493555f293389e6e41828289be8f1b463f6b95277d33d46b35f7e796e619a1d4

Analysis

max time kernel
98s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/04/2026, 09:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
493555f293389e6e41828289be8f1b463f6b95277d33d46b35f7e796e619a1d4.exe
Size 1016KB
Sample260421-kzn5vaby3p
SHA256 493555f293389e6e41828289be8f1b463f6b95277d33d46b35f7e796e619a1d4
MD5 c44b84e38fe4fc5eedd11cf7c8441132
SHA1 d57764fdacfb19af1b3f8a2199a0222a3c5b2a89
SHA512 e2f84048cc95a4bee88de0222c12cdfcab9c028b44051df6c36706e0f255e9564d5805d86b52ce1dbab1598302fc06207f48104113af6604f6f55a83c0dd4994
SSDEEP 24576:hRkrkULoRbepH3pY7g7jjSU6G5PoBlG4KbJ0cVp4sPXM:hpUnG7iSUzAlG4KtJ4T
TLSH
T1E6259D23E59280F1D224167014FB5735AE7897821B65CEC7E3D8DDBD2C622E1A73B21E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	493555f293389e6e41828289be8f1b463f6b95277d33d46b35f7e796e619a1d4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	493555f293389e6e41828289be8f1b463f6b95277d33d46b35f7e796e619a1d4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings	493555f293389e6e41828289be8f1b463f6b95277d33d46b35f7e796e619a1d4.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3748	493555f293389e6e41828289be8f1b463f6b95277d33d46b35f7e796e619a1d4.exe
3748	493555f293389e6e41828289be8f1b463f6b95277d33d46b35f7e796e619a1d4.exe
3748	493555f293389e6e41828289be8f1b463f6b95277d33d46b35f7e796e619a1d4.exe
3748	493555f293389e6e41828289be8f1b463f6b95277d33d46b35f7e796e619a1d4.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3748	493555f293389e6e41828289be8f1b463f6b95277d33d46b35f7e796e619a1d4.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3748	493555f293389e6e41828289be8f1b463f6b95277d33d46b35f7e796e619a1d4.exe
3748	493555f293389e6e41828289be8f1b463f6b95277d33d46b35f7e796e619a1d4.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3748 wrote to memory of 3676	3748	493555f293389e6e41828289be8f1b463f6b95277d33d46b35f7e796e619a1d4.exe	84
PID 3748 wrote to memory of 4124	3748	493555f293389e6e41828289be8f1b463f6b95277d33d46b35f7e796e619a1d4.exe	85

C:\Users\Admin\AppData\Local\Temp\493555f293389e6e41828289be8f1b463f6b95277d33d46b35f7e796e619a1d4.exe
"C:\Users\Admin\AppData\Local\Temp\493555f293389e6e41828289be8f1b463f6b95277d33d46b35f7e796e619a1d4.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3676
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 753B
SHA256 28a9eb7d6f531e962bfac67fb7350ff9d4a6911d54e78f832df140a44ad86c53
MD5 4e33f4527747aa739cc4d24cb6eada3c
SHA1 b696b8d18f69736298214418ac3434f7cd3ad54d
SHA512 3d6bc3cfd9ff4651ca5afa89c0614e53a0c62ef4693b56d238572bd91e35a46c2ddb60c56fe04266868d9c9ad5946be6abf0034c7af9bf7ab3ca42c497e7fda1
TLSH
T1D601CB10DD4CC29C903553B62532A84EF7AA1563B303ACE8B899D1B52F707689CB0A36
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3676-11-0x0000000002AE0000-0x0000000002BDA000-memory.dmp

Download

memory/3676-20-0x0000000002AE0000-0x0000000002BDA000-memory.dmp

Download

memory/3748-10-0x0000000000400000-0x0000000000533000-memory.dmp

Download

memory/4124-12-0x0000000003420000-0x000000000351A000-memory.dmp

Download

memory/4124-21-0x0000000003420000-0x000000000351A000-memory.dmp

Download