b016eb06c2f40477c5163060571c16e79b60095b3876c3e16c72a420359b7795

Analysis

max time kernel
149s
max time network
97s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/02/2026, 20:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vengrom executor/Bin/Monaco Editor/vs/editor/editor.main.nls.fr.js.map
Size 65KB
Sample260210-ytssqsa19a
SHA256 b016eb06c2f40477c5163060571c16e79b60095b3876c3e16c72a420359b7795
MD5 bd5ff599189942ec1d9b1a82cf789da0
SHA1 6dbf042c89b98ffb6f4707b9675acbfe9f78ae13
SHA512 181998c1179bed09ecf8ae20f3e65817ed4734edb314de4eee78b1a26722c20f5f33b69d21a020efec0616783476b03b37b8842b6d9b79dc6d722e9bdd8709e9
SSDEEP 1536:703kWYUarPCqQq37VFI+pGswZXRI3Jcy0ZO:70RYUarP0IVvpm6Jcy0c
TLSH
T1296352DF52E2EA4288CE1F52B5539F93B4E39CC8B3C5912178AAF18701C549CF79AD90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4124	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\vengrom executor\Bin\Monaco Editor\vs\editor\editor.main.nls.fr.js.map"
1⤵
- Modifies registry class
PID:1720

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1720-0-0x0000028C54EA0000-0x0000028C54EFD000-memory.dmp

Download

memory/4124-1-0x000001F373580000-0x000001F37361E000-memory.dmp