Summary

e9e24fb71b09913424236131a896329ed726e0a6c796735462ff6ab440d7287c.exe

File e9e24fb71b09913424236131a896329ed726e0a6c796735462ff6ab440d7287c.exe

Summary
Download Resubmit sample

Size 81.5KB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 aa11b6ff927d330207749e83e747b78a
SHA1 b5d7e5ad5e427641bcd47ddf087883fa516577d5
SHA256 e9e24fb71b09913424236131a896329ed726e0a6c796735462ff6ab440d7287c
SHA512
1beca8f24986668dbe0b423becd6348b13761860e2a19f1bd46943f152f0ebe4af2aea99169074dfafdea19c6bd56ca99c43cea6d92764c62192ef7535f2fd45
CRC32 1A67A107
ssdeep None
PDB Path netsh.pdb
Yara
  • APT32_KerrDown - (no description)
  • DebuggerException__SetConsoleCtrl - (no description)

Score

This file appears fairly benign with a score of 0.6 out of 10.

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis
Category Started Completed Duration Routing Logs
FILE Feb. 25, 2026, 9:37 p.m. Feb. 25, 2026, 9:37 p.m. 38 seconds internet Show Analyzer Log
Show Cuckoo Log

Analyzer Log

2026-02-25 20:37:06,015 [analyzer] DEBUG: Starting analyzer from: C:\tmpwoh6zt
2026-02-25 20:37:06,030 [analyzer] DEBUG: Pipe server name: \??\PIPE\RtkXLaWIzkhlqUEJrtJzurgigmhlN
2026-02-25 20:37:06,030 [analyzer] DEBUG: Log pipe server name: \??\PIPE\MSsByAqSVORkVikbriWLmqTqQRnYWmNy
2026-02-25 20:37:06,312 [analyzer] DEBUG: Started auxiliary module Curtain
2026-02-25 20:37:06,312 [analyzer] DEBUG: Started auxiliary module DbgView
2026-02-25 20:37:06,858 [analyzer] DEBUG: Started auxiliary module Disguise
2026-02-25 20:37:07,078 [analyzer] DEBUG: Loaded monitor into process with pid 500
2026-02-25 20:37:07,092 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2026-02-25 20:37:07,092 [analyzer] DEBUG: Started auxiliary module Human
2026-02-25 20:37:07,092 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2026-02-25 20:37:07,092 [analyzer] DEBUG: Started auxiliary module Reboot
2026-02-25 20:37:07,187 [analyzer] DEBUG: Started auxiliary module RecentFiles
2026-02-25 20:37:07,187 [analyzer] DEBUG: Started auxiliary module Screenshots
2026-02-25 20:37:07,187 [analyzer] DEBUG: Started auxiliary module Sysmon
2026-02-25 20:37:07,187 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2026-02-25 20:37:07,265 [lib.api.process] ERROR: Failed to execute process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\e9e24fb71b09913424236131a896329ed726e0a6c796735462ff6ab440d7287c.exe' with arguments ['bin\\inject-x86.exe', '--app', u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\e9e24fb71b09913424236131a896329ed726e0a6c796735462ff6ab440d7287c.exe', '--only-start', '--curdir', 'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp'] (Error: Command '['bin\\inject-x86.exe', '--app', u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\e9e24fb71b09913424236131a896329ed726e0a6c796735462ff6ab440d7287c.exe', '--only-start', '--curdir', 'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp']' returned non-zero exit status 1)

Cuckoo Log

2026-02-25 21:37:06,759 [cuckoo.core.scheduler] INFO: Task #7465475: acquired machine win7x643 (label=win7x643)
2026-02-25 21:37:06,760 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.203 for task #7465475
2026-02-25 21:37:07,064 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 599979 (interface=vboxnet0, host=192.168.168.203)
2026-02-25 21:37:07,416 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x643
2026-02-25 21:37:07,876 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x643 to vmcloak
2026-02-25 21:37:16,437 [cuckoo.core.guest] INFO: Starting analysis #7465475 on guest (id=win7x643, ip=192.168.168.203)
2026-02-25 21:37:17,443 [cuckoo.core.guest] DEBUG: win7x643: not ready yet
2026-02-25 21:37:22,466 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x643, ip=192.168.168.203)
2026-02-25 21:37:22,668 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x643, ip=192.168.168.203, monitor=latest, size=6660546)
2026-02-25 21:37:24,156 [cuckoo.core.resultserver] DEBUG: Task #7465475: live log analysis.log initialized.
2026-02-25 21:37:25,185 [cuckoo.core.resultserver] DEBUG: Task #7465475 is sending a BSON stream
2026-02-25 21:37:26,477 [cuckoo.core.resultserver] DEBUG: Task #7465475: File upload for 'shots/0001.jpg'
2026-02-25 21:37:26,505 [cuckoo.core.resultserver] DEBUG: Task #7465475 uploaded file length: 133470
2026-02-25 21:37:26,617 [cuckoo.core.guest] WARNING: win7x643: analysis #7465475 caught an exception
Traceback (most recent call last):
  File "C:/tmpwoh6zt/analyzer.py", line 824, in <module>
    success = analyzer.run()
  File "C:/tmpwoh6zt/analyzer.py", line 673, in run
    pids = self.package.start(self.target)
  File "C:\tmpwoh6zt\modules\packages\exe.py", line 34, in start
    return self.execute(path, args=shlex.split(args))
  File "C:\tmpwoh6zt\lib\common\abstracts.py", line 205, in execute
    "Unable to execute the initial process, analysis aborted."
CuckooPackageError: Unable to execute the initial process, analysis aborted.

2026-02-25 21:37:26,634 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2026-02-25 21:37:26,667 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2026-02-25 21:37:27,430 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x643 to path /srv/cuckoo/cwd/storage/analyses/7465475/memory.dmp
2026-02-25 21:37:27,432 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x643
2026-02-25 21:37:44,473 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.203 for task #7465475
2026-02-25 21:37:44,474 [cuckoo.core.resultserver] DEBUG: Cancel <Context for LOG> for task 7465475
2026-02-25 21:37:44,837 [cuckoo.core.scheduler] DEBUG: Released database task #7465475
2026-02-25 21:37:44,858 [cuckoo.core.scheduler] INFO: Task #7465475: analysis procedure completed

Signatures

Yara rules detected for file (2 events)
description (no description) rule APT32_KerrDown
description (no description) rule DebuggerException__SetConsoleCtrl
This executable has a PDB path (1 event)
pdb_path netsh.pdb
The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)
section .didat
The file contains an unknown PE resource name possibly indicative of a packer (1 event)
resource name MUI
Screenshots
Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action VT Location
No hosts contacted.
Cuckoo

We're processing your submission... This could take a few seconds.