81cda388503889486b1ba8e66e9f92edf4c18222e63eb889c370f68d217044a6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 14:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
81cda388503889486b1ba8e66e9f92edf4c18222e63eb889c370f68d217044a6.exe
Size 1.2MB
Sample260826-r1plbseq9v
SHA256 81cda388503889486b1ba8e66e9f92edf4c18222e63eb889c370f68d217044a6
MD5 d96c217444118d525b5ba531ba827dad
SHA1 3a2f41f12bc6cb31957e05159784a6f0901bb21d
SHA512 d4839b74b27e73e0aa9d4ec0e4e3cb995e0b85b81ae2f4a31ad8c6f0f8878bfe0c1ed4de1de8d80967832addb6af421bd70fd51b578b78747c86f674d7166b6b
SSDEEP 24576:3Z8nkF9oySiLz72ooSru/so3V9xC2BjW9YPx8rM/mJxuWpbR3:eiLz72ooSW7j+5D
TLSH
T1BE45AE937ACB0CF6CCA227F485C7277697385E314913CB6BA654C92A8FA36C0BD59701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\service.exe"	service.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	81cda388503889486b1ba8e66e9f92edf4c18222e63eb889c370f68d217044a6.exe

Executes dropped EXE 4 IoCs

pid	Process
1332	service.exe
1728	service.exe
1916	service.exe
772	service.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Service Application = "C:\\Windows\\service.exe"	service.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3308 set thread context of 4400	3308	81cda388503889486b1ba8e66e9f92edf4c18222e63eb889c370f68d217044a6.exe	86
PID 1332 set thread context of 1728	1332	service.exe	91
PID 1916 set thread context of 772	1916	service.exe	95

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\service.exe	81cda388503889486b1ba8e66e9f92edf4c18222e63eb889c370f68d217044a6.exe
File opened for modification	C:\Windows\service.exe	81cda388503889486b1ba8e66e9f92edf4c18222e63eb889c370f68d217044a6.exe
File created	C:\Windows\service.exe	service.exe
File opened for modification	C:\Windows\service.exe	service.exe
File created	C:\Windows\service.exe	service.exe
File opened for modification	C:\Windows\service.exe	service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5076	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81cda388503889486b1ba8e66e9f92edf4c18222e63eb889c370f68d217044a6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81cda388503889486b1ba8e66e9f92edf4c18222e63eb889c370f68d217044a6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	81cda388503889486b1ba8e66e9f92edf4c18222e63eb889c370f68d217044a6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	81cda388503889486b1ba8e66e9f92edf4c18222e63eb889c370f68d217044a6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	service.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	service.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	service.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	service.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	81cda388503889486b1ba8e66e9f92edf4c18222e63eb889c370f68d217044a6.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 4400	3308	81cda388503889486b1ba8e66e9f92edf4c18222e63eb889c370f68d217044a6.exe	86
PID 3308 wrote to memory of 4400	3308	81cda388503889486b1ba8e66e9f92edf4c18222e63eb889c370f68d217044a6.exe	86
PID 3308 wrote to memory of 4400	3308	81cda388503889486b1ba8e66e9f92edf4c18222e63eb889c370f68d217044a6.exe	86
PID 3308 wrote to memory of 4400	3308	81cda388503889486b1ba8e66e9f92edf4c18222e63eb889c370f68d217044a6.exe	86
PID 3308 wrote to memory of 4400	3308	81cda388503889486b1ba8e66e9f92edf4c18222e63eb889c370f68d217044a6.exe	86
PID 4400 wrote to memory of 5076	4400	81cda388503889486b1ba8e66e9f92edf4c18222e63eb889c370f68d217044a6.exe	88
PID 4400 wrote to memory of 1332	4400	81cda388503889486b1ba8e66e9f92edf4c18222e63eb889c370f68d217044a6.exe	90
PID 1332 wrote to memory of 1728	1332	service.exe	91
PID 1332 wrote to memory of 1728	1332	service.exe	91
PID 1332 wrote to memory of 1728	1332	service.exe	91
PID 1332 wrote to memory of 1728	1332	service.exe	91
PID 1332 wrote to memory of 1728	1332	service.exe	91
PID 1916 wrote to memory of 772	1916	service.exe	95
PID 1916 wrote to memory of 772	1916	service.exe	95
PID 1916 wrote to memory of 772	1916	service.exe	95
PID 1916 wrote to memory of 772	1916	service.exe	95
PID 1916 wrote to memory of 772	1916	service.exe	95

C:\Users\Admin\AppData\Local\Temp\81cda388503889486b1ba8e66e9f92edf4c18222e63eb889c370f68d217044a6.exe
"C:\Users\Admin\AppData\Local\Temp\81cda388503889486b1ba8e66e9f92edf4c18222e63eb889c370f68d217044a6.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Users\Admin\AppData\Local\Temp\81cda388503889486b1ba8e66e9f92edf4c18222e63eb889c370f68d217044a6.exe
  "C:\Users\Admin\AppData\Local\Temp\81cda388503889486b1ba8e66e9f92edf4c18222e63eb889c370f68d217044a6.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\remove55668.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5076
- - C:\Windows\service.exe
    "C:\Windows\service.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1332
  - - C:\Windows\service.exe
      "C:\Windows\service.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Checks processor information in registry
      PID:1728

C:\Windows\service.exe
C:\Windows\service.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\service.exe
  "C:\Windows\service.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Checks processor information in registry
  PID:772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

remove55668.bat

Path C:\Users\Admin\AppData\Local\Temp\remove55668.bat
Size 267B
SHA256 47811832c9c0266bbe68e48f6eeca2d4883070dba6a527948d8c8429ef875b3f
MD5 5c16b59aef9a469e7eda8b73b23b3786
SHA1 318f42fc915114a34eb03581d6460bb610fea6d3
SHA512 75a0dbca0bd5ac79cc85b9d826718586a62f82ca3ceb1e1288c6d9659340398d658014ec522ecb89c3b64ac4bc9f9b36a29e8a056b6c1234b282fa03433fc0c6
TLSH
T157D02B0B802B8EA54A40A3330EA5196D40A56C253DC03BB85F1780CC648703DF043A02
MD5 SHA1 SHA512 TLSH

Submit Download

shell32.dll

Path C:\Users\Admin\AppData\Local\Temp\shell32.dll
Size 51B
SHA256 56236f215239c47b888dc5d2c75f1e454e5e9a495afa17b10bf12e3d2aa57c69
MD5 08b3330cbd780635b96aa08865fcc434
SHA1 93ff24625db0c78556252cde56e90e54978527d2
SHA512 55ccd0de8188748e6ad1787b0348d43ccc03a6dbb316e96170dbebf51fec9b3dff7b21777ae76ec7efc43c99cb17272e264a67d7f031b950fc5ae799a60c9709
TLSH
T14290021C871A90551561854499744128401DA05C0748647465A5260D885115586117F4
MD5 SHA1 SHA512 TLSH

Submit Download

service.exe

Path C:\Windows\service.exe
Size 1.2MB
SHA256 1641781eb5139a116030b8b607870dc126ce4767824b5397fb3628995dfa7a8c
MD5 c029a4e241e9c567b0f6eccd19674afd
SHA1 5f7a682bd003a70e4ca6f5c96b9eb4a493a5e9ba
SHA512 5d44bd4e5375cb6346dfe35f4cffe2bef08bad7014418de68d3b953b59e8e9f72581e6d365ce07696eeaa713f7798dfc196e5d24110021f8299255b5ef78069c
SSDEEP 24576:3Z8nkF9oySiLz72ooSru/so3V9xC2BjW9YPx8rM/mJxuWpbRr:eiLz72ooSW7j+5v
TLSH
T1BE45AE937ACB0CF6CCA227F485C7277697385E314913CB6BA654C92A8FA36C0BD59701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/772-65-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/1332-53-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/1728-55-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/1728-54-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/1728-58-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/1728-57-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/1728-59-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/1916-63-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/3308-1-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/4400-48-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/4400-4-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/4400-0-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/4400-3-0x0000000000400000-0x000000000041A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads