Analysis
- max time kernel
148s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 12:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Türkcescript.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Türkcescript.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target Türkcescript.exe
- Size 2.3MB
- Sample260723-pmjf2scl9v
- SHA256 89a6bdafbcc3a5835e48596104935bd2144ccf210f4b80a5b5b877ec232806e1
- MD5 ab155088ffe67a0900e1deebd48674c0
- SHA1 b65fb30f96504a0c9b7202fa68203bf2325fefa0
- SHA512 ab8fef1883b9633b8a7a9dc645c7b5c55bf918555c6f80cd557b3baa04f35e89cfd310203764e512a78fa9c907a03f41a3e97e0c938644b69567e174bd45eec0
- SSDEEP 49152:URm8Fga4K94LrdNrm1BooiAAaoZrNLroDdg1UcpfFBYy4Ckt:TaX9gdNrmiraaR8Ddg1hNBC
- TLSH T192B53309B2E941F7E9B50B7090A5173B2B32DD75110169F7A72CFAA74D31BE44B07293
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Türkçe Script\aGRaSif\Kick.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\icon\Liste.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\playlist.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\Resims\Resims\Candy.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\Resims\Resims\oyun.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\Sounds\Ban.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\SysTxt\swear.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\control.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\dll\bars.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\oyun\Sevecenforce.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\Resims\kolaymirc.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\Resims\Lock.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\oyun\Sevecentavla.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\Popups.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\channels.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\icon\gorunum.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\icon\oyunlar.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\logs\#Sohbet.KELEBEK.ORG.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\logs\#Sohbet.Sohbet.Net.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\Resims\Resims\eglence.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\aGRaSif\aa.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\dll\Aniwin.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\dll\nHTML.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\icon\Ayarlar.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\Resims\help.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\Resims\Resims\carkifelek.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\scripts\aliases.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\scripts\script2.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\aGRaSif\Login.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\icon\internet.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\logs\#Sohbet.EkeLebek.Net.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\logs\#Sohbet.Sohbetyeri.Org.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\Mynet.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\oyun\Sevecenblock.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\scripts\vars.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\Servers.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\dll\RebaR.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\icon\kanal.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\logs\#Sohbet.KolayMirc.Org.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\Resims\Resims\Lock.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\Resims\yan.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\script3.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\scripts\script1.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\Sounds\Online.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\aliases.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\kullanici.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\logs\#Sohbet.ChatTur.Com.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\logs\#Sohbet.irc.Sohbetyeri.Org.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\logs\#Sohbet.Laubali.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\logs\#Sohbet.UNet.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\Mirc.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\oyun\Sevecenkayak.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\remote.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\Resims\Resims\radyo.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\script2.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\SysTxt\yazi.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\aGRaSif\Guzel.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\dll\nHTMLn_2.95.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\dll\Tema.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\icon\yardým.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\oyun\AFORCE.$$A Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\Resims\Resims\mIRC.$$A Türkcescript.exe File opened for modification C:\Program Files (x86)\Türkçe Script\Uninstal.exe Türkcescript.exe File created C:\Program Files (x86)\Türkçe Script\aGRaSif\Supper.$$A Türkcescript.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Türkcescript.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Türkçe Script\Mynet.exe
- Size 1.8MB
- SHA256 a2da0d5698d9d501c1ceef12935f0a7c40a336a5e4432efc3d752871d3db8cb9
- MD5 e32c0f45d559e39552fbbb52da0e3393
- SHA1 e94524fc9be56f5a0603222dbf6c6b14d40f7ec3
- SHA512 2b4781882f456db8d7641e775957320aa09051c912e2608bced1eb42c5845da1ffb7479f7657355f75a73f4602c754319077f521fa259534f7012d99de735fcf
- SSDEEP 24576:ft+PGXJIYJgv8E32bpXnKKLA3FEQTdHUOD0/WkdmKaMaOhhpQP:lJXJQ32l3tLtIHXAOkdm
- TLSH T119856C02E2D14473ECA3033118611B716AFABF34273AA6DB96217D652DB1752DF2932F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Türkçe Script\Resims\Resims\mIRC.$$A
- Size 24KB
- SHA256 996eea643892bb7455a541782b004820a3ca9839348f40c4b0085183cef3e86d
- MD5 a41bc6483f185bd6bec1e7bb65423db5
- SHA1 f9a7bf81f0cca3b1137d962b7aefe9fab993db7c
- SHA512 8ecca211a808ed86b7efcccae40b018d88aef25d99cef139112070e5f71da33de3c93c55cf80059f3425fe1984250ed3aac2fad68922a00ad5c380ef176f72bb
- SSDEEP 384:UhfI2WYX3ISKz9suGmN9Npyo8en+LutqlrBVyrfBaXA4:Og4XKnGmNzpyGn+SItVUfBU
- TLSH T17AB21715BB00C881C4AB4274DC87CBF46620BC66ED305E73B7D17F9F3E71981A50929A
- MD5 SHA1 SHA512 SSDEEP TLSH