74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967

Analysis

max time kernel
149s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967.exe
Size 862KB
Sample260825-sdctpabk9x
SHA256 74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967
MD5 1e398d3d07eedc7037bacbe933ea4dd1
SHA1 ef72f9af15430442bd6719c7ae4db983896d0b14
SHA512 be30bd469a3b50a0ee2616ea1f7c75a52a529668b27de1772fbdfc636deff2486b52a571db6144af9ec716566f5985e5548847d1aca18afaac6b9c052acb7ee5
SSDEEP 24576:MtqEG+li6u7GcJQOicJj+8JBUnM3XI1FdZhgLH7ir7dyky7+:MUyXu7fQOpdKMItZhHy57+
TLSH
T1311512099A03D7F1DC1F0733894BD67A12505E6CF254CCD3D7AD7D6AECBA5A23222252
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	internal74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967.exe

Executes dropped EXE 1 IoCs

pid	Process
4080	internal74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967.exe

Loads dropped DLL 1 IoCs

pid	Process
772	74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4712	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internal74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
692	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
692	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4080	internal74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967.exe
4080	internal74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4080	internal74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967.exe
4080	internal74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967.exe
4080	internal74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 4080	772	74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967.exe	87
PID 4080 wrote to memory of 4712	4080	internal74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967.exe	94
PID 4712 wrote to memory of 692	4712	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967.exe
"C:\Users\Admin\AppData\Local\Temp\74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:772
- C:\Users\Admin\AppData\Local\Temp\nsa4498.tmp\internal74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967.exe
  C:\Users\Admin\AppData\Local\Temp\nsa4498.tmp\internal74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967.exe /baseInstaller='C:/Users/Admin/AppData/Local/Temp/74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967.exe' /fallbackfolder='C:/Users/Admin/AppData/Local/Temp/nsa4498.tmp/fallbackfiles/'
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\25117.bat" "C:\Users\Admin\AppData\Local\Temp\18AC95D4B624400FA4C1522D50AEFAC3\""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4712
  - - C:\Windows\SysWOW64\PING.EXE
      ping 1.1.1.1 -n 1 -w 1000
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$I1SZ3T0

Path C:\$Recycle.Bin\S-1-5-21-1074038928-2032447174-945360078-1000\$I1SZ3T0
Size 98B
SHA256 537ab3070f44b9e330717800690935874dd68c2823d6d5e7b917e91c1ad562ad
MD5 6a2bdc4ce2f9c667e6c3cfbc8a948ddf
SHA1 c867e729adb56c6e3cc50b151f75b48278b269cb
SHA512 16e7fdc61970514ca0bb306d566c634be5f4412b273e1a50bec4f36444726143ce711fa5339604875aaa3275d3a9ff8ca63147ec5d3c108914cf835da834f4ed
TLSH
T1AEB012343AF40054F9738431D87280D01237B15003101408418001A040625029159701
MD5 SHA1 SHA512 TLSH

Submit Download

18AC95D4B624400FA4C1522D50AEFAC3_LogFile.txt

Path C:\Users\Admin\AppData\Local\Temp\18AC95D4B624400FA4C1522D50AEFAC3\18AC95D4B624400FA4C1522D50AEFAC3_LogFile.txt
Size 10KB
SHA256 7e50645944b86209ef313fa0f445a62a29cc58725fbe2b77a5faa46ac53bdbee
MD5 d6160b9304a42d27257451e99e62efc7
SHA1 af331e57e14d5ade4c29c4daf52e98aa426c0ac2
SHA512 bd32c52408c50f5f61b0c174add0118c7805045c156854f48805692b119ed5ec66b56971cc196b6b947d86a83a9889308f1addf23bb7751ffb3fbe317fcc00de
SSDEEP 192:k7ZHM7u7W7u7bF737Po7Y7s7J6r7pd7nHs7S7x7F7u7T7ywU5w:k7xM7u7W7u7J737A7Y7s7Jc7pd7Hs7Sw
TLSH
T11F22307A0702D0F9558414BFE078CFC66364499FBE74AA58EF2B02C4A6DDB91DB6B0C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

18AC95~1.TXT

Path C:\Users\Admin\AppData\Local\Temp\18AC95D4B624400FA4C1522D50AEFAC3\18AC95~1.TXT
Size 123KB
SHA256 a2bc67ba864b48bcff80a2e2721d04ab597cd17e68d3f32a763a3d8a02fff7aa
MD5 4e1db3dccb6c80b99431ee670b41d082
SHA1 01880a2a4b88869e27a4e7f91ea67209281bf289
SHA512 ef9a015892cf7cacad5ea6d231a7bc87f97598a70c20946918eb9c2131bb71a4b7f9fee67e151b8380defa127caf24889a7ade6aad0895f1a8c38cb65d0cbbbc
SSDEEP 768:k7q7u7W7u7J737A7Y7s7Jc7pd7M7S7x7F7u7T7yz5p7C7T7U79E7937w7K7n787S:OA
TLSH
T1B7C3B47A4542D1FC458418FFA028CFCA3364499FAE71AB68EF2B01C4B5DDB959B6E0C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

25117.bat

Path C:\Users\Admin\AppData\Local\Temp\25117.bat
Size 212B
SHA256 cdb93994093a24991c246d8b6f7003920a510a45bfc8441521314ce22a79191d
MD5 668767f1e0c7ff2b3960447e259e9f00
SHA1 32d8abf834cce72f5e845175a0af2513b00504d8
SHA512 c07f26c8601cf91d9805004668463721ab91e14f3cc59e77e20f43d98e070ea8e742c38fe8021c4ffb1ebc02e3743ab732b66ff84bb24b59a5fdcc8634c77680
TLSH
T188D0C98EBBA5785F4A1A429722D28506470CF0490D57A2C6113068EEBF05A61AABBDC2
MD5 SHA1 SHA512 TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa4498.tmp\StdUtils.dll
Size 14KB
SHA256 0ebd62de633fa108cf18139be6778fa560680f9f8a755e41c6ab544ab8db5c16
MD5 21010df9bc37daffcc0b5ae190381d85
SHA1 a8ba022aafc1233894db29e40e569dfc8b280eb9
SHA512 95d3dbba6eac144260d5fcc7fcd5fb3afcb59ae62bd2eafc5a1d2190e9b44f8e125290d62fef82ad8799d0072997c57b2fa8a643aba554d0a82bbd3f8eb1403e
SSDEEP 192:OFb8Y8oqy2mqZc9hGBQHRx39oRxmMvURkB/Fs:qb8Y8nKqohGBKxox9vURw/a
TLSH
T1F152A6258D40AAB9F4F1157B71BB2762DA394D04A324FCDB4B2228F91A045FB7C7274E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

internal74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967.exe

Path C:\Users\Admin\AppData\Local\Temp\nsa4498.tmp\internal74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967.exe
Size 1.8MB
SHA256 333d9de24a498e6a520c9a0a7085961821febc2bd7e059a881883fd5266ea9a4
MD5 a00cd9d2d4c53263004ad4d50208a58a
SHA1 03e563a1691144255710c424acdcc344205565b1
SHA512 56e224c00ba26d0e8405ecf4bf6d7e325e95293945b586747a1d609375ed83cf92e969e602a2a317ce337ec37a9fc680a7d568008eee2c5eceb6552ff985a756
SSDEEP 49152:rc4u49CbNSFXVJUtSH9zaTRpSWaezjQWLtm5YXld:rz4GFJUtYf
TLSH
T14B858C96F682C030D5610572D078D6FE807A6F74E321A9E753DC3EAA29315C2E939F72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

internal74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967_icon.ico

Path C:\Users\Admin\AppData\Local\Temp\nsa4498.tmp\internal74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967_icon.ico
Size 31KB
SHA256 7b465e8921a8e9d5219566676da7ddecafcbb4991ac79fc7039d7468dfeef038
MD5 f6d27dbbdb39b7a048494f3e74421e2c
SHA1 82c6a7856af6c79d4449e4ab57604688017efe9f
SHA512 4d0de9b896050b6814c1a9f657f4dfdc0f6dad38a26084623112a5b4504cf98d5565902c0a930e28790543bdd834fc2932908a2909bb8b556cb20a007bea646b
SSDEEP 384:nK9KK0gPGuj2rncudgNisT9MvlQjcSm8nYex4AalGsceW3ZIigRq0HlEHfGBX:n4KK0gPmncRunSm1exQn6URqYEHUX
TLSH
T193E2A1059A13E3DAC05F6B73C84FE6F601926D2DF4A8C2D391AC7D5BF97E9523422091
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

internal74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967_splash.png

Path C:\Users\Admin\AppData\Local\Temp\nsa4498.tmp\internal74aab5e40664334f92bd44f29cbfca76e7c7c6ee467b164cba95e7b1de20e967_splash.png
Size 79KB
SHA256 b13214b03b76fb63e2ad17cdaf96b4cb92a8100c35392926cbb12cf5671094c9
MD5 0cc43ef142e9f71f1178e77ee3b7b7e9
SHA1 39498148a70bd00cc269fad582fa4dcfda725c5d
SHA512 398e79e2da071265ad1e18c3cdf0f65cab15b534a8ad71488d814cda9b7c092bb56b9e319e96c7fe93b2cc9b63e8f95393a6c9def64f310cc16233e8ec5ec16a
SSDEEP 1536:7Nj9chhbFDlQxRF2FO7M419UQMv9ay/I2J3+tZXdguDr0WU6wXlkz:Bj0VEv2R4lmIu3mFdgG0WU9Xqz
TLSH
T1198312D4EBD610AE5F084701A9802B85D9F2067BDA427F3FDC73CA462F7053E6A52B49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/772-0-0x0000000000429000-0x000000000042A000-memory.dmp

Download

memory/772-295-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4080-77-0x0000000004140000-0x0000000004141000-memory.dmp

Download