6bddf59e2a5065255cfc90d2e2e66e3bfd4a7cbf4e0b6341b4da93b574cc4f53

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6bddf59e2a5065255cfc90d2e2e66e3bfd4a7cbf4e0b6341b4da93b574cc4f53.exe
Size 63KB
Sample260808-ltppvsdj5y
SHA256 6bddf59e2a5065255cfc90d2e2e66e3bfd4a7cbf4e0b6341b4da93b574cc4f53
MD5 edc363b70430949e73fcbd0dd1cf5f18
SHA1 798464efe355b352b1f8c42ac912b4e5b925dc74
SHA512 b19efb5b45a9844126cb88a379af2b51d4db61baaed5de977069dae3723fe9033f4c924cc055d2066d8a6bd6f6af4850aaa528f3ae60ab702df6814737667a50
SSDEEP 768:i6gjnkiPE8T8sEhhAwFnJJy8WY293ouz1ySYXN2aoeqAqy50N+UiRnqpq32g:LInk62RzDnNA3p1yjcye1iIpq32g
TLSH
T19953E11BB39348DED62BC575D3F35F38F9B0F82146915B3C46A0E4790E30A686AA2F11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4992	powershell.EXE

Downloads MZ/PE file 4 IoCs

flow	pid	Process
11	4628	svchost.exe
19	4628	svchost.exe
30	2812	svchost.exe
32	2812	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	6bddf59e2a5065255cfc90d2e2e66e3bfd4a7cbf4e0b6341b4da93b574cc4f53.exe

Executes dropped EXE 4 IoCs

pid	Process
4628	svchost.exe
3960	stealer.exe
472	hvnc.exe
2812	svchost.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4992	powershell.EXE

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
2480	certutil.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
12	ipinfo.io
28	ifconfig.me

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2224	cmd.exe
1212	cmd.exe
4224	cmd.exe
3128	cmd.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	hvnc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	hvnc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2816	schtasks.exe
4548	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2540	powershell.exe
2540	powershell.exe
4992	powershell.EXE
4992	powershell.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2540	powershell.exe
Token: SeDebugPrivilege	4992	powershell.EXE

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 2224	1016	6bddf59e2a5065255cfc90d2e2e66e3bfd4a7cbf4e0b6341b4da93b574cc4f53.exe	86
PID 2224 wrote to memory of 2816	2224	cmd.exe	88
PID 1016 wrote to memory of 1212	1016	6bddf59e2a5065255cfc90d2e2e66e3bfd4a7cbf4e0b6341b4da93b574cc4f53.exe	91
PID 1212 wrote to memory of 4100	1212	cmd.exe	93
PID 1212 wrote to memory of 3540	1212	cmd.exe	95
PID 4992 wrote to memory of 2480	4992	powershell.EXE	97
PID 4992 wrote to memory of 4548	4992	powershell.EXE	98
PID 4992 wrote to memory of 5044	4992	powershell.EXE	99
PID 4992 wrote to memory of 5068	4992	powershell.EXE	101
PID 4628 wrote to memory of 3960	4628	svchost.exe	102
PID 4628 wrote to memory of 472	4628	svchost.exe	103
PID 4628 wrote to memory of 4224	4628	svchost.exe	107
PID 4224 wrote to memory of 1732	4224	cmd.exe	109
PID 2812 wrote to memory of 3128	2812	svchost.exe	112
PID 3128 wrote to memory of 2548	3128	cmd.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6bddf59e2a5065255cfc90d2e2e66e3bfd4a7cbf4e0b6341b4da93b574cc4f53.exe
"C:\Users\Admin\AppData\Local\Temp\6bddf59e2a5065255cfc90d2e2e66e3bfd4a7cbf4e0b6341b4da93b574cc4f53.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c "schtasks /create /tn "S0" /tr "powershell -ep bypass -f C:\Users\Public\setup.ps1" /sc once /st 00:00 /it /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "S0" /tr "powershell -ep bypass -f C:\Users\Public\setup.ps1" /sc once /st 00:00 /it /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\run.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Windows\system32\schtasks.exe
    schtasks /run /tn S0
    3⤵
    PID:4100
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn S0 /f
    3⤵
    PID:3540

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2540

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -ep bypass -f C:\Users\Public\setup.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\system32\certutil.exe
  "C:\Windows\system32\certutil.exe" -decode C:\Users\Public\l.cer C:\Users\Public\svchost.exe
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2480
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /create /tn MU /tr C:\Users\Public\svchost.exe /sc once /st 00:00 /it /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4548
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /run /tn MU
  2⤵
  PID:5044
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /delete /tn MU /f
  2⤵
  PID:5068

C:\Users\Public\svchost.exe
C:\Users\Public\svchost.exe
1⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Users\Public\stealer.exe
  C:\Users\Public\stealer.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Users\Public\hvnc.exe
  C:\Users\Public\hvnc.exe
  2⤵
  - Executes dropped EXE
  - Enumerates system info in registry
  PID:472
- C:\Windows\system32\cmd.exe
  "cmd" /C "reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"SecurityHealth\" /t REG_SZ /d \"C:\Users\Public\svchost.exe\" /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Windows\system32\reg.exe
    reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"SecurityHealth\" /t REG_SZ /d \"C:\Users\Public\svchost.exe\" /f
    3⤵
    PID:1732

C:\Users\Public\svchost.exe
"C:\Users\Public\svchost.exe"
1⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\system32\cmd.exe
  "cmd" /C "reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"SecurityHealth\" /t REG_SZ /d \"C:\Users\Public\svchost.exe\" /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Windows\system32\reg.exe
    reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"SecurityHealth\" /t REG_SZ /d \"C:\Users\Public\svchost.exe\" /f
    3⤵
    PID:2548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 95f26d33133b899aedc96601ce5fb567ee5ef33502d0623bd118b90107c4e67c
MD5 2e1443884f4c107b4a5629037d48bf76
SHA1 36fd3962a086584f04740939e4ac69c3ff486f69
SHA512 143853dbfeb0029d1a3acf0e107a7e6b58af08467cca107cdc551fd152e0e915c06924ee87011dd0f8aa44caf49b8feb9d59f15341447a82a579bf27de67b17f
SSDEEP 1536:GYaC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5d:GYaC+jH04tAHk1cMrxyNhftflJdvYoFw
TLSH
T1C3334093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ruultd4c.wpr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ruultd4c.wpr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

hvnc.exe

Path C:\Users\Public\hvnc.exe
Size 1.9MB
SHA256 278762dfc0f743216a475919bdc9ecc59735bcc247bba5b7b468fc475407ec6a
MD5 f2ea42022380a711dcbbef1e699bb5d4
SHA1 86f6d64c4bbbe4521955f2e3fb21d07547ebab60
SHA512 815caed039fe3b9bd42c972ca20cb5c2478b605ff0f2bcdb87fa02a7caa0d064b5505b1d0b419808d0ee691268544f5ad8c040312804d99619d00dbaec73201f
SSDEEP 49152:62hv4e6rZPZVSEYf4PE2UFQeWtSCYsx+cOUmfihAEcm3Y2:TAGUEZn4+cM6hAgo2
TLSH
T1D1957C07E2A350ECC56BC174875BA772BE31B81901357DBF56A4CB302F51E606B6EB28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

l.cer

Path C:\Users\Public\l.cer
Size 5.4MB
SHA256 c348ab31e68e5888af45d1207c97cfe295ed2b44510e041e5dfae71b12e11052
MD5 d7824c4e9dc9a4cd7bb7ccfccbd06dcd
SHA1 2453527f10634ae18750ec49041b5f015d4b2f71
SHA512 145c1963213bb79d41be83dcf889d0b08f5ccfe448d340f7d7b83c1699818bc5be3cc58f9352812f2c877bbda84a815be910ddb6cc3184eb4368c1a2e8a3746e
SSDEEP 49152:15udcIPYw8DbMzFpFS4bxkx6+08G17ad8ThfG:d
TLSH
T12D469EB702AFB9AD39641D42E00226565CAE374F6669E506F8C838FE63FD190CD08F75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run.bat

Path C:\Users\Public\run.bat
Size 91B
SHA256 e7bda7016054deebfe6de8d9df7a7f650453271e599c768a105dfef15aa7841b
MD5 da39d275ee0f6473286a5ff8deee44d9
SHA1 8d4d806447d5498b104723e3083bcaecb21533c7
SHA512 dab146ffde53b92e517cbe9ffb91577f9db7f73584cf0c907cc626d323e93b646c77b5e15f894f6cc3a01834a242ce70cbc9d4142bec35710e71be81e82f0750
TLSH
T1D5B0121764429C1418006C435E8F00377CEC10D120054345D15700F8448D8651477572
MD5 SHA1 SHA512 TLSH

Submit Download

setup.ps1

Path C:\Users\Public\setup.ps1
Size 339B
SHA256 6aef80514237808dfe25621a8912422d20a8414bc2054008a119e541166821b5
MD5 50c69c5bfdeef55e496249ef96bd7137
SHA1 ce20daec709d4827377dfdc711040e2b5ce3c050
SHA512 1de4348a87f712eddcf69331edf0928ba472b9600030079fa8c606f1f48d65be8f57a2162a02274d4583c78ee48903bc3ed90c8a6676a36b649945a78d9b5d6c
TLSH
T178E020250981C5577D8051830272511B6CF5103D295E2BF08F6B1C7C504AD7B329F212
MD5 SHA1 SHA512 TLSH

Submit Download

stealer.exe

Path C:\Users\Public\stealer.exe
Size 6.3MB
SHA256 d0f0734d4e31ec126da43a46896d0cd761e5532c0c385db6226cc5a6927d7722
MD5 ed9cd259602788d5d1ea1dcda422acbb
SHA1 d0f8797766ed74a021aaa7fd72f2f94d1780d02d
SHA512 77191c8ab504ca98eee56a64df9f844cae8b000057be24ae5f98d20798eb7875066270925b3528d4068f8a60822afa2e8b8b51ce337729f3203e31d357d8a213
SSDEEP 98304:5BHQDmpLeZ2gJC3/R6djtc6tvMu4t4xpDts6jMdURy5+Hi:r2po3evA/VUK/
TLSH
T13E666B53F6A390ECC16AC1B4835AA232FE32B84945317AAB57D4CB313E52F506F1DB19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Public\svchost.exe
Size 4.0MB
SHA256 7cb59abaa268ac66461447773d46bb0b0e5e2568e35e1a8f1d07ac2ec57f67a6
MD5 90e91b699ed457abdfbb0c3f30ed366f
SHA1 761b0e43db475700943255ca906c9156f16258cf
SHA512 6e665e7c0cb75dd249c2610d58e66950fcecc8c553fdb1cb5600e79ba57df13795d4409870f080a3e8abcadd9936e92cdf97ee59e0b85fed57a6d56ac67124a6
SSDEEP 49152:6dGMuBMd58ZZMsAeoKSHAZPYAfvcfjsPT9rSJCKgETsdFmUthrx5MxrTdRC1ZIUB:+sM16oxAxLcUMjsdFmUQd5+sC1
TLSH
T1B2164A43E66290FCC16AC0788356B632FF32BC8945327AAB57E48B313E65F506B1DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/472-87-0x00007FF6B6E70000-0x00007FF6B7055000-memory.dmp

Download

memory/472-81-0x00007FF6B6E70000-0x00007FF6B7055000-memory.dmp

Download

memory/1016-15-0x00007FF73F790000-0x00007FF73F7A8000-memory.dmp

Download

memory/2540-16-0x000001AB1C750000-0x000001AB1C7C6000-memory.dmp

Download

memory/2540-26-0x000001AB1C190000-0x000001AB1C1A0000-memory.dmp

Download

memory/2540-3-0x000001AB1C190000-0x000001AB1C1A0000-memory.dmp

Download

memory/2540-27-0x000001AB1C190000-0x000001AB1C1A0000-memory.dmp

Download

memory/2540-12-0x000001AB1C680000-0x000001AB1C6C4000-memory.dmp

Download

memory/2540-2-0x000001AB1C190000-0x000001AB1C1A0000-memory.dmp

Download

memory/2540-9-0x000001AB1C7D0000-0x000001AB1C7F2000-memory.dmp

Download

memory/2812-83-0x00007FF7A07C0000-0x00007FF7A0BBF000-memory.dmp

Download

memory/3960-86-0x00007FF695230000-0x00007FF69587B000-memory.dmp

Download

memory/3960-47-0x00007FF695230000-0x00007FF69587B000-memory.dmp

Download

memory/3960-82-0x00007FF695230000-0x00007FF69587B000-memory.dmp

Download

memory/3960-85-0x00007FF695230000-0x00007FF69587B000-memory.dmp

Download

memory/4628-42-0x00007FF7A07C0000-0x00007FF7A0BBF000-memory.dmp

Download

memory/4628-48-0x00007FF7A07C0000-0x00007FF7A0BBF000-memory.dmp

Download