Services
C&CMembersNov 3, 2026, 09:38 (UTC+9)Commands targeted two named firewall rules, but deletion is unconfirmed
Two Windows process events record commands to delete firewall rules named wire and upWire. A separate file record identifies a Windows service location named wire. The shared names raise a concrete question: do these observations show software managing its own service and network settings, or an attempt to weaken a host’s defenses? The evidence supports the first, narrower description of the software’s role, without resolving its intent.
#Windowsfirewallrules#netshcommands#Windowsservices#processcreation#codesigning#serviceconfigurationActorsAPT28 · StrontiumIOCf6 · i20 · d30 · u3MITRE32
APTMembersNov 3, 2026, 09:38 (UTC+9)WinAuthority run requests point to an activity-reporting endpoint
WinAuthority.exe sent an HTTP request describing its own activity: action=run, app=winauth and a module version matching the executable’s reported file version. Three sandbox reports captured the same request structure at s.91toolbox.com/winauth, with different identifier-like values. The question is not simply whether the utility contacted an external server, but what that exchange reveals about the server’s role.
#WinAuthority#Windowsexecutable#activityreporting#HTTPrequests#sandboxanalysis#browsercacheartifactsActorsAPT28 · StrontiumIOCf7 · i9 · d5 · u2MITRE22
FILEMembersNov 2, 2026, 17:42 (UTC+9)Activation sample sought a Defender exclusion for its own executable
An executable running as program.exe launched cmd.exe, which launched WMIC with a request to add that same executable to Windows Defender’s exclusion list. The parent-child relationship is recorded in a CAPE Sandbox report—not merely inferred from a detection label. Other matched process events associated with the sample requested exclusions for an AAct_files directory and named executables and a DLL. The concrete finding is an attempt to change what Defender would inspect.
#Defenderexclusions#WMIC#processcreation#activationsoftware#remoteadministration#serviceregistryartifactActorsGamaredon Group · CTIGIOCf4 · i0 · d0 · u0MITRE22IndustriesGovernment
C&CMembersNov 2, 2026, 17:42 (UTC+9)Hostname resolves to two IPs; fingerprint match is only a lead
The hostname 1818706573.cdn.123clouddisk.com shares a recorded TLS service fingerprint with 61.174.8.171, yet its supplied DNS answers point to two different addresses. That mismatch raises the central question: does the fingerprint identify another destination for the hostname, or simply a service worth comparing? CTX Threat Intelligence’s records establish a DNS relationship to the two returned addresses and a separate fingerprint similarity to the listed IP.
#DNSresolution#Arecords#CNAMErecords#TLScertificates#JARMfingerprints#Hosteddeliveryinfrastructure#Command-and-controlassessmentActorsUAC-0063 · TAG-110IOCf0 · i2 · d1 · u3MITRE10
APTMembersNov 2, 2026, 17:37 (UTC+9)Service path links a placed executable to auto-start execution
An executable named gbifebxy.exe appears beneath services.exe in a sandbox process tree. In the same report, a Windows service’s ImagePath points to that filename inside a newly named system-directory folder. The service-creation command gives it the display name “wifi support.” Is this simply a file being run, or an installation mechanism intended to keep it running? The records support the second interpretation.
#Windowsservices#Auto-startservices#Serviceinstallation#Sandboxanalysis#Mail-servercontact#OutboundtrafficActorsSmoky SpiderIOCf2 · i1 · d0 · u1MITRE33RegionsUSIndustriesRetail
FILEMembersNov 2, 2026, 01:48 (UTC+9)AppData file write leads to an observed child process
A sandbox report places an executable under %APPDATA% and shows a process at that same path as a child of the file being tested. The input is a .NET program just 7,168 bytes long. Is that small executable the program investigators need to understand, or is its more consequential role to start something else? The records assembled by CTX Threat Intelligence support the second reading: the sample participates in a concrete handoff to another executable, which in turn has a temporary-file process…
#maliciousfile#.NETexecutable#AppDataexecution#childprocess#installer-likebehavior#sandboxanalysis#HTTPrequestActorsPromethium · StrongPityIOCf81 · i0 · d1 · u3MITRE14RegionsUS
C&CMembersNov 2, 2026, 01:38 (UTC+9)Update-request context complicates a Tofsee TLS fingerprint alert
A TLS fingerprint alert attached to a Windows executable identifies a connection as “Tofsee,” but its destination also appears in a sandbox report resolving armmf.adobe.com and retrieving MSI content. Does that make the address malware infrastructure—or show why a network signature needs the surrounding request evidence? The records reviewed by CTX Threat Intelligence support a narrower, more useful finding: the alert identifies a fingerprint match, while the sandbox supplies evidence…
#TLSfingerprinting#JA3#DNS#HTTPrequests#MSImanifests#rundll32.exe#process-linkednetworkactivityActorsSalty Spider · KuKuIOCf16 · i1 · d6 · u25RegionsTHIndustriesTelecommunications
FILEMembersNov 1, 2026, 09:49 (UTC+9)Three configured domains overlap with Remcos network alerts at the IP level
Three port-443 destinations in a Windows executable’s network alerts also appear in DNS records for domains listed in its extracted command-and-control configuration. That overlap raises a more useful question than whether the domains look suspicious: how much of the file’s configured network has evidence of actual use? CTX Threat Intelligence’s records connect the executable to eleven distinct configured domains, spanning names under africa.com, hk.com, radio.am and .blog.
#Remcos#Windowsexecutable#C2configuration#Networkalerts#DNSrecords#RegistrywriteActorsGorgon Group · SubaatIOCf1 · i0 · d11 · u6RegionsUSIndustriesRetail
C&CMembersNov 1, 2026, 09:49 (UTC+9)Bank-themed domain points web and mail records to one IP
spectratrustbank.com points to 66.29.156.99, names itself as its mail destination, and explicitly includes that same IP address in its email sender policy. The relationship raises a more useful question than the bank-themed name alone: does the evidence establish a working phishing service, or infrastructure configured to support web and mail services? CTX Threat Intelligence’s records establish the configuration, not its use.
#Phishingclassification#Bank-themeddomain#DNSconfiguration#Mailinfrastructure#SPFpolicy#TLScertificatesActorsCactus · Cactus Ransomware GroupIOCf0 · i20 · d123 · u14IndustriesFood & Beverages
C&CMembersOct 31, 2026, 17:35 (UTC+9)Amadey configuration matched observed POSTs to its HTTP endpoint
An executable’s extracted configuration pointed to http://185.156.72.8/rob75u9v/index.php. Sandbox records then supplied the more consequential evidence: HTTP POST requests to that exact address, including a recorded 200 response. This was not simply an IP address appearing inside a suspicious file. The configured endpoint was also used during analysis.
#Amadey#RedLineStealer#C2infrastructure#HTTPPOST#sandboxanalysis#scheduledtaskartifactIOCf39 · i2 · d1 · u8MITRE57RegionsUS
APTMembersOct 31, 2026, 01:56 (UTC+9)Matching class ID links DLL’s browser setting to COM registration
A process loading Deals Plugin Extension.dll wrote a value named CrossriderApp0021806 beneath Windows’ Browser Helper Objects registry branch. The same class identifier appeared in COM registration keys recorded during the DLL’s sandbox analysis. That combination raises a more useful question than whether the file’s name looks suspicious: what role was this component configuring itself to play in the browser? The records examined by CTX Threat Intelligence support a specific answer.
#BrowserHelperObjects#COMregistration#Windowsregistry#browserextensions#NSISinstaller#sandboxanalysis#DNSlookupActorsDarkHotel · Fallout TeamIOCf51 · i0 · d2 · u9RegionsCA
FILEMembersOct 31, 2026, 01:45 (UTC+9)Date Manager and PrecisionTime share a registry structure with distinct settings
In separate sandbox reports, Date Manager and PrecisionTime recorded their executable locations under the same Gator.com registry structure. Each used a product-specific branch with entries named event, lockfiles and restart. The paths pointed back to the executables represented in the respective reports. What does that establish: a shared application-management mechanism, automatic persistence, or a connection to the similarly named date-manager.com domain? The strongest finding is local.
#DateManager#PrecisionTime#registryconfiguration#sandboxanalysis#executablepaths#DNSrecordsActorsSnowglobe · Animal FarmIOCf18 · i1 · d1 · u0MITRE21RegionsDE
FILEMembersOct 30, 2026, 09:32 (UTC+9)Matching script hash links executable drop to separate analysis
A Windows executable’s sandbox report records a VBScript file in the Startup folder and a wscript.exe process beneath the executable. The script’s hash matches a separately analysed file whose own reports show JavaScript placement, logon-launch settings and HTTP exchanges with an external endpoint. The question is not simply whether the executable is malicious: how much of its activity continues through scripts, and which connections between those components can actually be demonstrated?
#Windowsexecutable#VBScript#JavaScript#Startupfolder#Runkeys#scriptexecution#HTTPrequestsActorsTA2541 · Operation LayoverIOCf12 · i1 · d1 · u3RegionsCN · PK
C&CMembersOct 30, 2026, 09:32 (UTC+9)Different extensions, same DLL in recorded regsvr32 commands
A file named auctbv.bcb in a Windows system directory appears in a sandbox report as the target of a regsvr32.exe command. A second command references a Desktop file ending in .dll.ocx. The names suggest different components, but the reported SHA-256 values are identical. Is this evidence of an additional payload, or of the same DLL being used under different names?
#WindowsDLL#regsvr32#SystemBinaryProxyExecution#sandboxanalysis#HTTPSrequests#command-and-controlinfrastructureActorsEmotet Group · TA542IOCf1 · i3 · d0 · u9MITRE27RegionsRO
APTMembersOct 30, 2026, 09:31 (UTC+9)DLL traffic and sandbox alerts converge on reported C2 endpoints
A sandbox report for a Windows DLL records an HTTPS GET to 162.244.80.68:443/rXpAvLRK and an HTTP 200 response. A separate analysis of the same file records TCP traffic to that endpoint, while a network alert identifies the destination as a Feodo Tracker–reported command-and-control server. Together, these observations raise a more useful question than the file’s application-style name: how much of its role can be established from the execution and traffic records?
#WindowsDLL#sandboxanalysis#DLLloading#regsvr32#HTTPStraffic#command-and-controlalertsActorsLazarus Group · Hastati GroupIOCf1 · i5 · d0 · u6MITRE25RegionsRO
FILEMembersOct 29, 2026, 17:37 (UTC+9)Same external host appears in two browser sandbox reports
Two browser sandbox reports for the same local HTML file record a lookup of www.webzdarma.cz and a TCP connection to its resolved address, 185.64.219.22, on port 443. One report opened the file in Microsoft Edge; the other used Google Chrome. The repeated destination raises a concrete question: what role did that external host play when the local page was opened? The records reviewed by CTX Threat Intelligence establish a useful hostname-to-address connection in both environments.
#HTMLdocument#browsersandbox#DNSlookup#externalresources#certificateretrieval#browsermaintenanceActorsSalty Spider · KuKuIOCf31 · i0 · d1 · u2MITRE58RegionsBDIndustriesConsulting
APTMembersOct 28, 2026, 14:49 (UTC+9)VAUX-COM package extraction accompanies UAC-policy write
A Windows executable associated with a VAUX-COM software package appears in a sandbox record that sets the User Account Control policy value EnableLUA to zero. Other records show files being unpacked into a VAUX-COM directory and network alerts involving two web addresses ending in logo.gif. That combination raises a more useful question than whether the installer’s name looks suspicious: how much of the observed activity can ordinary package extraction explain?
#Windowsexecutable#RARself-extractingarchive#UACpolicy#registrymodification#filevisibilitysettings#Sality-relatedsignatures#networkalertsActorsTA505 · Hive0065IOCf30 · i2 · d4 · u16MITRE51RegionsES · GB · RO · RS
FILEMembersOct 28, 2026, 11:10 (UTC+9)Spreadsheet analysis links executable launch to matching local files
Excel launched an executable from a user’s Windows Templates directory while analysis of the same spreadsheet recorded a request for an .exe file on www.bagsrad.com. But the remote endpoint recovered from memory was elsewhere: mirrowingviewnet.ydns.eu:5203. Which address supplied the program, and which was intended to control it? The evidence supports different roles, with different levels of certainty.
#Warzone#maliciousspreadsheet#executablelaunch#Run-keypersistence#command-and-control#executablerequestActorsMuddyWater · TEMP.ZagrosIOCf1 · i0 · d1 · u2RegionsCH · DE · TR · USIndustriesConstruction · Education & Research · Hospitality & Leisure
C&CMembersOct 28, 2026, 11:10 (UTC+9)Executable queried TXT records across two .xyz domains via a resolver
A Windows executable asked a DNS-resolution service for TXT records beneath two related .xyz domains, using both the service’s hostname and a numeric IP address. In one sandbox report, those requests received HTTP 200 responses identified as JSON. The same file’s reports also recorded traffic to an address returned for down.zhangyaping.top.
#Windowsexecutable#TXTrecordlookups#HTTPDNSresolution#sandboxanalysis#SysWOW64execution#processcreationActorsGold Evergreen · Business ClubIOCf5 · i1 · d7 · u2RegionsUS
APTMembersOct 28, 2026, 11:10 (UTC+9)Spreadsheet drops executable content disguised as a document
An Excel spreadsheet’s sandbox report records a file called System.doc in a user-profile .templates directory. Despite its document extension, the file is a Windows executable—and its SHA-256 matches a separately analysed sample called System Manager.exe. The same spreadsheet report records an HTTP request to offlineearthquake.com, a hostname also used in the executable’s independent analysis.
#spreadsheetanalysis#executablemasquerading#droppedfile#hashmatching#HTTPrequests#sandboxanalysisActorsOilRig · APT34IOCf4 · i0 · d1 · u1MITRE10RegionsUSIndustriesRetail
FILEMembersOct 27, 2026, 10:57 (UTC+9)Shared DNS settings link two domains; a TLS match links a different pair
mrodularmall.top shares its recorded nameserver set and SPF text with crosshairc.life, but its recorded TLS service fingerprint matches a different domain: gunlovers.top. Does that make the three hosts one infrastructure cluster? CTX Threat Intelligence’s records support a narrower, more useful finding: mrodularmall.top is a pivot between two distinct infrastructure comparisons, not a demonstrated link in a command-and-control network.
#DNSconfiguration#SPFrecords#MXrecords#TLSfingerprinting#JARM#InfrastructurecomparisonIOCf25 · i0 · d4 · u8MITRE29RegionsPK
C&CMembersOct 27, 2026, 09:11 (UTC+9)Matching POST requests link two hosts in an installer workflow
Two hosts, os.baixakialtcdn.com and os2.baixakialtcdn.com, appear in a sandbox report with an unusually specific connection: each was addressed by HTTP POST requests using the same path and matching query parameters. The report also records temporary setup executables, a command with a progress-display argument, and a request for an executable hosted on Amazon S3. What role did the paired hosts play in that activity?
#sandboxanalysis#installerworkflow#HTTPPOSTrequests#temporaryexecutables#softwaredownloads#advertisingrequests#DNSrecordsIOCf7 · i1 · d3 · u2MITRE34RegionsBRIndustriesAgriculture
APTMembersOct 27, 2026, 09:10 (UTC+9)Text-suffixed path appears in service setting and execution argument
A process named Remote Data.exe was launched by a Windows service host with a numbered .txt file as its argument. The process metadata identified its original filename as RUNDLL32.EXE, while a separate registry event pointed the “Remote Data” service’s ServiceDll setting at the same text-suffixed path. The question is not simply whether the filename looks suspicious: what role was this apparent document playing in service-related execution?
#Windowsservices#ServiceDll#Rundll32-styleexecution#Runkeypersistence#Configurationextraction#SpreadsheetfilecreationActorsAPT28 · StrontiumIOCf24 · i2 · d0 · u0MITRE35RegionsUSIndustriesRetail
FILEMembersOct 26, 2026, 10:20 (UTC+9)Installer turns an obscure resource file into PowerShell input
The executable’s PowerShell child did not launch a conventional .ps1 file. Its command read Amnesias.Und from a directory under the user’s roaming profile, extracted three characters from the file’s contents and used the resulting string as a command name. That raises a more useful question than whether the installer used PowerShell: was this obscurely named file a passive resource, or part of the execution mechanism? The records establish the latter.
#PowerShell#installerexecutable#scriptexecution#filedrop#processinspection#WindowsErrorReportingActorsKimsuky · Velvet ChollimaIOCf8 · i0 · d0 · u1MITRE27RegionsPK
APTMembersOct 26, 2026, 10:19 (UTC+9)Archive analysis links extracted EXE to standalone sample by hash and launch
Three HTTPS POST requests went to three IP addresses on nonstandard ports, using paths that looked like application-management APIs. All three received HTTP 502 responses. What connects those requests to AEDT.zip, an archive whose sandbox report shows an executable being unpacked and launched? The strongest answer is not a shared filename or a malware label. The archive produced an AEDT.exe whose SHA-256 exactly matches the separately analyzed executable that generated the HTTP records.
#malwareanalysis#archiveextraction#executableexecution#outboundHTTPSrequests#networkindicators#sandboxanalysisActorsSafePayIOCf2 · i3 · d0 · u8MITRE12RegionsJO · PKIndustriesGovernment
FILEMembersOct 25, 2026, 17:39 (UTC+9)Dropped executable’s hash links dayroc.exe to a csrss.exe mimic
C:\Windows\rss\csrss.exe appears as a process image, a scheduled-task target and a Run-key value in the supplied sandbox evidence. A firewall command also names that same executable. The convergence raises a more useful question than whether a suspicious file borrowed a Windows process name: what placed this component within the case, and what role were the surrounding settings intended to give it? CTX Threat Intelligence’s review identifies a concrete connection.
#Stealc#droppedexecutable#system-processmimicry#logonpersistence#scheduledtask#Runkey#firewallruleActorsBarium · Wicked SpiderIOCf14 · i4 · d0 · u8MITRE25RegionsPK
FILEMembersOct 25, 2026, 08:41 (UTC+9)BR.exe launches an AutoIt script, clarifying the package’s role
A process named BR.exe launched AutoIt3.exe with Waters.a3x as its argument. That parent-child relationship, recorded in a CAPE sandbox report, answers a question the executable’s “Internet Explorer” product metadata cannot: what was this package actually running? The evidence reviewed by CTX Threat Intelligence identifies a wrapper-and-script execution mechanism.
#AutoIt#scriptexecution#executablewrapper#sandboxanalysis#HTTPPOSTActorsAPT28 · StrontiumIOCf8 · i1 · d2 · u1MITRE38
APTMembersOct 25, 2026, 05:30 (UTC+9)Serviceamd10 launcher drops and starts a separate XMRig executable
A Windows executable placed three files in C:\Windows\Serviceamd10\: another executable, a configuration file and a WinRing0 driver. Sandbox process trees recorded the new executable running as its child. The important question is not simply whether “Serviceamd10” is a miner, but what the original file puts into operation—and whether the accompanying driver remains on disk or is actually loaded. The records examined by CTX Threat Intelligence support a concrete answer.
#XMRig#WinRing0#Windows#minerlauncher#driverload#sandboxanalysisActorsSalty Spider · KuKuIOCf8 · i1 · d1 · u7MITRE13RegionsUS
FILEMembersOct 24, 2026, 11:11 (UTC+9)Dropped-file hashes reveal nested execution behind a shared endpoint
A Wextract-marked executable launched a program from one temporary directory, which in turn launched executables from another. In the same VMRay sandbox report, TCP traffic went to 185.161.248.73:4164—the exact destination found in extracted configurations for both the original file and one of its hash-identified components. The question is no longer simply whether the file is suspicious, but how its packaging behavior connects to that network destination.
#RedLine#Wextract#.NETexecutable#nestedexecution#C2traffic#RunOncecleanup#DefenderpolicychangesActorsSmoky SpiderIOCf6 · i1 · d0 · u1MITRE25RegionsPK
C&CMembersOct 24, 2026, 10:13 (UTC+9)Configured RedLine endpoint also appears in outbound and response alerts
The same address appears on both sides of network alerts associated with a Windows executable: 83.97.73.131:19071 is a destination in outbound detections and a source in response detections. The executable’s extracted configuration names that exact IP and port as command-and-control infrastructure. Together, those observations raise a more useful question than whether the address has a malicious reputation: what activity can actually be connected to it?
#RedLine#Amadey#C2communications#temporaryexecutables#Defenderpolicychanges#RunOncecleanup#scheduledtaskActorsTortoiseshell · Imperial KittenIOCf9 · i1 · d0 · u1MITRE3RegionsPK
APTMembersOct 23, 2026, 19:09 (UTC+9)Two payloads, not a numbered sequence, emerge from sandbox records
Two temporary executables appear as sibling processes beneath the same submitted file. One is connected to a running TiWorker.exe; the other is connected by its hash to svhost.exe in a user’s Startup folder. The important question is not simply whether those names look suspicious, but whether they represent separate programs, renamed copies, or successive steps in one execution chain.
#sandboxanalysis#payloadinstallation#Startupfolderpersistence#Run-keypersistence#system-likefilenames#processrelationshipsActorsSnowglobe · Animal FarmIOCf3 · i2 · d0 · u1MITRE43RegionsGB · ZAIndustriesGovernment
FILEMembersOct 23, 2026, 19:07 (UTC+9)Hash match links mining-configured executable to dropped payload
An executable that configured Windows-update-themed launch settings also left a second program in a temporary cache directory. In two sandbox reports, that file—WinInetCache\g3.exe—had the exact SHA-256 of a separately analyzed executable with SalatStealer configuration. The relationship raises a more consequential question than either malware label alone: was this merely a mining-related program, or did its activity extend to placing another malware component on the host?
#maliciousexecutable#payloaddelivery#miningconfiguration#logonpersistence#scheduledtask#configuredC2#securitypolicychangesActorsSnowglobe · Animal FarmIOCf31 · i3 · d0 · u1RegionsDE
FILEMembersOct 23, 2026, 06:22 (UTC+9)Updater’s `.cln` child matches the submitted file’s content
A PangYa-branded updater launched a child process named updater_signed.cln. The unusual extension triggered a suspicious-file-type rule, but the process record contains a more revealing detail: the child’s SHA-256 matches the submitted updater sample. What appears at first to be an unexplained extra executable is the known file’s content running under another name. That raises a more useful question than whether .cln looks suspicious: what work does this updater perform?
#softwareupdater#patchingworkflow#nonstandardfileextension#processcreation#HTTPrequests#componentfiles#certificatetrustActorsComment Crew · Byzantine CandorIOCf4 · i7 · d0 · u0MITRE11IndustriesConstruction · Telecommunications
APTMembersOct 23, 2026, 06:22 (UTC+9)Configured C2 address also appears in a separate sample’s HTTP POST
A sandbox recorded an HTTP POST to http://host-host-file8.com/, a URL also identified as a command-and-control endpoint in configuration extracted from a different executable. That overlap raises a concrete question: was the address merely present in malware configuration, or did an analyzed program actually use it? The records supplied to CTX Threat Intelligence support the latter, at the level of the sandbox report.
#SmokeLoader-familyconfiguration#HTTPPOST#C2configuration#DNSresolution#AppDatafilewrite#Remote-threadcreationActorsBarium · Wicked SpiderIOCf19 · i0 · d4 · u2MITRE20RegionsPK
FILEPublicOct 22, 2026, 09:36 (UTC+9)Configured endpoint appears in sandbox POST, beyond Azorult label
A sandbox report for a Windows executable records an HTTP POST to http://ANYIOBA.INFO/index.php—the exact URL identified in the file’s extracted configuration. That match answers a consequential question: was the endpoint merely present in configuration, or did it also appear in recorded network activity? In this case, it appeared in both. CTX Threat Intelligence’s evidence links the configured destination to a request recorded by Rising MOVES, which also logged a DNS lookup for anyioba.info.
#Azorult#Windowsexecutable#sandboxanalysis#HTTPPOST#extractedconfiguration#DNSlookupsActorsGorgon Group · SubaatIOCf1 · i0 · d1 · u2RegionsUSIndustriesRetail
APTMembersOct 22, 2026, 09:29 (UTC+9)Netsh commands target firewall rules matching wire and upWire service names
Two recorded Windows process-creation events invoke netsh to delete firewall rules named wire and upWire. Separately, the associated file profiles report Windows service locations bearing those same names. The match raises a more specific question than a generic firewall alert: was software managing its own network rules, or was an unauthorized change being made to the host’s controls?
#firewall-ruledeletion#netsh#Windowsservices#processcreation#codesigning#certificaterevocationActorsCactus · Cactus Ransomware GroupIOCf11 · i14 · d6 · u1MITRE17IndustriesEducation & Research · Government