3c61dc3de2a94ea94189a32445b08ae99bd0379e4279ded3c400f13e6677bd7a

Analysis

max time kernel
149s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/04/2026, 17:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3c61dc3de2a94ea94189a32445b08ae99bd0379e4279ded3c400f13e6677bd7a.exe
Size 7.8MB
Sample260420-vs2gpsa12p
SHA256 3c61dc3de2a94ea94189a32445b08ae99bd0379e4279ded3c400f13e6677bd7a
MD5 6aba1989db867e44940586341e619622
SHA1 a820d5bfb87af5116a0062e09527fff99092b888
SHA512 905634ac617fbd9ca1d93b85f752227688799409d3cde1c7da7523235683679f7610c113710011d6e65f68730bc949344d3c562e16d6ef2f02ddad252ba94b6a
SSDEEP 196608:P0SiClExqpaecNhBeMIHvHeeVZXyoz9bl/Qvmd2yhlDieDsAc:Herv+PPZXvxhdd2yDDieDsAc
TLSH
T1E7863315CBF448F8E0B3B7344DA1A612E67FB4967732838F46A825955F33790AE35B20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	3c61dc3de2a94ea94189a32445b08ae99bd0379e4279ded3c400f13e6677bd7a.exe

Executes dropped EXE 1 IoCs

pid	Process
3752	a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 3752	4680	3c61dc3de2a94ea94189a32445b08ae99bd0379e4279ded3c400f13e6677bd7a.exe	85

C:\Users\Admin\AppData\Local\Temp\3c61dc3de2a94ea94189a32445b08ae99bd0379e4279ded3c400f13e6677bd7a.exe
"C:\Users\Admin\AppData\Local\Temp\3c61dc3de2a94ea94189a32445b08ae99bd0379e4279ded3c400f13e6677bd7a.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\a.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\a.exe"
  2⤵
  - Executes dropped EXE
  PID:3752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\a.exe
Size 29.3MB
SHA256 afea3fbe228067bb8eb57c2871b33a1e3384478bc1dfc83ad52e8ffea5f1f265
MD5 a2e7ecc7d64cbb7df9f01211a6900e9e
SHA1 96e60a2317bef54998bec5e0b13e9d2e7af83a5d
SHA512 98b9350255524f462059e144df51924b588950576beea21b760cb3afef256ad5ae3156e3dc0197d2f9d291bfb3f2400221b01773d0cee818aa5432b905190322
SSDEEP 393216:BXZcbjK51cbjK5zDmXAeyhT/evPMRL31CPwDvt3uFhCIcFe9Xba938kWkez:JZcbjKTcbjKNmhE
TLSH
T1C6678C47B6605156FE75F03884A74506E379BCA2AB2083DB315D72292FF7BE19E39308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4680-12-0x000001DB3E4A0000-0x000001DB3E549000-memory.dmp

Download