8b64258249dc34d1d7c68324735323190c949f3d9766122676bf7051afc3310d

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/07/2026, 06:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$_3_.exe
Size 1.8MB
Sample260710-gzedvsfx2v
SHA256 8b64258249dc34d1d7c68324735323190c949f3d9766122676bf7051afc3310d
MD5 27dbebefac44d6947bc6fcc5e7b662da
SHA1 872239b048d6b9f889e3f538b8c909c99f182790
SHA512 bde18aed3250028a6977e555cf094f26be3b31f2053a5e7ec0e2b576255418dcaa453a9e2e8a84c22461fd049128204a6696a1604200cce5674d4878698cb1e3
SSDEEP 49152:pnGcxOUi39yHebZTcNHTXpSliV2s1/ctYmwYDdd:pNYymZZP
TLSH
T193858C92F682C031D5A10572D078D6FE807A6F74E321A9E753DC3EA629319C1E939F72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	$_3_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	$_3_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1376	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1376	PING.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2832	$_3_.exe
2832	$_3_.exe
2832	$_3_.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 3056	2832	$_3_.exe	89
PID 3056 wrote to memory of 1376	3056	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\$_3_.exe
"C:\Users\Admin\AppData\Local\Temp\$_3_.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\18306.bat" "C:\Users\Admin\AppData\Local\Temp\34CAB1536F9540399E69700DAA871D98\""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 1000
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

18306.bat

Path C:\Users\Admin\AppData\Local\Temp\18306.bat
Size 212B
SHA256 cdb93994093a24991c246d8b6f7003920a510a45bfc8441521314ce22a79191d
MD5 668767f1e0c7ff2b3960447e259e9f00
SHA1 32d8abf834cce72f5e845175a0af2513b00504d8
SHA512 c07f26c8601cf91d9805004668463721ab91e14f3cc59e77e20f43d98e070ea8e742c38fe8021c4ffb1ebc02e3743ab732b66ff84bb24b59a5fdcc8634c77680
TLSH
T188D0C98EBBA5785F4A1A429722D28506470CF0490D57A2C6113068EEBF05A61AABBDC2
MD5 SHA1 SHA512 TLSH

Submit Download

34CAB1536F9540399E69700DAA871D98_LogFile.txt

Path C:\Users\Admin\AppData\Local\Temp\34CAB1536F9540399E69700DAA871D98\34CAB1536F9540399E69700DAA871D98_LogFile.txt
Size 9KB
SHA256 b820408e5f1f1b16bbffe680700a51af8d0c83add852e028c992651ec228e341
MD5 0b07fad1fae35fdda565f79821e4c5c0
SHA1 e82fab3bf0aee9101d5b156d5eae78881ccec225
SHA512 d38a9eb8728d31acfc70f532546fd70f271ea7503b405f7d22f99e06cba30351424f7976f4d1088d2877469ef257b9c82d846f297aa5ddd20544f57ec8a971bf
SSDEEP 192:mBB9BmBuBmBtDBfBtyBEBpBf/cBvrBnlBCBJBhBmBq:mB/BmBuBmBtBfBYBEBpBf/cBvrBlBCBz
TLSH
T1D5126D7A4706D0ED518514BFE038CFCA3368495FAE74AA58EF2B02C476DDB91DA2B5C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

34CAB1~1.TXT

Path C:\Users\Admin\AppData\Local\Temp\34CAB1536F9540399E69700DAA871D98\34CAB1~1.TXT
Size 54KB
SHA256 e5a68b83349e781f2c56459ac2fd3ca4b4f6a1ed146112a4e24564d9bcc2b5bf
MD5 841b88786e35e4588e8fec1db49f818b
SHA1 8d8d12937efd56b7b85e5edb94b6a17c7269d328
SHA512 580867aa9bf6a303646c0d02025e90b7c8a9e69f9731318b9dd960343a90e2b5deb007ad423421fbf4c7c3848789b4d2d0f1c0b4673fe5a6bc73489b328894be
SSDEEP 768:mB/BmBuBmBtBfBYBEBpBfUBvrBlBCBJBhBmBPBZBLBHBkBP+BPdBABaB1BABUBaN:YZ3h9VzhYR
TLSH
T1F843957A4646D1FD418518BFA038CFC63364459FAE70A668EF2B01C4B6EDB919B2F4C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2832-61-0x0000000003650000-0x0000000003651000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads