bfb0f512afa98eadc9ec5b16012dd24a48ec9401da81602dbce701e7a7ae4d57

Analysis

user interaction
yes
max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Kod.exe
Size 98KB
Sample260721-dev94ads4n
SHA256 bfb0f512afa98eadc9ec5b16012dd24a48ec9401da81602dbce701e7a7ae4d57
MD5 59c3fabb1625c7574c7ce75620c59b33
SHA1 47903d0929fe0236a243bd31d64fc3228bd1e998
SHA512 1b52a220cb7ebd9f88cef89098b4b7eb55d335402b56483fc43282648561431ca47ee1b51f6d008894aa805f753149a37f6c123eec24cb2d5af368ee7b6dbcc6
SSDEEP 1536:0jkmo+6QLU11z3yJa6E0OImpj3oO2tsWZTLKM7iZOyEsq+g:f+1LUHyJa8UotHZ+vnHq
TLSH
T103A3092B9A56507DE1A5CABDC9C78D41DB327C8A47916BCF43800DF24EA56D0AF3E603
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

ransomware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
7	discord.com
13	discord.com

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5604	NOTEPAD.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1656	explorer.exe

C:\Users\Admin\AppData\Local\Temp\Kod.exe
"C:\Users\Admin\AppData\Local\Temp\Kod.exe"
1⤵
PID:3332

C:\Windows\explorer.exe
"C:\Windows\explorer.exe" shell:::{52205fd8-5dfb-447d-801a-d0b52f2e83e1}
1⤵
PID:6080

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1656

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5424

C:\Users\Admin\AppData\Local\Temp\Kod.exe
"C:\Users\Admin\AppData\Local\Temp\Kod.exe"
1⤵
PID:2764

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\bot_log.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bot_log.txt

Path C:\Users\Admin\AppData\Local\Temp\bot_log.txt
Size 178B
SHA256 cd0c87bba89bf1c0d9bccaa793ab319bb497fea6235d212260c04d41006fc4b1
MD5 49160db4833c5994a4a12555546e545e
SHA1 3e502885924ee61448ddcde20f48ad1ab2a6857a
SHA512 6042b6b66d7ecf7bd74fbc90c8e8d50bb56a6f26b3e33dc7d6b3666454548ca560d42e2ec61f490c4706a354c4c9dda83d009664ed4345fa39e39f27b9b864b0
TLSH
T10DC012F4060010530260449BF1462CCADD002317A4470D0183F167C7268D90BA751E25
MD5 SHA1 SHA512 TLSH

Submit Download