604d39766391d9e7f14ff6a41ad53f97dd011a9de075505f215170dfe1768d6e

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 17:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x604d39766391d9e7f14ff6a41ad53f97dd011a9de075505f215170dfe1768d6e.exe
Size 626KB
Sample260415-v411baft7l
SHA256 604d39766391d9e7f14ff6a41ad53f97dd011a9de075505f215170dfe1768d6e
MD5 aa99ebe812c38cc791c050298626923a
SHA1 99a46a6661bb3a443bbf84db732990dcfaea7b58
SHA512 d0c188c7a6d1d787fdaa6a53fb6ed709a7e18f36c95e379985ec2aaafff7fc09ad17e04015100298da0d25509832f258845aaa143e855cd2e541a186bdf3b31f
SSDEEP 12288:zYC6phcxu+g2yjk91gBoU1Pn1CECdtd19hrsAj+qsASeer5+nZoE:zYZpmO2yjk9aBRfzCfd1frKNuT
TLSH
T1F5D4011EB6A9FAD7C9724F302C74865467B2B89369501A3B1AD0530E6C271F4CE2BF35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3828	x604d39766391d9e7f14ff6a41ad53f97dd011a9de075505f215170dfe1768d6e.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\pkktddyirr = "C:\\Users\\Admin\\AppData\\Roaming\\jsccxhhd\\mmvrbbkgg.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\x604d39766391d9e7f14ff6a41ad53f97dd011a9d"	x604d39766391d9e7f14ff6a41ad53f97dd011a9de075505f215170dfe1768d6e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5020	3828	WerFault.exe	78

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x604d39766391d9e7f14ff6a41ad53f97dd011a9de075505f215170dfe1768d6e.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 808	3828	x604d39766391d9e7f14ff6a41ad53f97dd011a9de075505f215170dfe1768d6e.exe	79

C:\Users\Admin\AppData\Local\Temp\x604d39766391d9e7f14ff6a41ad53f97dd011a9de075505f215170dfe1768d6e.exe
"C:\Users\Admin\AppData\Local\Temp\x604d39766391d9e7f14ff6a41ad53f97dd011a9de075505f215170dfe1768d6e.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Users\Admin\AppData\Local\Temp\x604d39766391d9e7f14ff6a41ad53f97dd011a9de075505f215170dfe1768d6e.exe
  "C:\Users\Admin\AppData\Local\Temp\x604d39766391d9e7f14ff6a41ad53f97dd011a9de075505f215170dfe1768d6e.exe"
  2⤵
  PID:808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 1072
  2⤵
  - Program crash
  PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3828 -ip 3828
1⤵
PID:2432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blvitae.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy8A.tmp\blvitae.dll
Size 83KB
SHA256 82f3d8e31e90e0250657e38806cff749e68a40676bee6883d9af5e056303c532
MD5 ac6721f85992ebcd8f880fa231f056d4
SHA1 88c553a0cc6504de31fcd17efe03ecbc62d7f94e
SHA512 a1b9c5225397a84d06ba21585f4e9075bef35703e8d3a67bbcd621277cd235263aae86ef7e4081fcc0bef3899e807b577ad828f4b34b41eb4800c241749b3d87
SSDEEP 1536:pHCa7j/RLmHWR2LTujFWIci/Zt21sWv9cd5kTSvmxOvNR:84RLmHFLTujF7v2Xs5kuOxOvNR
TLSH
T1AA835B4075D1C871E6BE09355864D5616B3EBD528FE09E6B278623AE0F702C1EF34E3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3828-6-0x0000000000B40000-0x0000000000B42000-memory.dmp

Download

memory/3828-8-0x0000000003330000-0x000000000342E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads