d4ac5b3c525a5fd94019d80ff81b552e73b19b1bd0a554b9609cdd5e1b00955a

Analysis

user interaction
yes
max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 03:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rkill.exe
Size 1.7MB
Sample260810-dsdl7szfrd
SHA256 d4ac5b3c525a5fd94019d80ff81b552e73b19b1bd0a554b9609cdd5e1b00955a
MD5 6d622dcc87edc9a7b10d35372ade816b
SHA1 47d98825b03c507b85dec02a2297e03ebc925f30
SHA512 ed06f872a7c66ffeeb8cb8f6fedca06ccabf623f9cd188c4c7105428e8d6521ef8da0bac0564e14d2da914d2846369a9c04577a8cf7fb80cb62831e5497f2a58
SSDEEP 49152:KpEsgw14kZV2HXsMnmjEREseBSsxHnfXsrHYi2Yijig:0wYJYW
TLSH
T1A0857C2177E90274F2B3CA709975C222D5B5B8626F32D7CF42911A1D1E37ED09E36B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	rkill64.exe

Executes dropped EXE 1 IoCs

pid	Process
4940	rkill64.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rkill.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4940	rkill64.exe
4940	rkill64.exe
4940	rkill64.exe
4940	rkill64.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4192	rkill.exe
Token: SeDebugPrivilege	4940	rkill64.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 4940	4192	rkill.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\rkill.exe
"C:\Users\Admin\AppData\Local\Temp\rkill.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Users\Admin\AppData\Local\Temp\rkill64.exe
  C:\Users\Admin\AppData\Local\Temp\rkill.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rkill64.exe

Path C:\Users\Admin\AppData\Local\Temp\rkill64.exe
Size 964KB
SHA256 797f0917162e74e64f556fd467cc13d10401e826309c3ed889574889a96b88c7
MD5 ae368c10327fe7a8e5c875360e529b35
SHA1 d69fad67631f48f2eee9109a368eb176356da531
SHA512 e7e6e4d29dfdc537b21fdffc6c1ac0674b55fdf6c61e5fecfbdde1fa271903db1291c50bac3263bc9f4ee7797689542f29770e0d98b8180453c39bc6058a5c67
SSDEEP 24576:g+3UZV2HXsMnmjERERaUYCmoOOzKBKs/pvViM9U3U8oqBSsxHnm1NkMRvYHFSzMD:1kZV2HXsMnmjEREseBSsxHnfXsrHYiC
TLSH
T1ED256C6677E802F4F277C63589B58112E6F17856AB31D7CF01A1061E1F37EA48E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rkill.txt

Path C:\Users\Admin\Desktop\Rkill.txt
Size 514B
SHA256 e9c8cf38684857899952f0586bb9228a6ab774cd54889559b702c8541d550bf3
MD5 e0704cb59042066f157ad8b4fae06481
SHA1 be61d968ab7b8395023b8cc4d79c26ef4bac4e07
SHA512 cc2e5fbd689c4fa9a2b2b4da7a2f0f654c8ff815c2dd7f5591f5233ed8fa53b75eb94ccb5dc32df94ea332d6c9c5672d25c6687da1f4746b18d2e4f74570cc44
TLSH
T1D4F0EC123BFA4645F1F727596CF620D6DAB97F23B83CD64C02E1050C01F99415900BB3
MD5 SHA1 SHA512 TLSH

Submit Download