04a822d310fa08aac54f98a44f8aaad15e5babd3d3fcb87869910c1b7906dc01

Analysis

user interaction
yes
max time kernel
36s
max time network
45s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260126-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260126-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
16/04/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
opencode-cli.exe
Size 147.7MB
Sample260416-vb2q5saw2s
SHA256 04a822d310fa08aac54f98a44f8aaad15e5babd3d3fcb87869910c1b7906dc01
MD5 aee9a11196badcffc496388554fa0cab
SHA1 51bbe243747f0a882ce60f97fdf0a9780ecb3734
SHA512 1c0655d38ec2bd863685061cf9be59f3b8a73838b8a532d056ea6cb3470bbe0d9d99582a26caef6570aea972ae13332c5a88c8d88fc7de9c43129cb0b349e28f
SSDEEP 1572864:KjmPjN5oVlUzswxe5ch32QdsWcwVjaOqwbq7bu0c:KQIU+Oqwbq7bu0c
TLSH
T14978AF03B2AB54DCE5BBC97081E75323A5337C461B3099EF61884B352F27AD49B76B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4214655515-2537246629-1547560666-1000\Control Panel\International\Geo\Nation	opencode-cli.exe

Loads dropped DLL 2 IoCs

pid	Process
3584	opencode-cli.exe
3584	opencode-cli.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 4764	3584	opencode-cli.exe	82
PID 3584 wrote to memory of 2248	3584	opencode-cli.exe	84
PID 3584 wrote to memory of 3528	3584	opencode-cli.exe	86
PID 3584 wrote to memory of 2732	3584	opencode-cli.exe	88
PID 3584 wrote to memory of 440	3584	opencode-cli.exe	90
PID 3584 wrote to memory of 3640	3584	opencode-cli.exe	92
PID 3584 wrote to memory of 2052	3584	opencode-cli.exe	94

C:\Users\Admin\AppData\Local\Temp\opencode-cli.exe
"C:\Users\Admin\AppData\Local\Temp\opencode-cli.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Windows\system32\cmd.exe
  cmd.exe /d /s /c "npm ^"list^" ^"-g^" ^"--depth=0^""
  2⤵
  PID:4764
- C:\Windows\system32\cmd.exe
  cmd.exe /d /s /c "yarn ^"global^" ^"list^""
  2⤵
  PID:2248
- C:\Windows\system32\cmd.exe
  cmd.exe /d /s /c "pnpm ^"list^" ^"-g^" ^"--depth=0^""
  2⤵
  PID:3528
- C:\Windows\system32\cmd.exe
  cmd.exe /d /s /c "bun ^"pm^" ^"ls^" ^"-g^""
  2⤵
  PID:2732
- C:\Windows\system32\cmd.exe
  cmd.exe /d /s /c "brew ^"list^" ^"--formula^" ^"opencode^""
  2⤵
  PID:440
- C:\Windows\system32\cmd.exe
  cmd.exe /d /s /c "scoop ^"list^" ^"opencode^""
  2⤵
  PID:3640
- C:\Windows\system32\cmd.exe
  cmd.exe /d /s /c "choco ^"list^" ^"--limit-output^" ^"opencode^""
  2⤵
  PID:2052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

package.json

Path C:\Users\Admin\.config\opencode\package.json
Size 62B
SHA256 95be083aaf52d6a4cb7a01bfd95a47802441fcdd52a34373cd09c2bfc0722547
MD5 ac29eca972f9638b12df179b33813fe5
SHA1 d49d09d27ce23bc9d4a38c8d846d00c9777c4efd
SHA512 147ad56089db26c8c4c007f92085bad715633b5ae54c1f3d8476050f7edf8fc1c6cc8f875a467162f10aaeb1642184700702fedeac6a4a8b6acf9279bb103974
TLSH
T136A02230B00000E28EEFA0C00088C323880EB808C0088808A0E002CCCC00AB2008C220
MD5 SHA1 SHA512 TLSH

Submit Download

.bebef5fff9b9ffbe-00000000.dll

Path C:\Users\Admin\AppData\Local\Temp\.bebef5fff9b9ffbe-00000000.dll
Size 1.1MB
SHA256 1c51f4bd5e5a61a9e3aec69922de6f0da92db82aa3a936abac2a4e02ac155d57
MD5 86940db044ee98a91174b10e7d1f0363
SHA1 0e9db4cf937a6ab17a40e8b3f06e839dc69e42c3
SHA512 befff4a42ee331fa1a340c0224897fde7a5962102d6d59eeb9f8de51fc677fd3430cbeb3f4bfc4b5ad33bc16c709b5f0091095b62920f0b4e38fedaaac40dcd7
SSDEEP 24576:aIp2C9qdXP68TPtiGFrZwFelnwqESQT+:aIp2C6P68pNFrZ/lnwqEv
TLSH
T19935E507F2A29D7BE01E807041E756D2D2FD76498300E8BF91A05A2C1E978FB5B747E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.fea7efe31f2ff7fa-00000001.node

Path C:\Users\Admin\AppData\Local\Temp\.fea7efe31f2ff7fa-00000001.node
Size 506KB
SHA256 a8199cf7b6c5102267a5889f80321a4cc92e631d7504c474d32a35b4d440f315
MD5 34581748f55c388cd744f152e065bd0c
SHA1 95c5394ad0a174184b808c17d1eb5fc71593d7de
SHA512 b5b8ab91947a2b06bd7ef097855b0cf19dfbf3b9e93b33d02b57cbdac4ed0b7d82004665123a1ee6c5a880b80d7cd9df9ad202fa179731b2045b0ae11e1c69f3
SSDEEP 6144:jk4bH+DHWwaMfPvMpRIO8kM4dac5mlMH1BVLI6vuLlKIdM1sj3vy8BK:N+rWgcc6hdac5mSrVLIUuLlzqsDpU
TLSH
T19BB47D6AA2A803B8D4ABD17CCA574903F77578460761DBDF03E086761F27BE15A7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3584-279-0x000001F8D4D90000-0x000001F8D4DBF000-memory.dmp

Download

memory/3584-280-0x000001F8E37F0000-0x000001F8E37FC000-memory.dmp

Download

memory/3584-291-0x000001F8D4D90000-0x000001F8D4DBF000-memory.dmp

Download

memory/3584-292-0x000001F8E37F0000-0x000001F8E37FC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads