APTMembersOct 21, 2026, 17:36 (UTC+9)AppPatch svchost.exe execution is tied to a Winlogon launch setting
A process named svchost.exe ran from C:\Windows\AppPatch\svchost.exe, with another svchost.exe in a Downloads directory recorded as its parent. A separate registry event placed the AppPatch executable’s path alongside userinit.exe in a Winlogon setting. The combination raises a more consequential question than whether a filename looks suspicious: was this system-looking location also being made a future launch point?
#processmasquerading#Winlogonregistrymodification#logonpersistence#AppPatchexecutable#HTTPrequests#DNScorroborationActorsEmotet Group · TA542IOCf2 · i3 · d56 · u16MITRE27RegionsUSIndustriesRetail
C&CMembersOct 21, 2026, 04:50 (UTC+9)Dropped AppData executable linked to scheduled execution and HTTP requests
A Windows Schedule-service process appears as the parent of two synchost.exe processes running from a user’s AppData directory. In the same sandbox report, that path is written to disk and a synchost.job task file is recorded. The question is not simply whether a suspicious executable ran, but how that executable relates to the submitted sample—and whether the task activity provides a mechanism for running it beyond the original launch.
#Amadey#scheduledtasks#AppDataexecution#executabledeployment#HTTPC2#WindowsIOCf52 · i4 · d0 · u4RegionsCA · DO · FR · USIndustriesRetail
FILEMembersOct 20, 2026, 10:01 (UTC+9)Seven size matches point to possible packaged malware components
A compressed file submitted as launch.exe contains a Windows executable with a reported uncompressed size of 176,386 bytes—the exact size of a separately catalogued executable identified as ntmstart.exe. That would be a modest lead on its own. In the records examined by CTX Threat Intelligence, however, the same relationship appears across seven compressed-file and executable candidates.
#Compressedexecutables#WindowsDLLs#Sandboxanalysis#Filehashmatching#Process-attributedwrites#RegistryRunkeys#AutostartActorsLazarus Group · Hastati GroupIOCf28 · i0 · d0 · u0MITRE27RegionsCN
C&CMembersOct 20, 2026, 09:44 (UTC+9)Tool-labelled executable delivered a distinct Setup payload
A program recorded as Open Bullet.exe launched two processes named Setup.exe from a temporary directory. The filename alone could describe an ordinary installer helper. But the sandbox also recorded the dropped file’s hash, linking it to a separately analyzed executable whose reports contain script execution, an Explorer-named payload and registry settings intended to run commands at logon. What was the tool-labelled program actually delivering?
#sandboxanalysis#payloaddelivery#scriptexecution#registrypersistence#HTTPrequests#DNSresolutionIOCf14 · i1 · d1 · u1MITRE24RegionsBR
APTMembersOct 20, 2026, 09:35 (UTC+9)Mail hostname has a historical HTTPS footprint, not a malware link
The hostname turing.lru.li appears in two different roles in records reviewed by CTX Threat Intelligence: as a mail exchanger for lru.li, and as the name on an HTTPS certificate observed at 49.12.115.177. That match gives the IP a specific investigative context. But does it identify a mail server used by the malicious executable supplied alongside these records? The evidence supports a narrower finding.
#Mailinfrastructure#MXrecords#HTTPScertificates#DNS#Maliciousexecutable#InfrastructureanalysisActorsLazarus Group · Hastati GroupIOCf67 · i9 · d5 · u0RegionsUSIndustriesRetail
FILEMembersOct 19, 2026, 18:24 (UTC+9)Registry setting targeted a temporary executable that also ran as a child
A temporary executable launched by bofuv.exe was also the target of a persistence-related registry setting. In the same Zenbox report, that temporary executable dropped and launched another executable. Was the temporary directory merely a staging area, or did it hold the components the sample was arranging to keep running? The evidence supports the second interpretation, with a specific limit: it shows an execution pattern linked to a launch setting, not a demonstrated return after logon.
#Windowsexecutable#registrymodification#persistence-relatedsetting#temporaryexecutables#processtree#TCPtraffic#configuredC2ActorsSpring Dragon · Lotus BlossomIOCf5 · i2 · d0 · u4RegionsUSIndustriesRetail
C&CMembersOct 19, 2026, 18:17 (UTC+9)DNS and certificate records link qh88eu.com to its backdoor subdomain
backdoor.qh88eu.com and qh88eu.com have the same recorded IP addresses and HTTPS certificate. Two other domains share their TLS service fingerprint but have different addresses and certificates. That contrast raises the central question: how much of this apparent infrastructure cluster is actually connected? The records supplied to CTX Threat Intelligence support a specific relationship between the qh88eu.com parent domain and its backdoor subdomain. The wider grouping is less tightly linked.
#DNSrecords#TLScertificates#JARMfingerprint#Cloudflarenameservers#Infrastructureanalysis#C2investigationIOCf52 · i0 · d7 · u3RegionsUSIndustriesRetail
APTMembersOct 19, 2026, 18:16 (UTC+9)Dropped-file hash links outer installer to an executed inner installer
An executable running as setup.exe wrote update.exe into a Downloads directory and appeared as its parent in a sandbox process tree. The important detail was not the update-themed filename: the written file’s SHA-256 matched a second executable that had been analysed independently as an installer. Was this merely a bundle of similarly named files, or could the records show how one installer operated inside another? CTX Threat Intelligence’s records support the latter.
#Nestedinstallers#Droppedexecutables#Processtrees#Hashmatching#Temporaryexecutables#MSIpackages#Mining-poollookupActorsVoid Arachne · Silver FoxIOCf16 · i4 · d2 · u1RegionsBR
C&CMembersOct 19, 2026, 03:33 (UTC+9)Matching executable copies appear at two paths with Run entries
A Windows executable left matching copies of itself in both the user profile and Windows directory, with registry launch settings pointing to each location. In a sandbox report for the same sample, requests to two remote IP addresses received HTTP 404 responses. That combination raises a consequential question: does an unsuccessful request for remote content mean the executable failed to establish a foothold? The records examined by CTX Threat Intelligence support a more specific answer.
#Windowsexecutable#Runregistrykeys#Persistence#Direct-IPHTTP#Security-statusregistrychangesIOCf1 · i2 · d0 · u8MITRE13RegionsRO
APTMembersOct 19, 2026, 03:02 (UTC+9)Dropped-file hash links two samples beyond a shared HTTP endpoint
Two executable samples produced HTTP POST requests to the same IP address and PHP path in sandbox analyses. That overlap could have been just a shared destination. But the file records reveal a stronger relationship: analyses of one executable recorded a dropped file whose SHA-256 exactly matches the other. What role did that delivered code play—and how much of its operation can the records actually reconstruct?
#Amadey-associatedpayload#sandboxanalysis#dropped-filedelivery#HTTPcommandandcontrol#Run-keypersistence#scheduled-taskmodificationActorsTA505 · Hive0065IOCf10 · i1 · d0 · u2MITRE38RegionsPK
FILEMembersOct 18, 2026, 09:43 (UTC+9)Dropped-file hash links JavaScript to task-targeted payload
A JavaScript sandbox analysis recorded a file named WindowsUpdate.exe in a user’s temporary directory. Its SHA-256 matched a separately analyzed executable that requested a logon-triggered scheduled task pointing to that same location. The match answers the central question in this case: are the script, the executable and their launch settings merely similar-looking alerts, or do they describe connected components?
#JavaScript#Droppedexecutable#Scheduledtask#Runkey#Logonpersistence#DNSresolution#NetworktrafficActorsTA2541 · Operation LayoverIOCf14 · i0 · d2 · u1MITRE24
APTMembersOct 18, 2026, 09:36 (UTC+9)Recurring C# source links local compilation across malware analyses
A process reported as Microsoft’s MSBuild.exe launched Chrome with headless mode, remote debugging on port 9223, and the browser’s existing Default profile selected. In the same malware sample’s analysis record, MSBuild also appears in outbound connection events to an address recovered from memory as a command-and-control endpoint. Why is a build tool appearing at both the browser and network boundaries?
#Windows.NET#C#compilation#MSBuild#headlessbrowser#remotedebugging#C2configuration#malwareanalysisActorsScully Spider · TA547IOCf13 · i1 · d0 · u2MITRE18RegionsPK
FILEMembersOct 17, 2026, 17:38 (UTC+9)Parallel DNS names lead to separate recorded alias targets
Two hostnames with the same yzzcommon prefix point to different CNAME targets under separate .com domains. The records raise a specific question: do the parallel names under tyui54345.xyz and zxcv56745.xyz represent a common destination, or simply a repeated naming scheme? CTX Threat Intelligence’s records establish the naming pattern and distinct DNS alias targets—not a common backend.
#DNSaliases#CNAMErecords#Parallelnaming#Windowsexecutable#MaliciousfiledetectionActorsGold Evergreen · Business ClubIOCf5 · i0 · d7 · u2RegionsUSIndustriesRetail
C&CMembersOct 17, 2026, 17:37 (UTC+9)DNS links domain to IP; matching TLS fingerprints corroborate
dfkjgoi3.info points to 213.108.199.215 in the supplied DNS record, and the two profiles report matching HTTPS certificates and JARM service fingerprints. Together, these observations answer a concrete question: is the IP merely another suspicious indicator, or does it have a documented relationship to the domain? CTX Threat Intelligence’s records support the latter. The IP is an infrastructure pivot for investigating the domain, not just a nearby entry in an indicator collection.
#DNS#IPinfrastructure#TLScertificates#JARMfingerprinting#Command-and-controlclassification#Windowsexecutable#AutostartartifactActorsSalty Spider · KuKuIOCf9 · i1 · d2 · u37MITRE46RegionsUA
C&CMembersOct 16, 2026, 23:24 (UTC+9)Configured Stealc endpoint draws POSTs; shared loader host remains unobserved
An executable sent an HTTP POST to 196.251.107.130/16b022998f754137b60a.php, and a sandbox recorded an HTTP 200 response. A different executable listed the same IP address in its extracted configuration—but with /api.php as the path. That overlap raises a more useful question than whether the address is suspicious: does it connect two programs in an attack chain, or identify a host with distinct, separately evidenced roles? CTX Threat Intelligence’s records support the second reading.
#Stealcv2#command-and-control#HTTPPOST#sharedinfrastructure#scheduledtasks#registrypersistenceActorsAPT28 · StrontiumIOCf29 · i4 · d0 · u10MITRE22RegionsUSIndustriesRetail
FILEMembersOct 16, 2026, 23:22 (UTC+9)Image-like archive name masks script staging and Defender exclusion requests
A Windows PowerShell process invoked tar -xf N.jpg -C $env:public: a command to extract an archive, not display a photograph. Why was a file with a JPEG-style name being passed to an archive tool? Records examined by CTX Threat Intelligence provide a concrete explanation. A submitted file named N.jpg is identified as a POSIX TAR archive containing PowerShell and VBScript components, while process events show scripts with corresponding extensions being invoked through Windows interpreters.
#TARarchive#scriptstaging#PowerShell#VBScript#commandobfuscation#DefenderexclusionrequestsActorsOperation Epic ManchegoIOCf23 · i3 · d1 · u3RegionsUSIndustriesTechnology
C&CMembersOct 16, 2026, 07:50 (UTC+9)Firewall-disable command anchors a broader defense-interference attempt
A sandbox process tree records netsh.exe issuing netsh firewall set opmode disable. Elsewhere in the same report, Windows Security Center notification settings were written alongside a policy value governing User Account Control (UAC). The combination raises a more useful question than whether the executable looked suspicious: was it trying to change the host’s defenses, suppress their warnings, or both?
#Defenseinterference#Firewallconfiguration#Securitynotificationsettings#UACpolicy#Sandboxanalysis#WindowsActorsSalty Spider · KuKuIOCf11 · i1 · d2 · u29MITRE50RegionsUA
FILEMembersOct 16, 2026, 07:28 (UTC+9)Child processes link staged executables to logon launch settings
An executable running as software.exe created several other executables in a Windows temporary directory. The process tree placed some of those files directly beneath it, while a registry event identified one child setting a Windows-directory executable as a logon launch target. The question is not simply why so many filenames surround this sample, but what connects their roles: which files were staged, which ran, and which configured another path to run later?
#Windowsmalware#executablestaging#childprocesses#Run-keypersistence#registrychanges#processcreation#sandboxanalysisIOCf22 · i0 · d7 · u6MITRE30RegionsUA
FILEMembersOct 15, 2026, 15:24 (UTC+9)Configured C2 Host Matches Sandbox DNS and Traffic, Not a Proven Session
A Windows executable’s memory-derived configuration names https://sa1atik.cn/sa1at/ as a command-and-control endpoint. In a CAPE sandbox report for the same file, that hostname resolves to two addresses, one of which also appears as a TCP destination on port 443. The relationship raises a more useful question than whether the domain has a malicious reputation: how much of the configured communication route is visible in execution evidence?
#Windowsexecutable#Salat#C2configuration#malwareanalysis#DNSresolution#TLScertificates#sandboxtrafficActorsSnowglobe · Animal FarmIOCf1 · i1 · d1 · u1RegionsBG · DE · PH · PLIndustriesTelecommunications
APTMembersOct 15, 2026, 15:24 (UTC+9)Different filenames hide one executable in launcher process tree
A program recorded as 0CA02BB80457.exe produced a file named conhost.exe in a Windows Error Reporting temporary directory. The sandbox’s process tree placed that file beneath the original program—and placed an AppData svchost.exe beneath conhost.exe. Were these separate components, or the same executable operating under different names? The hashes change the interpretation.
#Windowsmalware#launcher#processmasquerading#Runkeypersistence#sandboxanalysis#DNSlookupActorsAPT27 · TEMP.HippoIOCf10 · i1 · d4 · u8
FILEMembersOct 14, 2026, 23:37 (UTC+9)Sandbox reports pair written files with Windows Run targets
Two sandbox reports recorded HTTP POST requests to spaines.pw/EiDQjNbWEQ/. A third recorded a POST to the identical path on a different domain, vcklmnnejwxx.pw. Alongside those requests, each report contained a written bin.exe path and a Windows Run entry pointing to that report’s corresponding file location. The question is not simply whether these are suspicious names, but how far the recorded relationships establish a mechanism: a program configured to return at logon and communicate…
#WindowsRunkey#AppData#persistence#HTTPPOST#outboundrequests#sandboxanalysisActorsSmoky SpiderIOCf10 · i0 · d3 · u3RegionsRO
C&CMembersOct 14, 2026, 23:12 (UTC+9)Sandbox reports trace executable’s request to configuration-shaped URL
Two sandbox reports record a Windows executable requesting the same resource: http://udo.jxwan.com/index/getcfg?id=59522. Both resolve the hostname to the same pair of IP addresses, and one records an HTTP 200 response. The request raises a more useful question than whether the destination appears on a threat list: what role did this service actually play in the executable’s behavior?
#Windowsexecutable#sandboxanalysis#HTTPrequest#configurationretrieval#networktraffic#processactivity#TLSinfrastructureIOCf21 · i8 · d28 · u2RegionsUSIndustriesRetail
APTMembersOct 14, 2026, 23:12 (UTC+9)Startup report, not just a Telegram connection
A Windows executable recorded in a CAPE sandbox report made a Telegram API request announcing “[CLIPPER STARTED]” and carrying details of its execution environment. The message described a “FIRST RUN” and claimed “STEALTH MODE ACTIVE.” But what did the program actually do beyond announcing itself? The records supplied to CTX Threat Intelligence give a more concrete answer than those self-descriptions.
#Windowsexecutable#TelegramAPI#startupreporting#Runkeypersistence#scheduledtask#firewallrule#eventlogclearingActorsComment Crew · Byzantine CandorIOCf4 · i1 · d1 · u0MITRE19RegionsSG
FILEMembersOct 14, 2026, 07:14 (UTC+9)Sandbox process chain shows executable launching recovery-disruption commands
A single command shell in a CAPE sandbox report connects an analyzed executable to five Windows recovery-management commands. Its children include tools launched to delete shadow copies, alter boot-recovery settings and remove the backup catalog. The important question is not simply whether this resembles ransomware, but how much of the recovery-disruption mechanism the record actually demonstrates.
#Windowsexecutable#ransomware-orientedactivity#recoverydisruption#shadow-copydeletion#boot-recoverychanges#backup-catalogdeletion#Runkeypersistence#event-logclearingActorsLockbit GangIOCf37 · i0 · d0 · u0MITRE35RegionsRO
C&CMembersOct 14, 2026, 07:14 (UTC+9)Different extensions, identical DLL content in sandbox report
A Windows DLL appeared under two very different filenames in a sandbox report: one on the desktop with a .dll.ocx suffix, the other beneath SysWOW64 with a .tsu extension. Both were targets of recorded regsvr32.exe commands. Were these separate components, or the same content taking different forms in the execution record? Their matching SHA-256 answers the content question: the two files were identical.
#WindowsDLL#regsvr32#system-binaryproxyexecution#sandboxanalysis#SysWOW64#HTTPStrafficActorsEmotet Group · TA542IOCf1 · i4 · d0 · u8MITRE27RegionsRO
APTMembersOct 14, 2026, 07:13 (UTC+9)Three DLL C2 URLs share a path, but not evidence of contact
Three web addresses extracted from a Windows DLL end in the same path, /8/forum.php, and all are designated as command-and-control endpoints. That gives the addresses a concrete relationship: they belong to one sample’s configuration. But do they also describe three servers that the malware reached, or even three services operating together? The evidence reviewed by CTX Threat Intelligence supports a more specific finding.
#WindowsDLL#HTTPC2#malwareconfiguration#DNSinfrastructure#JARMfingerprint#sandboxanalysisActorsTA511 · MAN1IOCf1 · i0 · d3 · u6RegionsRO
FILEMembersOct 13, 2026, 15:19 (UTC+9)AAct sample invokes WMIC to request Defender exclusions for itself and helper paths
An executable running as program.exe launched a command shell, which in turn launched Windows’ WMIC utility with an unusual request: add the executable’s own path to Microsoft Defender’s exclusions. The process tree makes the question concrete. Was this simply an activation utility trying to avoid detection, or evidence of a broader attempt to protect other components from inspection?
#AAct#Defenderexclusions#WMIC#processexecution#KMSemulator#scheduledtasks#servicepersistenceActorsGamaredon Group · CTIGIOCf2 · i0 · d0 · u0MITRE17IndustriesGovernment
C&CMembersOct 13, 2026, 15:19 (UTC+9)Written AppData file named in Windows executable-open command
A Windows executable wrote sidebar.exe beneath the current user’s AppData directory and changed the user’s .exe open command to point to that same file. The new command placed sidebar.exe /START before the executable being opened and its arguments. That raises a more consequential question than whether the sample contacted a suspicious address: was it positioning its own code in the path used to launch other programs? The CAPE Sandbox record supports that interpretation of the setting.
#Windows#AppData#executable-openredirection#registrymodification#droppedexecutable#processexecution#HTTPPOSTrequestsActorsGamaredon Group · CTIGIOCf12 · i1 · d0 · u9RegionsUSIndustriesRetail
APTMembersOct 13, 2026, 15:19 (UTC+9)Configured domains appear in POST requests, alongside local file changes
A Windows executable contacted two domains named in its extracted configuration, while a separate sandbox report tied an unusual file suffix to README files, an icon and Windows file-association settings. Those observations raise a more useful question than whether the sample is malicious: how do its outward communications relate to the changes it makes locally? The records examined by CTX Threat Intelligence support two complementary roles.
#DarkSide#ransomware#HTTPSPOSTrequests#command-and-controlconfiguration#Windowsfileassociations#VolumeShadowCopyActorsDarkside · Gold WaterfallIOCf87 · i0 · d1 · u3MITRE37RegionsRO
FILEMembersOct 12, 2026, 23:27 (UTC+9)Seven size matches point to possible packaged PE counterparts
A compressed object submitted as launch.exe is reported to expand to 176,386 bytes—the exact size of a separately listed Windows executable, ntmstart.exe. The same pattern recurs across six other compressed records and their possible executable or DLL counterparts. Are these additional components, or different representations of the same underlying files?
#ZLIBcompression#PEfiles#filehashes#sandboxanalysis#filewrites#Runkey#WindowsmetadataActorsLazarus Group · Hastati GroupIOCf29 · i0 · d0 · u0MITRE29RegionsSG
C&CMembersOct 12, 2026, 23:15 (UTC+9)One signed updater, several application-named service locations
A Bright Data-signed updater is associated with Windows service locations whose names refer to three different applications: Epic Pen, Bright VPN and drvhub. Two other signed updater files share the Bright VPN service name. That recurring footprint raises a more useful question than whether a file called net_updater.exe is suspicious: what component does the record identify, and what does it show that component doing?
#BrightSDK#BrightData#Windowsservices#signedsoftware#softwareupdater#sandboxclassificationActorsSpace Pirates · WebwormIOCf18 · i35 · d29 · u9MITRE19
APTMembersOct 12, 2026, 23:15 (UTC+9)A familiar process name becomes a specific logon target
The path %WINDIR%\rss\csrss.exe appears in several roles in the analysis record: as a file on disk, an execution target, a logon launch setting and the target of a scheduled-task creation command. The Windows Defender exclusion writes also reference the rss directory and the name csrss.exe. Why does this particular path recur across otherwise different kinds of activity? The strongest answer is that it anchors an attempted foothold, rather than merely giving a suspicious file a familiar name.
#system-processmasquerading#logonpersistence#scheduledtasks#Defenderexclusions#auxiliaryexecutable#TorarchiverequestActorsBarium · Wicked SpiderIOCf5 · i0 · d2 · u0MITRE46RegionsSA
FILEMembersOct 12, 2026, 07:22 (UTC+9)Copied executable gains a logon launch setting, but restart is unproven
A Windows executable appears in sandbox output under the name PCSuite.exe, with exactly the same SHA-256 as the submitted sample. The same sample’s analysis records also identify two different executables written to disk. Is this simply a program changing location, or a source of additional execution routes? The evidence assembled by CTX Threat Intelligence supports the second interpretation.
#Windowsmalware#Run-keypersistence#DLLexecution#Batch-fileexecution#Sandboxanalysis#HTTPrequestsIOCf18 · i1 · d13 · u0MITRE48RegionsUSIndustriesRetail
C&CMembersOct 12, 2026, 07:19 (UTC+9)Firewall deletion commands targeted names also reported as services
Two Windows firewall rules named upWire and wire were targeted for deletion in sandbox events associated with an upWire executable. Those same names appear separately as service-registry locations reported for two distinct files. The correspondence raises a more useful question than whether a firewall alert fired: was the software managing its own service-related network settings, or trying to remove a security restriction?
#Windowsfirewall#Firewallruledeletion#Serviceregistry#Netsh#Processcreation#CodesigningActorsSpace Pirates · WebwormIOCf19 · i17 · d6 · u2MITRE19
C&CMembersOct 11, 2026, 15:50 (UTC+9)upWire analysis shows attempted deletion of two named firewall rules
Two Windows command-shell events in an analysis associated with upWire launched netsh.exe with instructions to delete firewall rules named upWire and wire. A separate file identified as wire.exe has a reported registry location under Services\wire. Together, these observations raise a more specific question than whether a suspicious executable used a Windows administration tool: do the matching names reveal how related software manages its presence on the host?
#upWire#wire.exe#Windowsservices#firewallruledeletion#netsh#codesigning#hostconfigurationActorsSpace Pirates · WebwormIOCf16 · i18 · d21 · u6MITRE18
C&CMembersOct 11, 2026, 00:28 (UTC+9)UninstallerTray requests reveal a corroborated activity-reporting endpoint
An executable named UninstallerTray.exe appeared in a sandbox process tree while the same report recorded HTTP requests describing application activity: action=run and action=nowork. The requests went to s.jyrich.com/deep, carried a module version matching the file’s version, and included two identifier fields. Was this an isolated reporting mechanism, or did it resemble the behavior already documented for WinAuthority? The comparison is substantive.
#activityreporting#HTTPrequests#signedsoftware#publishercertificate#sandboxanalysis#internetcache#LSASSimageloadActorsGroup123 · Venus 121IOCf10 · i3 · d2 · u1MITRE52
FILEMembersOct 10, 2026, 23:23 (UTC+9)Image-named DLL path set as Remote Desktop service load target
Windows Remote Desktop’s service configuration was pointed at a file named C:\Windows\branding\mediasrv.png. The extension suggests an image, but a separate sandbox report identified a file dropped at that exact path as a 64-bit Windows DLL. Why was an image-named file being selected as a service component? The records reviewed by CTX Threat Intelligence support a concrete answer: the executable under analysis attempted to reconfigure Remote Desktop-related services, including their load target…
#WindowsDLL#RemoteDesktopServices#ServiceDLLconfiguration#PowerShell#Registrymodification#Service-startcommands#PortreconfigurationActorsTA505 · Hive0065IOCf10 · i2 · d3 · u8
APTMembersOct 10, 2026, 23:13 (UTC+9)Sandbox links written executable to logon target, records port-25 contacts
A sandbox report records daxixreameam.exe being written into a Windows user profile and a user-logon registry entry pointing to that same path. That relationship makes the filename more than an incidental artifact: it was both a recorded file-write destination and the target of a launch setting. But what was the executable being positioned to do? Separate network observations for the submitted sample show outbound contacts on TCP port 25, the port used by SMTP servers.
#Windowsexecutable#Runkey#User-logonpersistence#OutboundSMTPconnections#HTTPPOST#DNSlookupActorsPinchy Spider · SodinokibiIOCf2 · i4 · d10 · u11RegionsDE · USIndustriesRetail
C&CMembersOct 10, 2026, 07:26 (UTC+9)Firewall-rule deletion attempts targeted reported service names
Two recorded Windows commands targeted firewall rules named upWire and wire for deletion. Those names also appear in reported service autostart locations associated with two distinct signed executables. The match raises a more useful question than whether either file carries a suspicious label: what connects these programs’ service footprint to changes in the host’s network controls?
#Windowsfirewall#Firewall-ruledeletion#Windowsservices#Serviceautostart#Codesigning#Processcreation#SandboxanalysisActorsCactus · Cactus Ransomware GroupIOCf22 · i17 · d11 · u4MITRE16
APTMembersOct 10, 2026, 07:26 (UTC+9)Matching subdomains point to different CNAME targets
Two domains carry the same pair of subdomain labels: yzzcommon and 69f335c8397887d4. That repeated structure raises a concrete question: were the domains interchangeable routes to the same destination? DNS records supplied to CTX Threat Intelligence support a parallel naming scheme, but not a single demonstrated backend. The distinction matters because a useful infrastructure link can otherwise become an unsupported claim about redundancy or malware delivery.
#DNS#CNAMErecords#subdomains#nameservers#infrastructureanalysisActorsGold Evergreen · Business ClubIOCf5 · i1 · d7 · u2RegionsUSIndustriesRetail
FILEMembersOct 9, 2026, 15:34 (UTC+9)Word document’s download loop led to executables with different hashes
A web request in a Word-document sandbox analysis received an HTTP 200 response offering an executable attachment. The same report recorded an artifact under the attachment’s name, identical file content at a different local pathname, and a PowerShell child process bearing that local name. The question is no longer simply whether the document was malicious: how closely can its instructions, network activity and executable output be connected?
#Worddocument#PowerShelldownloader#encodedcommand#HTTPdownload#executableartifact#sandboxanalysisActorsEmotet Group · TA542IOCf4 · i0 · d5 · u3RegionsAUIndustriesTechnology
C&CMembersOct 9, 2026, 15:34 (UTC+9)One executable appeared behind several application names
A Windows executable appeared in a sandbox’s file outputs under both a CUAssistant launcher path and a Chrome installer path—with exactly the same SHA-256 as the file submitted for analysis. That raises a more useful question than the filenames alone can answer: were these separate software components, or was one executable’s content being placed behind several application-related names? The records support the latter interpretation for several outputs.
#Renamermalware#Windowsexecutables#software-directorywrites#fileplacement#sandboxanalysis#registrymodificationActorsSalty Spider · KuKuIOCf41 · i4 · d3 · u1MITRE17RegionsID
C&CMembersOct 8, 2026, 23:52 (UTC+9)DNS links flagged domain to IP with matching TLS fingerprints
The DNS record for dfkjgoi3.info points to 213.108.199.215, and the two indicators carry matching recorded HTTPS certificates and JARM service fingerprints. That combination raises a more useful question than whether either address has a malicious reputation: how firmly does the evidence identify a common service, and what activity can actually be attached to it? CTX Threat Intelligence’s records support a concrete domain-to-IP relationship, reinforced by matching TLS characteristics.
#Command-and-controlinfrastructure#DNSmapping#TLScertificates#JARMfingerprinting#NetherlandshostingActorsSalty Spider · KuKuIOCf13 · i1 · d2 · u46MITRE48RegionsUA
APTMembersOct 8, 2026, 23:52 (UTC+9)Executable’s batch file launched multiple PowerShell script requests
A Windows executable launched a temporary batch file whose child PowerShell processes named several remote script URLs. In a separate analysis, a Windows shortcut launched the same PowerShell command aimed at one of those URLs, http://marketprice.pk/zxcvb.ps1, and its sandbox recorded a DNS lookup for the domain. What connects the two files: a direct handoff, or a shared way of retrieving and executing code?
#Windowsexecutable#Windowsshortcuts#PowerShell#batchfiles#scriptretrieval#commandobfuscation#DNSlookupActorsPatchwork · ChinastratsIOCf12 · i0 · d5 · u6MITRE31RegionsUSIndustriesRetail
FILEMembersOct 8, 2026, 23:42 (UTC+9)Security-named program requests logon task to relaunch itself
A program running as Windows Security.exe launched the Windows task utility with a revealing instruction: create a task called “Windows Defender Security,” triggered at logon, that would run the same roaming-profile path as its parent. The security branding raises a practical question: was this a protective component, or a program arranging its own return under a reassuring name? Sandbox events reviewed by CTX Threat Intelligence support the latter interpretation.
#scheduledtasks#Runkey#logonpersistence#Defenderexclusion#roaming-profileexecutables#sandboxanalysisActorsLazyScripterIOCf10 · i2 · d1 · u3MITRE9RegionsZAIndustriesGovernment
FILEMembersOct 8, 2026, 07:32 (UTC+9)Hash-identified XMRig launch shares an IP with separate C2 configuration
A Windows process named sysmgnrsv.exe was created with a command line directing an XMRig miner to 178.16.54.109:6060. In a different file’s memory-extracted configuration, the same IP appeared on TCP port 6000, classified as command-and-control infrastructure. Does that overlap connect mining and malware control into one execution chain?
#XMRig#cryptomining#C2configuration#processcreation#SMTPconnections#infrastructureoverlapIOCf18 · i2 · d37 · u2MITRE19RegionsCN · GB · HK · HUIndustriesRetail
C&CMembersOct 8, 2026, 07:32 (UTC+9)WinAuthority’s run-labelled request points to a specific endpoint
A signed Windows executable sent an HTTP request that described its own activity as action=run, identified the application as winauth, and supplied a version matching the file’s reported version. What was the receiving server doing: collecting application activity, delivering instructions, or serving some other purpose? The sandbox records examined by CTX Threat Intelligence support a specific answer: WinAuthority.exe made a run-labelled request to s.91toolbox.com, while leaving…
#WinAuthority#Windowsexecutable#HTTPrequest#launchreporting#sandboxanalysis#localapplicationstate#DNSinfrastructureIOCf6 · i1 · d5 · u2MITRE48
APTMembersOct 8, 2026, 07:20 (UTC+9)Loader drops two distinct programs disguised as Windows processes
A loader placed two executables named svchost.exe and conhost.exe on disk, and sandbox records show both running from a Windows Error Reporting temporary directory. Their familiar names raise a practical question: were these Windows components participating in an application’s execution, or separate programs borrowing Windows identities? The evidence collected by CTX Threat Intelligence supports the second interpretation.
#loader#Windowsprocessmasquerading#droppedexecutables#temporary-directoryexecution#AppDataexecution#RunkeypersistenceActorsAPT27 · TEMP.HippoIOCf9 · i1 · d0 · u0MITRE43RegionsBR · CO · EG · FRIndustriesRetail
C&CMembersOct 7, 2026, 15:12 (UTC+9)Named firewall-rule deletion requests leave the outcome unresolved
The Windows command in the sandbox record targets a specific firewall rule: netsh advfirewall firewall delete rule name="upWire". Another recorded command targets a rule named wire. Those names also appear in reported Windows service locations associated with two signed executable samples. The question is what that overlap establishes: software managing its own network-related settings, or a deliberate attempt to weaken protection?
#WindowsFirewall#firewallruledeletion#processcreation#Windowsservices#codesigning#sandboxanalysisActorsEvilnum · DeathStalkerIOCf9 · i9 · d12 · u4MITRE20
C&CMembersOct 6, 2026, 23:15 (UTC+9)Install switches and service artifacts point to an updater, not a proven install
A Windows executable appeared in a sandbox with three installation- or loading-style command lines: software.exe -install, software.exe /install and software.exe /load. Its file record also identified updater-named Windows service locations. Together, these observations raise a concrete question: does the record show an updater establishing a persistent service, or only the entry points and artifacts associated with that role?
#Windowsservices#autostartartifacts#installswitches#codesigning#sandboxanalysis#UDPport53#TLSfingerprintActorsAPT15 · ROYALAPTIOCf11 · i2 · d5 · u2MITRE3IndustriesHealthcare · Telecommunications