ee7ca82f38b05b8421e7c34c9e5559d3bad4cd791cbb1ac278eb72008ebd8fe6

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SOA JULY 521797600.js
Size 794KB
Sample260820-rzbcbasvev
SHA256 ee7ca82f38b05b8421e7c34c9e5559d3bad4cd791cbb1ac278eb72008ebd8fe6
MD5 003b0dfbb4090703b0d1f3b9c612aac4
SHA1 c8c505414fa19e3cc519bfa72fbdffd08d243e48
SHA512 0ff0d7022984ba5555d5ae74de08aa0a7afc94f0f3c35f37534b8c2b05592bec45493d1d56f2735fdcea51394b9c3f12bb9ddefbeefa0853223f7a718ede7bc7
SSDEEP 192:e8iWot6nJQJGymC8NBX6VCq69sOHqe56gdATkGL7s/W8H5aBJRzeckSIY/Y5Rwa8:8
TLSH
T18E051977C2FD2F3EC4275659CE7A3C0C98B054A20B4EF47AED3764C5D87CAAA66A0150
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	3680	wscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
4312	vlc.exe

Loads dropped DLL 1 IoCs

pid	Process
4312	vlc.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4312	vlc.exe
4312	vlc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 4312	3680	wscript.exe	85

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\SOA JULY 521797600.js"
1⤵
- Badlisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Users\Admin\AppData\Local\Temp\5a9c\vlc.exe
  "C:\Users\Admin\AppData\Local\Temp\5a9c\vlc.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5a9c.bin

Path C:\Users\Admin\AppData\Local\Temp\5a9c.bin
Size 1.2MB
SHA256 f90cac678c07a3f06e7e9d39aa2cee6638f65bf04b95ee24f4994b1c9b96b8b1
MD5 ab78adb2180ff24502a091a61c7fff97
SHA1 64416ecc263956e82679488539bc107ae360addc
SHA512 f11e2d8c90cc0aeae258b90e17fa1816b4d79113314bf8c4801b07437fa6c9a2a75728207bf4467406ecd5d1b776d4814000c8dab78bf79b58f63deb4360df98
SSDEEP 24576:dJhT4GQMoROnt1U2Fu1KY8ZV3D1F2NV1bk0G6pXd5YmFWKQYkbLogqTQ3ftGoHaU:pUHCnFuoY8Z9Db2N/bodNlAgqkvtZ5kW
TLSH
T1074533503F06E954B9B5A17BE923C9160B9216FD5F6D2D031FE8BC985C0E0A4A4F0B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libvlc.dll

Path C:\Users\Admin\AppData\Local\Temp\5a9c\libvlc.dll
Size 1.4MB
SHA256 79803ea391bbc139f30426e7d271533fbe17c3b4442ea71ad6bac87281fa4dc1
MD5 59640d249e120524b15599c22d5f8e89
SHA1 c07e7fed67aecb3d1bded894e50ab2e7b55f8a57
SHA512 0b87d48ec61a4bf584bf36730a50cfb9173602381fc730f046a58780b4fe942156fee6b51f449061d2aaf2d6867abcf46cd3a88f883a2b0adedd819ebfa03ee5
SSDEEP 24576:kr8CtDVsmJdL31NYpaN5cPTekphlTxZacuahkVazjvPLLb8Uv7huz3jIXei7RVLz:kr8CtptJ11NYe+TemHZacpI27P78Tz38
TLSH
T1E265C1A42FD024F0E1B5CD75CB67B7B4533F366F1E416FB7112092692E7229AAA03C19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc.exe

Path C:\Users\Admin\AppData\Local\Temp\5a9c\vlc.exe
Size 1021KB
SHA256 bfa5740f028a8f310ca01c779bbc5f2f1b435c41539c54de592f715bb0c10389
MD5 f0a4d5c3492115bfe2f346bc7bdce396
SHA1 bfcbdc7d0cbb92b68d348090fe9f381b4358a587
SHA512 8e4b2e1852fbc821cab4a7c16675afbfa2588472faa1848600829c415bfbee7cbf4713568ba15a76916e6c761d79b0fff7c5a1ae087aabd912bb7063d38a560a
SSDEEP 24576:uGKuKkPztKt9cHPrLRAqKBAy1N1UGAmnnnFnnnZnnnGnnnsddodt:uGKuKkPzgt9cHTLRAqK81k8
TLSH
T1A9254B1BE7A345EDC56FC13487A7C772AA30B86942347E2E1D95DB221F10E609F2E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4312-48-0x00000267CC670000-0x00000267CC671000-memory.dmp

Download

memory/4312-49-0x00007FFFDBD90000-0x00007FFFDC059000-memory.dmp

Download

memory/4312-50-0x00007FF76F420000-0x00007FF76F523000-memory.dmp

Download