Analysis
- max time kernel
148s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
17/08/2026, 03:48
General
- Target d4fca6b637494981077cb99b3cfc5571cbc8abecab6760d4d07d2b4db4db900b.exe
- Size 5.3MB
- Sample260817-ec5lessgmd
- SHA256 d4fca6b637494981077cb99b3cfc5571cbc8abecab6760d4d07d2b4db4db900b
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 22 IoCs
- Drops file in Drivers directory 9 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4fca6b637494981077cb99b3cfc5571cbc8abecab6760d4d07d2b4db4db900b.exe"C:\Users\Admin\AppData\Local\Temp\d4fca6b637494981077cb99b3cfc5571cbc8abecab6760d4d07d2b4db4db900b.exe"1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Windows\System32\drivers\DriverData\setup123.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\drivers\DriverData\patch.exeC:\Windows\System32\drivers\DriverData\patch.exe3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\s0fcpgow\s0fcpgow.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7AC.tmp" "c:\Users\Admin\AppData\Local\Temp\s0fcpgow\CSCA20EDAD7B83C4211A490FC74F6793D5.TMP"5⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\s0fcpgow\s0fcpgow.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES858.tmp" "c:\Users\Admin\AppData\Local\Temp\s0fcpgow\CSCF900F6AD4F2C4601B1EC8EE8E6EEA67.TMP"5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES7AC.tmp
RES858.tmp
s0fcpgow.dll
s0fcpgow.dll
s0fcpgow.pdb
s0fcpgow.pdb
acpidev.dat
usbcir.dat
patch.exe
setup123.bat
CSCA20EDAD7B83C4211A490FC74F6793D5.TMP
s0fcpgow.0.cs
s0fcpgow.0.cs
s0fcpgow.cmdline
memory/3800-129-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-109-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-44-0x0000021C6E370000-0x0000021C6E378000-memory.dmp
memory/3800-14-0x0000021C6E380000-0x0000021C6E390000-memory.dmp
memory/3800-47-0x0000021C6ED80000-0x0000021C6EDE6000-memory.dmp
memory/3800-169-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-173-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-171-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-167-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-165-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-163-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-161-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-159-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-157-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-155-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-153-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-151-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-149-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-147-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-145-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-143-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-139-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-137-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-135-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-133-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-131-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-13-0x0000021C53DF0000-0x0000021C53DF8000-memory.dmp
memory/3800-125-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-123-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-121-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-120-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-117-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-115-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-113-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-111-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-29-0x0000021C6E350000-0x0000021C6E358000-memory.dmp
memory/3800-107-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-105-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-103-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-101-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-99-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-97-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-95-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-93-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-91-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-89-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-87-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-85-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-83-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-81-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-79-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-77-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-75-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-73-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-71-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-69-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-67-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-65-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-63-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-61-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-59-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-57-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-55-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-53-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-51-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-49-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-48-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-141-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp
memory/3800-127-0x0000021C6ED80000-0x0000021C6EDE1000-memory.dmp