9093ff3bc7e78cfe84cadc3a993eeb1c15ce497e94efdcf51c1adcafd0aedf18

Analysis

user interaction
yes
max time kernel
33s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dobrota.exe
Size 7.7MB
Sample260822-v7kshassc1
SHA256 9093ff3bc7e78cfe84cadc3a993eeb1c15ce497e94efdcf51c1adcafd0aedf18
MD5 c8b999419a3c103270290e99189f794c
SHA1 90148745b61d2c77c1694e43f11faaa9a3d05a0a
SHA512 6e95c693eef199c511c81052b1b4e9bdbd94bcd2fee2b16660ece026e86e3535c2389fe91049407842c2cad81ab9f0521865edb28708f961d804f32111d4c47c
SSDEEP 98304:JJx19RrCwXU7tTao36KJt6Oe2NhqCZao4+Axhy4V7FLEMUH82Z3dFRsFVsKtOepA:9thk7IInbrIh17FFWZnR0VsAHndDNE
TLSH
T1E4863303FA9248B2E73124B60158DF1127BA5E104B24C557B7C85DBEEE7A182EF3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	dobrota.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
4768	erroricons.exe
652	INVERS.exe
4960	crazywarningicons.exe
4864	crazyinvers.exe
2192	erroriconscursor.exe
4260	toonel.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	WScript.exe
File opened (read-only)	\??\I:	WScript.exe
File opened (read-only)	\??\K:	WScript.exe
File opened (read-only)	\??\M:	WScript.exe
File opened (read-only)	\??\R:	WScript.exe
File opened (read-only)	\??\S:	WScript.exe
File opened (read-only)	\??\U:	WScript.exe
File opened (read-only)	\??\A:	WScript.exe
File opened (read-only)	\??\J:	WScript.exe
File opened (read-only)	\??\O:	WScript.exe
File opened (read-only)	\??\T:	WScript.exe
File opened (read-only)	\??\W:	WScript.exe
File opened (read-only)	\??\Y:	WScript.exe
File opened (read-only)	\??\Q:	WScript.exe
File opened (read-only)	\??\E:	WScript.exe
File opened (read-only)	\??\G:	WScript.exe
File opened (read-only)	\??\H:	WScript.exe
File opened (read-only)	\??\L:	WScript.exe
File opened (read-only)	\??\X:	WScript.exe
File opened (read-only)	\??\N:	WScript.exe
File opened (read-only)	\??\P:	WScript.exe
File opened (read-only)	\??\V:	WScript.exe
File opened (read-only)	\??\Z:	WScript.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
4468	WScript.exe
4216	WScript.exe
4584	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3908	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dobrota.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4468	WScript.exe
Token: SeCreatePagefilePrivilege	4468	WScript.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 3908	4536	dobrota.exe	85
PID 3908 wrote to memory of 4468	3908	cmd.exe	88
PID 3908 wrote to memory of 4768	3908	cmd.exe	89
PID 3908 wrote to memory of 652	3908	cmd.exe	90
PID 3908 wrote to memory of 4960	3908	cmd.exe	91
PID 3908 wrote to memory of 4864	3908	cmd.exe	92
PID 3908 wrote to memory of 2192	3908	cmd.exe	93
PID 3908 wrote to memory of 4260	3908	cmd.exe	94
PID 3908 wrote to memory of 4216	3908	cmd.exe	95
PID 3908 wrote to memory of 4584	3908	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\dobrota.exe
"C:\Users\Admin\AppData\Local\Temp\dobrota.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\start_dobrota.bat" "
  2⤵
  - Checks computer location settings
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\sound.vbs"
    3⤵
    - Enumerates connected drives
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4468
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\erroricons.exe
    erroricons.exe
    3⤵
    - Executes dropped EXE
    PID:4768
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\INVERS.exe
    INVERS.exe
    3⤵
    - Executes dropped EXE
    PID:652
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\crazywarningicons.exe
    crazywarningicons.exe
    3⤵
    - Executes dropped EXE
    PID:4960
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\crazyinvers.exe
    crazyinvers.exe
    3⤵
    - Executes dropped EXE
    PID:4864
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\erroriconscursor.exe
    erroriconscursor.exe
    3⤵
    - Executes dropped EXE
    PID:2192
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\toonel.exe
    toonel.exe
    3⤵
    - Executes dropped EXE
    PID:4260
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\messages2.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:4216
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\messages.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:4584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 64KB
SHA256 4b1ac2785cc5110b36432498321239e1bbe18e2ea18580a4a8dac4823a79e683
MD5 cef3814dcdfdcc23d61622738e33a288
SHA1 441785dcc7ce55265c4f3736be79e221a8288978
SHA512 5e1984cd282e12d3ba188ef85597d837da88e87511a39947a08d4036ef47fbcf17b5b2edffc1f03475669c740eb8b9fff830dc478e4b1412659448e3f4a821ca
SSDEEP 3:lA/llll3allkltlsl7pl+e/llw74XplsMlKTxI1Xlldl0lcNklltlwzl4hR/mll:Ct/A+1E3+ejXplskK1I10cAe
TLSH
T1B9539208E3549862CC088376A5EA0B07B361E0A90E9AE72B501564399D662C4ACB0180
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INVERS.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\INVERS.exe
Size 2.3MB
SHA256 e69c9383b5d9fe4e069ddee15797c52e9116f883ad3b1717d2519621ab2751b2
MD5 5134f289dbf4abae370e3f36b637b73e
SHA1 c78d3f2d00dc47da0112a74df665c7a84a8e32c3
SHA512 0bf61a04b93b1ba5b8a0e2d9a1c333cc4605350a4c797cc9f5f78fec698d6f4fd62d329513ed406e76a06aa6af0f00d206da723e5a33315ce8de7f68f2002cb5
SSDEEP 49152:l3Qe5ZlQ0WORqQ6BbXNYD8fOVk9hVzestkkWi5sWTnE:lJ320WORRqNYD8fOVk9hVzestkk15sWw
TLSH
T1A5B51A52A6CB5DB6DCD237F050C7237A6338DE30CA3ACE7BE648C9355A536C4686A701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crazyinvers.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\crazyinvers.exe
Size 2.3MB
SHA256 47f0e9a90d45b193e81d3e60b7a43e5a4550a07a3dd1f7c98110fde12265d999
MD5 a44458813e819777013eb3e644d74362
SHA1 2dd0616ca78e22464cf0cf68ef7915358a16f9ee
SHA512 1a4723a36f55cf696f33a7927571bda403e81ced32fda85c7cf25c8458897fb187e46bf5f80c26542725a9a7e5aa0e961fd3f3b110ae8f54b3b96b3e5dfc8215
SSDEEP 49152:t3Qe5ZlQ0WORqQ6BbXNYD8fOVk9hVzestkkWi5sWTnE:tJ320WORRqNYD8fOVk9hVzestkk15sWw
TLSH
T16DB51A52A6CB5DB6DCD237F050C7237A6338DE30CA3ACE7BE648C9355A536C4686A701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crazywarningicons.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\crazywarningicons.exe
Size 1.2MB
SHA256 0ecbb8099ed1d9a1673165d3c4c9bbde88dd9678540a98b99434ff23b9e6d82c
MD5 e21bb4749a8b1b6fc26a7bcf57781836
SHA1 89cb0bd80d691ca650ad01551be3acefa2256ebd
SHA512 b0ccf421e415f94b6f0497dd041a8e7693d01d72cd577eca771d2049516f7a0c8c7221da642e5c38d5bc95a2335279d36f956314bda442b99a2d244bcc73b47b
SSDEEP 24576:UGqxBK84DB4heZriJJ59SsfVE1QZqS5czbsJUOXps:1qBK84DB4heZriT58sfVE1QwS5cnsJna
TLSH
T11C553A11FE083966F90F66F430A1B11711A8B18566D8F22775C8AE24F3478B13EA97DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dobrota.mp3

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\dobrota.mp3
Size 6.6MB
SHA256 a40dd9aedae52766593bce06a9a68d47fcf8d430f254ce5e50b0c55587d46213
MD5 fad2e8c2a096f4593a03a771bbe99458
SHA1 88af47f279b9ea008901a6a242466f40f44e8a5c
SHA512 7b607d2927bfb5d2ae3da7ad40fc842f6c1cd12cbc8814a043950d65f50d8084aaa8a544fe51312e68bde9434b138c5c8df50568650658ed0600f447a4a32441
SSDEEP 98304:MTgVNsgynWCNtlZN7V1rSOpAs5PhczBRTcoLlMPtLYHHomrUdImwF/U+9OVRf71B:M8NsFWCNffyA5EAK4Yniwm5nD1PJr
TLSH
T1476633B393C43D5ED89DD2A40648EE16FCD3CE61E2A85841FE01BDB411F9791E7AE281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

erroricons.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\erroricons.exe
Size 316KB
SHA256 994efdb644ca1acb029dfd8d8eeba440e1cb74d93841b17f21165b9900730b15
MD5 7f31508d95be3fe50e4e9aa646e86a12
SHA1 c61b439d6e17d630728f48c09b36af2647940748
SHA512 2e2b01e84a3476b47a9c703b71ce31887e4a4fa9340780f0cbbd20601be621bf00b9619df8bec0e81b2825550150c477c5071d921104a4c6265ef2d5a9e77eda
SSDEEP 6144:tX1KK324vOlFvSd05W1+5aq2EWykUCuOSTm+q1ZTq3iifGS4:JcVVrSa0MoxEZ+Qy3TGiQW
TLSH
T19D640AA4F686FEF5F8459BBD14E1230D539E9291EB2CE7337850FD68010AA5C82B354E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

erroriconscursor.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\erroriconscursor.exe
Size 316KB
SHA256 f0fe346146c30129ed6f507906c973f1a54c7d8dd8821c97e9b6edc42545699d
MD5 135eeb256e92d261066cfd3ffd31fb3e
SHA1 5c275ffd2ab1359249bae8c91bebcab19a185e91
SHA512 a3792f92b116851023620d862cac6d2b5542de41390b6b8d223074db94193f0ee6dfcc9d6588ea3e77173f73c7fdfc5f9a1e1044c597636fe275d9ff4b76a12b
SSDEEP 6144:N11KK324vOlFvSd05W1+5aq2EWykUCuOSTm+q1ZTq3iifGPh:bcVVrSa0MoxEZ+Qy3TGiQU
TLSH
T134641AA4F686FDF5F8459BBD14E1230D539EA291EB2CE7337850FD68010AA5C82B354E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.vbs

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\messages.vbs
Size 37B
SHA256 e1cdab59df6508013e8b91c71043c8ecfe81b94a037706147ed19adf992539e6
MD5 35fbf9bf29760b9e120b37900b3c1343
SHA1 8a231c37ee13e72f27a38411668fde6fef3ff5bc
SHA512 d1c12b6690c6b90dda5ad3e226e30adc848b3c324f929dec373ab6c7606fbcab716c49c4446efadf14036583924f8f094491bfe8bef380fd877c00cf9feaacc6
MD5 SHA1 SHA512

Submit Download

messages2.vbs

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\messages2.vbs
Size 37B
SHA256 bffa14678b8c39c2fbfa54b76fbac5f750aebc8dc2954da10a55b7f1f90f351c
MD5 63954d8930e517637c254f9da0749e7a
SHA1 27f6a13c0e9530166d62b4586c3d2bda5cb5064c
SHA512 dd5df6b8a64523fedb5aaced7d864013d12e6930015d8fd2267b11cffe76741c3a7907814a832ff7589476a51d16e8ab0fc566f4ac0784f6a599070080c7008d
MD5 SHA1 SHA512

Submit Download

sound.vbs

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\sound.vbs
Size 216B
SHA256 3d6123cae8ac645d9c9d33b0dada869a7fdd5117a2bf0f9080e4e30fe5bed736
MD5 c36c15e1f99e1c0d093b9b089b1073c5
SHA1 47a237639f83d8de0c2034831ff3e12a3bad7408
SHA512 4283b45c6483e2ed6e9741f5937bb7851e101fb4710bd687a73a77b5abcb820d2480deaee50c8e87a7f225cee2430836da75d201838e9d989e91f3c0c0c60d1f
TLSH
T1CAD0A76D54A0816FD98592A54890309881BA31386942A950D55DE4001E2C0555B0B402
MD5 SHA1 SHA512 TLSH

Submit Download

start_dobrota.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\start_dobrota.bat
Size 205B
SHA256 7670d34d64f41ae60bffdd902e4d566b7fdd0c7782738782d5a8dbe59cce2001
MD5 47fef7e366f39175f9467a5a33675b40
SHA1 4a55fdc489cb4b67517e04fe1eadc63dfff7b232
SHA512 ea5ee454f8fa4ce2e7519c3b8772a8083586d4c4eefa981410c17d67d0ae8e8e716f8693d331a040d5fd29cb007988af2472a0b36840805098be492f863a4e28
TLSH
T17CD08C04EC130C0B4E924C8237813B5BD08B020C18F5F0CEF428C0014E6FC0F3720600
MD5 SHA1 SHA512 TLSH

Submit Download

toonel.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\toonel.exe
Size 317KB
SHA256 fe7ff85b95ec06ce0f3cb49fdfa4d36de1f08669d36d381794aaf597510afad7
MD5 a84257e64cfbd9f6c0a574af416bc0d1
SHA1 245649583806d63abb1b2dc1947feccc8ce4a4bc
SHA512 6fc85ee0f8c75a25193fc4883a734704a8190253348c158b9cef4b918cffee5c8997c5248ec2bc793f66978e8cb4c5233d300d112f1d7750bc660698414865c2
SSDEEP 6144:EuyCVKK3240OlhvSd0lW1+paC2Suyk1CuGSvm+i1ZT43iifl9:r8VMnSaQMYJSRN4uLTgiQH
TLSH
T172641AA4F686FDF5F8459BBD14E1230D439EA291EB2CE7337850FD68011AA5C82B354E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/652-64-0x0000000000400000-0x0000000000582000-memory.dmp

Download

memory/2192-67-0x0000000000400000-0x0000000000454000-memory.dmp

Download

memory/4260-68-0x0000000000400000-0x0000000000454000-memory.dmp

Download

memory/4468-58-0x0000000005CF0000-0x0000000005D00000-memory.dmp

Download

memory/4468-62-0x0000000005CF0000-0x0000000005D00000-memory.dmp

Download

memory/4468-61-0x0000000005CF0000-0x0000000005D00000-memory.dmp

Download

memory/4468-57-0x0000000005CF0000-0x0000000005D00000-memory.dmp

Download

memory/4468-59-0x0000000005CF0000-0x0000000005D00000-memory.dmp

Download

memory/4468-60-0x0000000005CF0000-0x0000000005D00000-memory.dmp

Download

memory/4768-63-0x0000000000400000-0x0000000000454000-memory.dmp

Download

memory/4864-66-0x0000000000400000-0x0000000000582000-memory.dmp

Download

memory/4960-65-0x0000000000400000-0x0000000000541000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads