3b2eac8ab591f64a4983f3d1f6ed0db65a44eaa08ee7950ac1e6deef05e314b9

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/04/2026, 05:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
client.exe
Size 71.1MB
Sample260421-gl5c5act8v
SHA256 3b2eac8ab591f64a4983f3d1f6ed0db65a44eaa08ee7950ac1e6deef05e314b9
MD5 8888df48e20bbf0f123a4cc287fa0f47
SHA1 1997db2bb5d082643b6dab7d5ceb31559c24ca43
SHA512 00bf5cbb752323dfe10cdb3ece1010dcf0608ad1fc0339afa4abf92d9c10d7722855318db27ad8ac6a32488a0225348f561a0b403c31e77762f52c3554536344
SSDEEP 1572864:jTQxxBSyGAbism6u1eEcQQ4CJ+ujfKZTy+51JXQ0+v89rR0b:/Qx3Ot/YeSSZ55z3t9rR0b
TLSH
T12CF73324B611B438C56D493C27AB0A7821B03FA99CFCDA4B8DD975D67F7E252203D0DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	client.exe

Executes dropped EXE 2 IoCs

pid	Process
3452	client.pok.in.net.exe
4336	client.pok.in.net.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\client.pok.in.net.exe	client.exe
File opened for modification	C:\Windows\SysWOW64\client.pok.in.net.exe	client.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5348 set thread context of 4276	5348	client.exe	85
PID 3452 set thread context of 4336	3452	client.pok.in.net.exe	87

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4276-2-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/4276-4-0x0000000000400000-0x0000000000414000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client.pok.in.net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client.pok.in.net.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4276	client.exe
4336	client.pok.in.net.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5348 wrote to memory of 4276	5348	client.exe	85
PID 5348 wrote to memory of 4276	5348	client.exe	85
PID 5348 wrote to memory of 3452	5348	client.exe	86
PID 3452 wrote to memory of 4336	3452	client.pok.in.net.exe	87
PID 3452 wrote to memory of 4336	3452	client.pok.in.net.exe	87

C:\Users\Admin\AppData\Local\Temp\client.exe
"C:\Users\Admin\AppData\Local\Temp\client.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5348
- C:\Users\Admin\AppData\Local\Temp\client.exe
  C:\Users\Admin\AppData\Local\Temp\client.exe
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4276
- C:\Windows\SysWOW64\client.pok.in.net.exe
  "C:\Windows\System32\client.pok.in.net.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Windows\SysWOW64\client.pok.in.net.exe
    C:\Windows\SysWOW64\client.pok.in.net.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:4336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.html

Path C:\Users\Admin\ratata\logs.html
Size 292B
SHA256 36f329a197b00bdf04860031b2ab6e03afeec8cbf8ea4267f0862416a0084d41
MD5 b2bf6e54fb24f82a40501c166ae6584d
SHA1 bd00e9eb304a7d0ad7729a61f3967c03e2b811fc
SHA512 11b755f873949d1a872d9f505e308c14313b49fa71a89a256f648ec0c4e3643a758609deffd7da7752eca6f8a297b0832e051aa0186e3e72a698b909f0c9b671
TLSH
T189E08C09D8EB608A390B00094404F346E414C2C5BE0C8F50222B347BB38F0C410232A6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3452-21-0x0000000010000000-0x00000000100E6000-memory.dmp

Download

memory/3452-39-0x0000000010000000-0x00000000100E6000-memory.dmp

Download

memory/3452-32-0x0000000002400000-0x0000000002419000-memory.dmp

Download

memory/3452-31-0x0000000000770000-0x0000000000806000-memory.dmp

Download

memory/3452-29-0x0000000010000000-0x00000000100E6000-memory.dmp

Download

memory/4276-4-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4276-7-0x0000000010000000-0x00000000100E6000-memory.dmp

Download

memory/4276-2-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5348-20-0x00000000006D0000-0x0000000000766000-memory.dmp

Download

memory/5348-19-0x0000000010000000-0x00000000100E6000-memory.dmp

Download

memory/5348-0-0x0000000010075000-0x0000000010076000-memory.dmp

Download

memory/5348-1-0x0000000010000000-0x00000000100E6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads