67dc2a7036860a68e5312c212c31b8772ac463ed0289fcc44897867f55075e89

Analysis

max time kernel
148s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/07/2026, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Oldblturer.exe
Size 168.6MB
Sample260712-rbq3vsbs3l
SHA256 67dc2a7036860a68e5312c212c31b8772ac463ed0289fcc44897867f55075e89
MD5 fbe2635ee2c0e774247127b54371b343
SHA1 e1b2434bc210206da2e8f6f442c11de19b87a11d
SHA512 2832fd5f238aa5d2b7c4ce3bfc81c71a3ea764ca596cc360fbd08270e1a885a9b5a2c6d21912d902997f70c675e6212cb0c755ddd6890becf22959205d9c06c6
SSDEEP 1572864:vOhiqBPiJU33xaD1gWcdcMPEDCNCgDX0Bf+NNvTPQYhl49RIuKj53fHcTLNKJF96:DgmeNxNNZxqV
TLSH
T1E2887B13F29651D8F09DD1B18B578236EA72B8460738A6DF2754172A2F77FE02B39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
724	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	Oldblturer.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4900	WMIC.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
724	powershell.exe
724	powershell.exe
724	powershell.exe
724	powershell.exe
724	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3676	Oldblturer.exe
Token: SeCreatePagefilePrivilege	3676	Oldblturer.exe
Token: SeDebugPrivilege	724	powershell.exe
Token: SeShutdownPrivilege	3676	Oldblturer.exe
Token: SeCreatePagefilePrivilege	3676	Oldblturer.exe
Token: SeShutdownPrivilege	3676	Oldblturer.exe
Token: SeCreatePagefilePrivilege	3676	Oldblturer.exe
Token: SeShutdownPrivilege	3676	Oldblturer.exe
Token: SeCreatePagefilePrivilege	3676	Oldblturer.exe
Token: SeShutdownPrivilege	3676	Oldblturer.exe
Token: SeCreatePagefilePrivilege	3676	Oldblturer.exe
Token: SeShutdownPrivilege	3676	Oldblturer.exe
Token: SeCreatePagefilePrivilege	3676	Oldblturer.exe
Token: SeShutdownPrivilege	3676	Oldblturer.exe
Token: SeCreatePagefilePrivilege	3676	Oldblturer.exe
Token: SeShutdownPrivilege	3676	Oldblturer.exe
Token: SeCreatePagefilePrivilege	3676	Oldblturer.exe
Token: SeShutdownPrivilege	3676	Oldblturer.exe
Token: SeCreatePagefilePrivilege	3676	Oldblturer.exe
Token: SeShutdownPrivilege	3676	Oldblturer.exe
Token: SeCreatePagefilePrivilege	3676	Oldblturer.exe
Token: SeShutdownPrivilege	3676	Oldblturer.exe
Token: SeCreatePagefilePrivilege	3676	Oldblturer.exe
Token: SeShutdownPrivilege	3676	Oldblturer.exe
Token: SeCreatePagefilePrivilege	3676	Oldblturer.exe
Token: SeShutdownPrivilege	3676	Oldblturer.exe
Token: SeCreatePagefilePrivilege	3676	Oldblturer.exe
Token: SeShutdownPrivilege	3676	Oldblturer.exe
Token: SeCreatePagefilePrivilege	3676	Oldblturer.exe
Token: SeShutdownPrivilege	3676	Oldblturer.exe
Token: SeCreatePagefilePrivilege	3676	Oldblturer.exe
Token: SeShutdownPrivilege	3676	Oldblturer.exe
Token: SeCreatePagefilePrivilege	3676	Oldblturer.exe
Token: SeShutdownPrivilege	3676	Oldblturer.exe
Token: SeCreatePagefilePrivilege	3676	Oldblturer.exe
Token: SeShutdownPrivilege	3676	Oldblturer.exe
Token: SeCreatePagefilePrivilege	3676	Oldblturer.exe
Token: SeShutdownPrivilege	3676	Oldblturer.exe
Token: SeCreatePagefilePrivilege	3676	Oldblturer.exe
Token: SeShutdownPrivilege	3676	Oldblturer.exe
Token: SeCreatePagefilePrivilege	3676	Oldblturer.exe
Token: SeShutdownPrivilege	3676	Oldblturer.exe
Token: SeCreatePagefilePrivilege	3676	Oldblturer.exe
Token: SeShutdownPrivilege	3676	Oldblturer.exe
Token: SeCreatePagefilePrivilege	3676	Oldblturer.exe
Token: SeShutdownPrivilege	3676	Oldblturer.exe
Token: SeCreatePagefilePrivilege	3676	Oldblturer.exe
Token: SeShutdownPrivilege	3676	Oldblturer.exe
Token: SeCreatePagefilePrivilege	3676	Oldblturer.exe
Token: SeShutdownPrivilege	3676	Oldblturer.exe
Token: SeCreatePagefilePrivilege	3676	Oldblturer.exe
Token: SeShutdownPrivilege	3676	Oldblturer.exe
Token: SeCreatePagefilePrivilege	3676	Oldblturer.exe
Token: SeShutdownPrivilege	3676	Oldblturer.exe
Token: SeCreatePagefilePrivilege	3676	Oldblturer.exe
Token: SeShutdownPrivilege	3676	Oldblturer.exe
Token: SeCreatePagefilePrivilege	3676	Oldblturer.exe
Token: SeShutdownPrivilege	3676	Oldblturer.exe
Token: SeCreatePagefilePrivilege	3676	Oldblturer.exe
Token: SeShutdownPrivilege	3676	Oldblturer.exe
Token: SeCreatePagefilePrivilege	3676	Oldblturer.exe
Token: SeShutdownPrivilege	3676	Oldblturer.exe
Token: SeCreatePagefilePrivilege	3676	Oldblturer.exe
Token: SeShutdownPrivilege	3676	Oldblturer.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 4208	3676	Oldblturer.exe	87
PID 3676 wrote to memory of 724	3676	Oldblturer.exe	88
PID 3676 wrote to memory of 1320	3676	Oldblturer.exe	89
PID 724 wrote to memory of 540	724	powershell.exe	91
PID 540 wrote to memory of 1640	540	csc.exe	92
PID 3676 wrote to memory of 1912	3676	Oldblturer.exe	95
PID 3676 wrote to memory of 3532	3676	Oldblturer.exe	96
PID 1912 wrote to memory of 4900	1912	cmd.exe	98
PID 3676 wrote to memory of 3940	3676	Oldblturer.exe	99
PID 3940 wrote to memory of 4916	3940	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\Oldblturer.exe
"C:\Users\Admin\AppData\Local\Temp\Oldblturer.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Users\Admin\AppData\Local\Temp\Oldblturer.exe
  "C:\Users\Admin\AppData\Local\Temp\Oldblturer.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\317_data_59jz7ftn" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1684 --field-trial-handle=1696,i,36134545152044321,276893857384722771,262144 --enable-features=kWebSQLAccess --disable-features=RendererCodeIntegrity,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
  2⤵
  PID:4208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -STA -ExecutionPolicy Bypass -WindowStyle Hidden -NoLogo -File C:\Users\Admin\AppData\Local\Temp\loader_1783866420734.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:724
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1qh1tpwo\1qh1tpwo.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:540
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC0BB.tmp" "c:\Users\Admin\AppData\Local\Temp\1qh1tpwo\CSC8CBB15C5CA8B409BA521B6617B6F92F.TMP"
      4⤵
      PID:1640
- C:\Users\Admin\AppData\Local\Temp\Oldblturer.exe
  "C:\Users\Admin\AppData\Local\Temp\Oldblturer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\317_data_59jz7ftn" --mojo-platform-channel-handle=2000 --field-trial-handle=1696,i,36134545152044321,276893857384722771,262144 --enable-features=kWebSQLAccess --disable-features=RendererCodeIntegrity,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
  2⤵
  PID:1320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name /value"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name /value
    3⤵
    - Detects videocard installed
    PID:4900
- C:\Users\Admin\AppData\Local\Temp\Oldblturer.exe
  "C:\Users\Admin\AppData\Local\Temp\Oldblturer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\317_data_59jz7ftn" --mojo-platform-channel-handle=2356 --field-trial-handle=1696,i,36134545152044321,276893857384722771,262144 --enable-features=kWebSQLAccess --disable-features=RendererCodeIntegrity,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
  2⤵
  PID:3532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name /value"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name /value
    3⤵
    PID:4916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1qh1tpwo.dll

Path C:\Users\Admin\AppData\Local\Temp\1qh1tpwo\1qh1tpwo.dll
Size 3KB
SHA256 d2299edaf606ae75ea610769a5ec7d68781ddf2c0d8a72bb8ffe4e06f31eca0a
MD5 a615803fa56a1ca070bafa868a8fee25
SHA1 e737da4048ddedf5c522826db73aa8fc0873c339
SHA512 d8eb75839b6b93644dc1a8780df6e91fb397c546b9e209313e557b34dcc9862a931ae38cf8524058b5ab4859aefa5b5e45a526f470572cfc0ab736801afbee9d
TLSH
T14A51F01667F94567E4770730AEE3436737B8F8509FB2976D4984022CAC50364AD36FB1
MD5 SHA1 SHA512 TLSH

Submit Download

317_debug.log

Path C:\Users\Admin\AppData\Local\Temp\317_debug.log
Size 496B
SHA256 286f32406aefab5315e76ead0f71f39540e82ae85e64f892ea42a6b1fafdc561
MD5 fd8551ea8573f00aecc7645b812aa7a7
SHA1 65e0c99d543500209d0b1e286d0f4b2dd0dfaaf4
SHA512 734b9689290536e3a609a2b505ca3a7e34551452dc01cbbf90dafff17a49a04b0e7d858a6e275cf735c15c45c4c1f1251729ed90dad49be41fcfbf64b4a68c1a
TLSH
T14AF0B48D7D9651D5CD8D401EC069CF2944DB7903AB4831C66654D04F83A74C77CE2C12
MD5 SHA1 SHA512 TLSH

Submit Download

RESC0BB.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC0BB.tmp
Size 1KB
SHA256 d3e904b243c42cb40bd9d608a0bfc321ff40fa0eabb3a07c2ad954fef529a34e
MD5 3b04e70a7a6f0478e9efa1a928e2f94a
SHA1 016589ec306ee7ee2fb2f38855f1d62c177442da
SHA512 10be914b38d3e53ee4f8875cccd944a5909f6c85ac8bc48cbe9f8034a21b7e74e9e90c5859e5b9ea199a6cccd8446ccd6bacff4ce9dd8a2d761c724c77abfdef
TLSH
T14821AF0553E9871FF073573169F6672F9239FD94EFA1939B8540412C1C51504EEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_dse3d2wq.dj3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dse3d2wq.dj3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

loader_1783866420734.ps1

Path C:\Users\Admin\AppData\Local\Temp\loader_1783866420734.ps1
Size 30KB
SHA256 009ca366bbf7148be0468629e57fd98074b596a02faf42975eabc2974c59d135
MD5 8f4bdb48fa4a519f91fdf1a9e8fe0476
SHA1 216bcc154e9340f942921472d17232b24e36858a
SHA512 c4f80a419f437da614d3d8aa2f82a6ee945ed2dfb2f26ef6772dcd655bae130ca213b9707b52c65309ed66dbc09cc79f37b589793dbb2f244942ad78644ee213
SSDEEP 192:pitgXyY6g/IH4BtMyyBo70eHIep2ghmJBzBBpPFUDjuy7f9TojcM1S/1Xj+Dyxdc:EtgVi0ANpPFUDjRcVXARb8
TLSH
T14CE29654A2FE0D29C3D3403A5BB17A007E2610B7931D9854B3DF83A8AF928A747B7DD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1qh1tpwo.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\1qh1tpwo\1qh1tpwo.0.cs
Size 209B
SHA256 8e989516e25af008eb9ce2645276000b480890e55fa001a50f3eebbddfa23464
MD5 ddbeb10ddbefd09de0061465d3af002f
SHA1 d22a9e60e39101cfeb598c76984336e00926f7db
SHA512 d8155852e7d971370bf0330dfa45fff3801cbe68ef220a9dcfc20d38543e443368da43fe1e3ee20e2cc29209985c73064763fdcabe768b115f49d970fe7e06e8
TLSH
T17AD0231835F36DB0401348130C46F1FD77235137756D1905B7A50310DF4B01C4131E1A
MD5 SHA1 SHA512 TLSH

Submit Download

1qh1tpwo.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\1qh1tpwo\1qh1tpwo.cmdline
Size 369B
SHA256 cc66aa765980c9d44823f8426bc139094c1d9221d7c42135d0bab9659be15e28
MD5 8852ddae432d7e2c6c59e1b58abf0f19
SHA1 0c11d3260fa37348d7228449db76073603374d9c
SHA512 f9df528d3140b0bc8179a09251bf804ac194366943e308409f340a25851546c46fc0519f9e66e07acbdc7b3163ca980bf8f34599bf1b245fa231abb2b5579e22
TLSH
T145E0683B424AC3BD05DA201731A9D4FC93B6564739C13F849054440FD1174012BD2789
MD5 SHA1 SHA512 TLSH

Submit Download

CSC8CBB15C5CA8B409BA521B6617B6F92F.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\1qh1tpwo\CSC8CBB15C5CA8B409BA521B6617B6F92F.TMP
Size 652B
SHA256 f9ef9b5cf51fb79e8035c66b7cfda8115f130335ba7894ffe5c99dc8484b5fed
MD5 6e48d6a8c2b3e542c99055e16fc6462b
SHA1 e9136c616ab579719c9d1fb3429dc0517f9e3f42
SHA512 493b488c715498fdb527d64068fe3de31f32055a4d80f7fb3c3548866401d622593d161b0eadffbbf1531d0e8cad2c5cfa188ab240ba213c0ba194f2d1a25cd6
TLSH
T1C7F05E0963F8420EF0F35B30BEF6936391ACBC64DE3293ED5440032D68645109962FB6
MD5 SHA1 SHA512 TLSH