7650821185661c85453cc2027ca6241ed6ff5e4610760caa7412ea9c1457b12a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7650821185661c85453cc2027ca6241ed6ff5e4610760caa7412ea9c1457b12a.exe
Size 5.3MB
Sample260817-ee2bsaek2x
SHA256 7650821185661c85453cc2027ca6241ed6ff5e4610760caa7412ea9c1457b12a
MD5 5140fb63c1de794e3ae1270360c7fa5e
SHA1 fa4049b0366001bfeac69a520eab9d0e4f826993
SHA512 4ec8416332fc3c19d4a07ddeee61e5bf0b3976a0d2b8236899da1833ec1fe8b53e3ade40c5f376ea6f293e0c0f112635994f478f2598ce4fe9643b41c83becb4
SSDEEP 98304:8KAQ58Eek+V0VyZG1vCqLfWrtX6FmrH9HTk1hlWcsrpyPVb7pG:8o+kYZenotX6IrH9HTwbWub7pG
TLSH
T195462349E7A405FDE4A3D1B8DD820A17F7717C9907A19BDF13A0A9A21F233905E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\DriverData\patch.exe	cmd.exe
File created	C:\Windows\System32\drivers\DriverData\patch.exe	cmd.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	7650821185661c85453cc2027ca6241ed6ff5e4610760caa7412ea9c1457b12a.exe

Executes dropped EXE 1 IoCs

pid	Process
4368	patch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2588	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 2588	4748	7650821185661c85453cc2027ca6241ed6ff5e4610760caa7412ea9c1457b12a.exe	89
PID 2588 wrote to memory of 4368	2588	cmd.exe	92
PID 4368 wrote to memory of 4836	4368	patch.exe	93
PID 4836 wrote to memory of 440	4836	csc.exe	95
PID 4368 wrote to memory of 3368	4368	patch.exe	96
PID 3368 wrote to memory of 1504	3368	csc.exe	99

C:\Users\Admin\AppData\Local\Temp\7650821185661c85453cc2027ca6241ed6ff5e4610760caa7412ea9c1457b12a.exe
"C:\Users\Admin\AppData\Local\Temp\7650821185661c85453cc2027ca6241ed6ff5e4610760caa7412ea9c1457b12a.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\setup123.bat" "
  2⤵
  - Drops file in Drivers directory
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Users\Admin\AppData\Local\Temp\patch.exe
    patch.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4368
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pvxcinlv\pvxcinlv.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4836
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8826.tmp" "c:\Users\Admin\AppData\Local\Temp\pvxcinlv\CSCDF34189825E843C8AD547276377283DD.TMP"
        5⤵
        
        PID:440
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pvxcinlv\pvxcinlv.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3368
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8911.tmp" "c:\Users\Admin\AppData\Local\Temp\pvxcinlv\CSCBC48F60B7E014559BDEBC5D8C4D27A4.TMP"
        5⤵
        
        PID:1504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES8826.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8826.tmp
Size 1KB
SHA256 1b31d01d7676dd82e8a5b7d3a44091e0ef89f9f131c0f1b7f747f2f6cde76f5d
MD5 165108e35d62d44a93175069fc509fcd
SHA1 8bdc0843e3fe1bbe085a68252743924066715057
SHA512 1141ce808893c6c4624d86ff7abb002528bfb96f45d7b27d4768cf243e2059eba6ddade707a4def19b2569a9cbe64710226bc7f732a19bb003be74ea8d0c96a7
TLSH
T19521AF0457E94B1FF0B7573169F6035FA238FDA5EFA1935B854042281C51504EEE1F72
MD5 SHA1 SHA512 TLSH

Submit Download

RES8911.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8911.tmp
Size 1KB
SHA256 a0ca5000e0d2188f7c0527f711e3513c0b2ac12d37f13387421285f1bcea4dc8
MD5 d6ca6102723cdba09a2dfb4219c63a9f
SHA1 157713c1eb3cd5316bea727501739e89f07e6bca
SHA512 74865c0e89da76a1528a0f368fc17604af42a54b9c5534c1e9047ffbf9b4e8eaa92de8867bcc7d1ce7f15271ba55e6651f276b78c865f5b546c8f28468f8ea88
TLSH
T1D421AF0857E94B1FF0B3573179F6176F9228FDA4EFA1535A854042282C51644EEF0F72
MD5 SHA1 SHA512 TLSH

Submit Download

patch.exe

Path C:\Users\Admin\AppData\Local\Temp\patch.exe
Size 13KB
SHA256 9b5ff51fc4b10f91ea4248f73359a5ce042f837dd424200bfab167b4fb5feb85
MD5 c1430dc38192984a989a9c13d2f54d49
SHA1 3e746eb2b388daf2fa3dda4a8e6d3594b3ccf6af
SHA512 352787e136350cef5d109dbc5c6730240d752e33de65b2fe2114a1f3f72c44973fa290b3c0e0f10710ba4a03e83e5e072f2d294de10ff509d220db9c2104b436
SSDEEP 384:tRDvO1Ycn+9lrShtLU0a0/HFTWrk7+BL6OMMW:/7wGAE0I4Cs
TLSH
T1AF522954BBE88737DAF71B765C33105407B6FA016E22CF9E9CC5204A99A2F044756B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pvxcinlv.dll

Path C:\Users\Admin\AppData\Local\Temp\pvxcinlv\pvxcinlv.dll
Size 3KB
SHA256 3ac4cc60036b5aa8fb73e5b0a9592b8f2862487838f84edcdfcd7782a00378b3
MD5 f27d726fddb5a44c28337a2d32ef031a
SHA1 150ab1d0fe6d31bb5435122e5a6a9a5a36639a0b
SHA512 0b065005db0c4b5531b472ef3e4bd0a08f4429621fbaad958f12c4dbbb8574640b428a6134e916989cbc9fedd0374bceec9ce1332b6586ebd7e7d6760a25608b
TLSH
T19B71CE1697E8466FE0BB4330AEF787132774FD60AF62937D598002296CA02305EB1FB0
MD5 SHA1 SHA512 TLSH

Submit Download

pvxcinlv.dll

Path C:\Users\Admin\AppData\Local\Temp\pvxcinlv\pvxcinlv.dll
Size 4KB
SHA256 5fa3d1ce592a04a37450c382dc384eed6f3c9721cef6c9b3a6190e1992f9f7af
MD5 41360c5deedc27847ff21a4edbe62e9a
SHA1 bf751ee4252ed823f5ff6908d702722b79b83c54
SHA512 9251c0573ffb717361e9cbe47dae1d82be4d633be88796fedcdc781186618fc9c7a5c9f180a3e6773580a2684634f1c3b82f660bab223b6a1c08b0f0b84018cf
TLSH
T1C381311667E84A27F46F0B70ADF3431623B4F9609E62A36E598012186CA1230AD71FB0
MD5 SHA1 SHA512 TLSH

Submit Download

pvxcinlv.pdb

Path C:\Users\Admin\AppData\Local\Temp\pvxcinlv\pvxcinlv.pdb
Size 11KB
SHA256 9efde0f465954710e2fad1ad49fc7be837c6f489297c9b04ac8932db5e3f65a8
MD5 694c9b64082f36e9b7e8ac7f5ff164e4
SHA1 39023a9ccc0e2fe532a0b883945e37a6de6055ec
SHA512 5ab402e87dcac1d68de6bc9570400f1bdb5643a4dabca589e3824bd281d2ecf5eff72159e79cd8a4e5fa0e8f06e27224e13c8524c08e82fc55b32d9c11fe153b
SSDEEP 24:zZmsCZj3wGx8fL2ZrtuQuoUBKnhwdpNPGGFabyXsKeH2wz5nU:zZGAp2ZBcQnOdpNPPh8KeH2wz5
TLSH
T11832B8413BC6E632D0184A790CDBD7CD5760FCA65FC6A38B3241B71D3CBA69A5D916C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pvxcinlv.pdb

Path C:\Users\Admin\AppData\Local\Temp\pvxcinlv\pvxcinlv.pdb
Size 11KB
SHA256 ec82e2dd43543adbb1fe1f60713d5c5539e91f7fd3df8e0ff1268f53b1fa44c0
MD5 fdd6765189625e27b3a6658f08098f3a
SHA1 d7784e970e0bef859fadcc21daaf10c15feedf48
SHA512 8d1adccb4d3b0e1ab3c5371a4aaeaa4040d8125602ce35eb93e7de131218db21d35cee1e3d353c6b0f8d9865d1d396663f8a892114a3884390874d098686c319
SSDEEP 24:zZmsjZj3wGx8wzB2ZrnQDkUHXBnM7GoyX4AeH2wztbU:zZ3AQ2ZjaJM7ojeH2wzt
TLSH
T139329C4137D5E632C05862B54C9B8BC94720FC619EC5A74B3680B71E3CFA29A2E906C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup123.bat

Path C:\Users\Admin\AppData\Local\Temp\setup123.bat
Size 189B
SHA256 1ace23e9b1841a1feb78a164927f8a12fc4e698f1da5026d4a947cc9e760127e
MD5 7fce0ecd105c13c93cf42d762d649888
SHA1 5a4b6d973d8ff1b1b3eb30dca22404df82092fce
SHA512 6620045d69caa9659ca30683f6351f8761f24096c7877a1303e5a6b10593d2988f4e63451b0549c14eb0fa00dbeb4e5caf3d02da99e4fbf8889c6913ae516c3d
TLSH
T104C012F10FD08471D0650D40551BD365E751F68D67F5543413E33184F50580D3E90C7D
MD5 SHA1 SHA512 TLSH

Submit Download

CSCDF34189825E843C8AD547276377283DD.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\pvxcinlv\CSCDF34189825E843C8AD547276377283DD.TMP
Size 652B
SHA256 03ca0111a984701defd8b1364e9bd84f60847589e5fafe743e4bfc398b0d0ab9
MD5 f1d4067f017b866d640bd8b5d400ff95
SHA1 d8f43254f9080b951f52688b835513a815f47e84
SHA512 c10c3d392229ae03bf702e33b30fcd9d6607f566e901596c848f538a81fcf274cfa7c2b9d49883ff0619e806d6df115a724270b8a6f15afe53ca11bce6671c4c
TLSH
T11DF05E4963F8020EF4F35B30BDF643A395ADBCA4DE3293ED545403192C6491089B2FB2
MD5 SHA1 SHA512 TLSH

Submit Download

pvxcinlv.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\pvxcinlv\pvxcinlv.0.cs
Size 82B
SHA256 dc4fe976865cf1f53de8f1f81206fbb0c1c562a96c90f57c4cd5bfb0ffecbcd9
MD5 9bc16e67b2cefd03bee7e7af74eb78f3
SHA1 de2d546df11efac03ef38c73a7662ac662cd0da5
SHA512 b45020fe02f6bc72c136cdfec49ad9844de9f9a9e60942fd2e785488e1277da73efc111c7bc3c096580f2091e3e3ea184844f0aa068e63b4bcd11619aa6a51df
TLSH
T1E5A012105E79D432564201D7A2240452B120C06442843400E8B01C9331020044438519
MD5 SHA1 SHA512 TLSH

Submit Download

pvxcinlv.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\pvxcinlv\pvxcinlv.0.cs
Size 283B
SHA256 7f3b52e5000161d78b030777007a2451d0ed9faa665eed4f7efb5d50a9f3fa08
MD5 13af16a9bb03578b8e7c4b7388d15859
SHA1 d39f36b70a29d61dfadd05d672fd5c99fa485125
SHA512 216321225446b47ce4afd94fc20e762fb6c42a1b68e8df7e312bd9145b873ac234c84708564284d5a9bd8b62001b85c876a250d89fc5461f8840b7d6bd29c398
TLSH
T1B4D0EBC02236EA300AC6640224FAFEBAFAB093248038C030B0C69C0DD02C230BBB0C26
MD5 SHA1 SHA512 TLSH

Submit Download

pvxcinlv.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\pvxcinlv\pvxcinlv.cmdline
Size 914B
SHA256 b7291567cb82791546cbae7ef8b54595a4d0038bb318bd1ed4de013ba6ff2620
MD5 3d7d576f2bb4b1f01f46987bd1ce12f0
SHA1 07371ddbd1353b01848abbd1305c3d2add82b14e
SHA512 3748695dcbc1e7d50c52f01f6a45285c76b1b38911b50806cc33164774e2ae9ee7c5d17a58619f8c6ec13db16705acaaaf5ebabf325e45341939744c65675fa3
TLSH
T165113A35037786F7C5B63943085D5E5CD267535F3482EE1C7A898D1AF9A74110E10790
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4368-31-0x0000024B26D60000-0x0000024B26D68000-memory.dmp

Download

memory/4368-16-0x0000024B26F20000-0x0000024B26F30000-memory.dmp

Download

memory/4368-15-0x0000024B24FD0000-0x0000024B24FD8000-memory.dmp

Download

memory/4368-46-0x0000024B26DA0000-0x0000024B26DA8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads