b485dd320d7eaf9d100030ca5b6d1e5d1f29647cf93ba49605fe6f3a26bf89e6

Analysis

max time kernel
29s
max time network
38s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/05/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
build.exe
Size 216.0MB
Sample260523-e1zp3sfw2w
SHA256 b485dd320d7eaf9d100030ca5b6d1e5d1f29647cf93ba49605fe6f3a26bf89e6
MD5 070812cd4790743ee5b24fbb28ec41b4
SHA1 bfb08840d1cdcff24d93538edca56bd4e3d2a802
SHA512 7cce604ebd7304922e0ffc432b52205f723929271547dcb8d49c1dab9ecc6df893005453de14571be91d12a680e73259af78494321a47949b791ffe2c3fed681
SSDEEP 1572864:1XuGYpqqn71DjiJKfgwVsLc2mHpCavVnbJ81bmHG3ZFsr0Wqbg6WpknAbIZfwWl5:IG6eLjPBI
TLSH
T1EDB88B03E29A02D9C05DD1B59B5A9633FEB1B8454B24B3DF2B5407522F66EF82B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	build.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	discord.com
4	discord.com

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build.exe

Suspicious use of AdjustPrivilegeToken 58 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3272	build.exe
Token: SeCreatePagefilePrivilege	3272	build.exe
Token: SeShutdownPrivilege	3272	build.exe
Token: SeCreatePagefilePrivilege	3272	build.exe
Token: SeShutdownPrivilege	3272	build.exe
Token: SeCreatePagefilePrivilege	3272	build.exe
Token: SeShutdownPrivilege	3272	build.exe
Token: SeCreatePagefilePrivilege	3272	build.exe
Token: SeShutdownPrivilege	3272	build.exe
Token: SeCreatePagefilePrivilege	3272	build.exe
Token: SeShutdownPrivilege	3272	build.exe
Token: SeCreatePagefilePrivilege	3272	build.exe
Token: SeShutdownPrivilege	3272	build.exe
Token: SeCreatePagefilePrivilege	3272	build.exe
Token: SeShutdownPrivilege	3272	build.exe
Token: SeCreatePagefilePrivilege	3272	build.exe
Token: SeShutdownPrivilege	3272	build.exe
Token: SeCreatePagefilePrivilege	3272	build.exe
Token: SeShutdownPrivilege	3272	build.exe
Token: SeCreatePagefilePrivilege	3272	build.exe
Token: SeShutdownPrivilege	3272	build.exe
Token: SeCreatePagefilePrivilege	3272	build.exe
Token: SeShutdownPrivilege	3272	build.exe
Token: SeCreatePagefilePrivilege	3272	build.exe
Token: SeShutdownPrivilege	3272	build.exe
Token: SeCreatePagefilePrivilege	3272	build.exe
Token: SeShutdownPrivilege	3272	build.exe
Token: SeCreatePagefilePrivilege	3272	build.exe
Token: SeShutdownPrivilege	3272	build.exe
Token: SeCreatePagefilePrivilege	3272	build.exe
Token: SeShutdownPrivilege	3272	build.exe
Token: SeCreatePagefilePrivilege	3272	build.exe
Token: SeShutdownPrivilege	3272	build.exe
Token: SeCreatePagefilePrivilege	3272	build.exe
Token: SeShutdownPrivilege	3272	build.exe
Token: SeCreatePagefilePrivilege	3272	build.exe
Token: SeShutdownPrivilege	3272	build.exe
Token: SeCreatePagefilePrivilege	3272	build.exe
Token: SeShutdownPrivilege	3272	build.exe
Token: SeCreatePagefilePrivilege	3272	build.exe
Token: SeShutdownPrivilege	3272	build.exe
Token: SeCreatePagefilePrivilege	3272	build.exe
Token: SeShutdownPrivilege	3272	build.exe
Token: SeCreatePagefilePrivilege	3272	build.exe
Token: SeShutdownPrivilege	3272	build.exe
Token: SeCreatePagefilePrivilege	3272	build.exe
Token: SeShutdownPrivilege	3272	build.exe
Token: SeCreatePagefilePrivilege	3272	build.exe
Token: SeShutdownPrivilege	3272	build.exe
Token: SeCreatePagefilePrivilege	3272	build.exe
Token: SeShutdownPrivilege	3272	build.exe
Token: SeCreatePagefilePrivilege	3272	build.exe
Token: SeShutdownPrivilege	3272	build.exe
Token: SeCreatePagefilePrivilege	3272	build.exe
Token: SeShutdownPrivilege	3272	build.exe
Token: SeCreatePagefilePrivilege	3272	build.exe
Token: SeShutdownPrivilege	3272	build.exe
Token: SeCreatePagefilePrivilege	3272	build.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 4812	3272	build.exe	88
PID 3272 wrote to memory of 1932	3272	build.exe	89

C:\Users\Admin\AppData\Local\Temp\build.exe
"C:\Users\Admin\AppData\Local\Temp\build.exe"
1⤵
- Checks computer location settings
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Users\Admin\AppData\Local\Temp\build.exe
  "C:\Users\Admin\AppData\Local\Temp\build.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\build" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1888,i,5531833293179021213,12174871290007994181,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1892,i,14354183467270629471,15926396861717114381,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:4812
- C:\Users\Admin\AppData\Local\Temp\build.exe
  "C:\Users\Admin\AppData\Local\Temp\build.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\build" --field-trial-handle=1888,i,5531833293179021213,12174871290007994181,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1892,i,14354183467270629471,15926396861717114381,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2080 /prefetch:3
  2⤵
  PID:1932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads