Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/08/2026, 11:11
Behavioral task
behavioral1
Sample
b84d1c46725f34cc9d193f9b0605cd40f60952f7a3c235287fcf46c89547ee2f.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target b84d1c46725f34cc9d193f9b0605cd40f60952f7a3c235287fcf46c89547ee2f.exe
- Size 672KB
- Sample260826-nak9fach84
- SHA256 b84d1c46725f34cc9d193f9b0605cd40f60952f7a3c235287fcf46c89547ee2f
- MD5 300d8e5ce3026a6524c76bbc60aee592
- SHA1 47e8406c105c3c564bf96a17155f0963d3b52676
- SHA512 31ba5dfd58fe1e3e1189c6531db771943c718708a7f99d61d4093121189dcd6ffd7e16987f0102e2b489d079caa93b5168e153953177b826f01dd515e8418d1c
- SSDEEP 12288:fztsYNPEaWJnIgvgnTGPY4U+m81kJE3u3Glzm/y02q9pJY+Q5Kfc8vy4hc:fztOaMMnKrTm81t+u02EpJq5n86H
- TLSH T169E4230B7FA246EBD2A29D3054E1EBAAEE7416B0FA47271327001EFD1D316539A79350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2636 beeaecibgg.exe - Loads dropped DLL 2 IoCs
pid Process 4692 b84d1c46725f34cc9d193f9b0605cd40f60952f7a3c235287fcf46c89547ee2f.exe 4692 b84d1c46725f34cc9d193f9b0605cd40f60952f7a3c235287fcf46c89547ee2f.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 1804 2636 WerFault.exe 85 - System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b84d1c46725f34cc9d193f9b0605cd40f60952f7a3c235287fcf46c89547ee2f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beeaecibgg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2952 wmic.exe Token: SeSecurityPrivilege 2952 wmic.exe Token: SeTakeOwnershipPrivilege 2952 wmic.exe Token: SeLoadDriverPrivilege 2952 wmic.exe Token: SeSystemProfilePrivilege 2952 wmic.exe Token: SeSystemtimePrivilege 2952 wmic.exe Token: SeProfSingleProcessPrivilege 2952 wmic.exe Token: SeIncBasePriorityPrivilege 2952 wmic.exe Token: SeCreatePagefilePrivilege 2952 wmic.exe Token: SeBackupPrivilege 2952 wmic.exe Token: SeRestorePrivilege 2952 wmic.exe Token: SeShutdownPrivilege 2952 wmic.exe Token: SeDebugPrivilege 2952 wmic.exe Token: SeSystemEnvironmentPrivilege 2952 wmic.exe Token: SeRemoteShutdownPrivilege 2952 wmic.exe Token: SeUndockPrivilege 2952 wmic.exe Token: SeManageVolumePrivilege 2952 wmic.exe Token: 33 2952 wmic.exe Token: 34 2952 wmic.exe Token: 35 2952 wmic.exe Token: 36 2952 wmic.exe Token: SeIncreaseQuotaPrivilege 2952 wmic.exe Token: SeSecurityPrivilege 2952 wmic.exe Token: SeTakeOwnershipPrivilege 2952 wmic.exe Token: SeLoadDriverPrivilege 2952 wmic.exe Token: SeSystemProfilePrivilege 2952 wmic.exe Token: SeSystemtimePrivilege 2952 wmic.exe Token: SeProfSingleProcessPrivilege 2952 wmic.exe Token: SeIncBasePriorityPrivilege 2952 wmic.exe Token: SeCreatePagefilePrivilege 2952 wmic.exe Token: SeBackupPrivilege 2952 wmic.exe Token: SeRestorePrivilege 2952 wmic.exe Token: SeShutdownPrivilege 2952 wmic.exe Token: SeDebugPrivilege 2952 wmic.exe Token: SeSystemEnvironmentPrivilege 2952 wmic.exe Token: SeRemoteShutdownPrivilege 2952 wmic.exe Token: SeUndockPrivilege 2952 wmic.exe Token: SeManageVolumePrivilege 2952 wmic.exe Token: 33 2952 wmic.exe Token: 34 2952 wmic.exe Token: 35 2952 wmic.exe Token: 36 2952 wmic.exe Token: SeIncreaseQuotaPrivilege 5052 wmic.exe Token: SeSecurityPrivilege 5052 wmic.exe Token: SeTakeOwnershipPrivilege 5052 wmic.exe Token: SeLoadDriverPrivilege 5052 wmic.exe Token: SeSystemProfilePrivilege 5052 wmic.exe Token: SeSystemtimePrivilege 5052 wmic.exe Token: SeProfSingleProcessPrivilege 5052 wmic.exe Token: SeIncBasePriorityPrivilege 5052 wmic.exe Token: SeCreatePagefilePrivilege 5052 wmic.exe Token: SeBackupPrivilege 5052 wmic.exe Token: SeRestorePrivilege 5052 wmic.exe Token: SeShutdownPrivilege 5052 wmic.exe Token: SeDebugPrivilege 5052 wmic.exe Token: SeSystemEnvironmentPrivilege 5052 wmic.exe Token: SeRemoteShutdownPrivilege 5052 wmic.exe Token: SeUndockPrivilege 5052 wmic.exe Token: SeManageVolumePrivilege 5052 wmic.exe Token: 33 5052 wmic.exe Token: 34 5052 wmic.exe Token: 35 5052 wmic.exe Token: 36 5052 wmic.exe Token: SeIncreaseQuotaPrivilege 5052 wmic.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4692 wrote to memory of 2636 4692 b84d1c46725f34cc9d193f9b0605cd40f60952f7a3c235287fcf46c89547ee2f.exe 85 PID 2636 wrote to memory of 2952 2636 beeaecibgg.exe 86 PID 2636 wrote to memory of 5052 2636 beeaecibgg.exe 89 PID 2636 wrote to memory of 520 2636 beeaecibgg.exe 91 PID 2636 wrote to memory of 3116 2636 beeaecibgg.exe 93 PID 2636 wrote to memory of 4284 2636 beeaecibgg.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\b84d1c46725f34cc9d193f9b0605cd40f60952f7a3c235287fcf46c89547ee2f.exe"C:\Users\Admin\AppData\Local\Temp\b84d1c46725f34cc9d193f9b0605cd40f60952f7a3c235287fcf46c89547ee2f.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\beeaecibgg.exeC:\Users\Admin\AppData\Local\Temp\beeaecibgg.exe 0^4^7^3^0^6^4^3^5^1^8 L0xCQT0sLjQtMBgvT04/UENAOisfJ05BTVRPTEdGPzwpICs9RlNORUE4MTEzLykdLz1FQTgvGC9MS0xETz9RWkg8PS4xMjgxHCxOREpWQUtcVUxIOmNzbHA2KCxzbHIrP0RLSylNTFAnPU1LLUFOQkgdLz1IRj5KQUQ5GSxEKzlLUEw6RU4ZLEQsOSosHydELzYqMRorQS88JTEcKEE1NykuGy5IUks9UkNOW01NSE5BP1I6IClMT0pDTUNQWEJVRj06Gy5IUks9UkNOW0s8TD09U2JrUltuKnM1LCArPlVFWVFPRzxgdHBpNy8pc3RyLWphbmVeYihfbGguamFuKHRpaG5ebSxwNjAmMjIrKmJzZBgvQVFCXz1JQUdIRkU5KFAgKURMTlNXQk5IVFM/TjowHydURDpLS1NLUlpUSkw5GSxWRzkvGy48Uy02S0FHQR0qUU1OUEJKRVlTQkdCR01BQkpBQUFSTUs1ICtCUF9MUUtPSEVFOW1vdV8cLE1ETFVOR0ZOQVtSTkRKX0A6VlM3Lh0qR0FEQVE6MRorRk5ePFlKOkpJPVtCSUJKWUxNQkQ3Yl5ncl0gKz1MV0hITDxDV0lMNjU0KDExKTAvMiorMTUaK008UTlMSD5JX0NKUE9AREw5X15sbWEdKlNBTUE2LjQuLDEuMDExLBksRElTS0dOOURbTUZNPzk1KjEsLy4pLjUkLzcwNzIzLCNNTQ==2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81787742701.txt bios get serialnumber3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2952
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81787742701.txt bios get version3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5052
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81787742701.txt bios get version3⤵
- System Location Discovery: System Language Discovery
PID:520
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81787742701.txt bios get version3⤵
- System Location Discovery: System Language Discovery
PID:3116
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81787742701.txt bios get version3⤵
- System Location Discovery: System Language Discovery
PID:4284
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 9363⤵
- Program crash
PID:1804
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2636 -ip 26361⤵PID:3324
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\81787742701.txt
- Size 70B
- SHA256 5c3b49db1374e42e5047a3ab05b1ee7577cf78cf6e875889a164f54d1af6257b
- MD5 5b21bdfd2dcb4143105a1642e631bf89
- SHA1 0921933e59eacc03e31a28dd8be977bc2726ee21
- SHA512 41608db131f901209389d780a5ff1561f0c1dcc0cd2b2d8ed87f60bef852b80925d6f1ca8c9230558635ea4aff4f7c1c9ec099ca5d1b3a85514b26c57b517ae4
- TLSH T1DCA00243C7DC218EF1F64514FD30506C1BC330C11D7E014C0048002B86F784446103D7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\81787742701.txt
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\81787742701.txt
- Size 58B
- SHA256 79dae8edfddb5a748fb1ed83c87081b245aeff9178c95dcf5fbaaed6baf82121
- MD5 f8e2f71e123c5a848f2a83d2a7aef11e
- SHA1 5e7a9a2937fa4f06fdf3e33d7def7de431c159b4
- SHA512 8d34a80d335ee5be5d899b19b385aeaeb6bc5480fd72d3d9e96269da2f544ccc13b30fd23111980de736a612b8beb24ff062f6bed2eb2d252dbe07a2ffeb701e
- TLSH T177A00212415CC100546359409055523816936890483D1829024C004693D74015451BEB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\beeaecibgg.exe
- Size 949KB
- SHA256 d3f963e0294c75dc537d7a6bb0efb59243a14ed0ed7252bd3f66cbb32cdd56d0
- MD5 9d3b55bd974ca277e3a51b88fb2ef68e
- SHA1 ecddafaf4800fc4aa53325ca333fc8a300bee169
- SHA512 7c73e50928cbee1296e1719e06f0018785b43f0db3e8eff4326d12ea90fea1edb3ee6516af0abe01d841ed262b051877c6def1c80a25176e3c649158afbf5cc8
- SSDEEP 24576:VLSBXNUxQ73FdTnyVn5p/4Mkwxlq70WYSb8uYmyb:Vmoe73FxG4MkIlqNYe8uYmyb
- TLSH T1C125AF01FBD7E0B1D94625B51AB7933F4A35BA12432586CBEBC41F1DCE212E1AA3F245
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsk1FA9.tmp\ZipDLL.dll
- Size 163KB
- SHA256 6bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1
- MD5 2dc35ddcabcb2b24919b9afae4ec3091
- SHA1 9eeed33c3abc656353a7ebd1c66af38cccadd939
- SHA512 0ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901
- SSDEEP 3072:8CkSJJ30k1pn2T4ISnUGN+E8KnCOxA17jxLmRtWHyPDQFllOdJiSg:tkSJy+c30UxbKnA1hLKWSVdk
- TLSH T102F3BF223DA1C67FD2AE0139CCE51F39EBFAB1218FB50D871B0906589D31DA1DA27356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsk1FA9.tmp\dydqpiz.dll
- Size 107KB
- SHA256 84026a94a356fa7afe50ad10d71318e99a2ee0d71b0c7b963d7a3e681302412d
- MD5 ce4918aae0a4a19081babf0abbdc4fb7
- SHA1 d099098ed8a3e0b3cbfea294f21eb741b1904bd7
- SHA512 868ca93e7147d052db26e9bd990276e3ae7d8ddaec949035d986164df110fc74dc5b6c711245bdc149db3c6e3696c88eba3d39205ce55739e2ed2251ebb5cea9
- SSDEEP 1536:MkszK+ptE72vFnjmvjAB7osmLRM51TDwvD5Kq3B31oP7DQS:MjNE72kEYLMpYKqx31oP7c
- TLSH T10FB36C213195C072E25E1A3D8922D7724B6BBCB1CDB5A89B3FD41ABE4F74282DF15306
- MD5 SHA1 SHA512 SSDEEP TLSH