Analysis
- max time kernel
0s - max time network
24s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
22/02/2026, 02:20
Errors
General
- Target The-MALWARE-Repo-master/Trojan/000.exe
- Size 6.7MB
- Sample260222-csec3acx8f
- SHA256 4ea1f2ecf7eb12896f2cbf8683dae8546d2b8dc43cf7710d68ce99e127c0a966
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Kills process with taskkill 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\000.exe"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\000.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic useraccount where name='Admin' set FullName='UR NEXT'3⤵
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic useraccount where name='Admin' rename 'UR NEXT'3⤵
-
-
C:\Windows\SysWOW64\shutdown.exeshutdown /f /r /t 03⤵
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3913855 /state1:0x41c64e6d1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CurrentDatabase_400.wmdb
WMSDKNS.XML
one.rtf
rniw.exe
windl.bat
UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N1XT.txt
memory/2080-21-0x0000000001450000-0x00000000014CB000-memory.dmp
memory/2528-863-0x0000000001000000-0x000000000107B000-memory.dmp
memory/2740-33-0x0000000000DA0000-0x0000000000DB9000-memory.dmp
memory/5512-11-0x0000000000640000-0x00000000006BB000-memory.dmp
memory/5620-51-0x00000000016A0000-0x00000000016B9000-memory.dmp
memory/6128-34-0x000000000CFF0000-0x000000000D000000-memory.dmp
memory/6128-32-0x000000000D020000-0x000000000D030000-memory.dmp
memory/6128-26-0x00000000098E0000-0x00000000098EE000-memory.dmp
memory/6128-10-0x00000000059D0000-0x00000000059E0000-memory.dmp
memory/6128-38-0x000000000CFF0000-0x000000000D000000-memory.dmp
memory/6128-1-0x00000000059D0000-0x00000000059E0000-memory.dmp
memory/6128-37-0x000000000D020000-0x000000000D030000-memory.dmp
memory/6128-35-0x000000000CFF0000-0x000000000D000000-memory.dmp
memory/6128-0-0x00000000009A0000-0x000000000104E000-memory.dmp
memory/6128-36-0x000000000D020000-0x000000000D030000-memory.dmp
memory/6128-31-0x000000000D020000-0x000000000D030000-memory.dmp
memory/6128-30-0x000000000D020000-0x000000000D030000-memory.dmp
memory/6128-29-0x000000000D020000-0x000000000D030000-memory.dmp
memory/6128-2-0x0000000006730000-0x0000000006CD4000-memory.dmp
memory/6128-859-0x00000000059A0000-0x00000000059B9000-memory.dmp
memory/6128-858-0x0000000001A70000-0x0000000001AEB000-memory.dmp
memory/6128-860-0x0000000005A60000-0x0000000006013000-memory.dmp
memory/6128-861-0x00000000059D0000-0x00000000059E0000-memory.dmp
memory/6128-862-0x00000000059D0000-0x00000000059E0000-memory.dmp
memory/6128-25-0x000000000CEE0000-0x000000000CF18000-memory.dmp