8d61f9e0aeeec43bdaf720bde7ead8e7d3de85f3497a0b784a723628c6d68dee

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/02/2026, 20:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vengrom executor/Bin/Monaco Editor/vs/editor/editor.main.css
Size 294KB
Sample260210-ytssqsa19a
SHA256 8d61f9e0aeeec43bdaf720bde7ead8e7d3de85f3497a0b784a723628c6d68dee
MD5 ea5ab85681f5442fbfbcb4d410f200f2
SHA1 5bd08fc669c7c830e88e0f37f7643a6a01e456ed
SHA512 5d622a2702c58dbdded3b55c23e976bfbc2f451bf560ffb237919c5a612c893a69499e9d132619285ac79454468c78349c3d3741b41fa57343524c98b713c3d1
SSDEEP 6144:UzsUTrsZ7KcNkuwcv2As0aMY/Y/RR9MtpWKco:UzsUTrsZXkW4/50i
TLSH
T15A54196F650A2B5A28DD28778596ED4EF4B4F0B2D8034FD4E8AE7F74804A7D8054736C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5916 wrote to memory of 2212	5916	cmd.exe	88

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\vengrom executor\Bin\Monaco Editor\vs\editor\editor.main.css"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5916
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\vengrom executor\Bin\Monaco Editor\vs\editor\editor.main.css
  2⤵
  PID:2212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads