6b1d30b4b5859f65dd1e78bb02a1ed91391d77bfa4ace1da2179742306ccffda

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6b1d30b4b5859f65dd1e78bb02a1ed91391d77bfa4ace1da2179742306ccffda.exe
Size 1.1MB
Sample260826-wt6cqa1vbz
SHA256 6b1d30b4b5859f65dd1e78bb02a1ed91391d77bfa4ace1da2179742306ccffda
MD5 2376434a9ca07f26004d2483a5188a0f
SHA1 92ba454138b824875be9f54c1cd65cab8adf05e0
SHA512 375c9e0539d6e6805ea71f93bca6119efa281e899c256c3d68cf79ce1501489d5861a065a8e8fab81daaa0d067f78511a3580fecfcb9ed6917190534d1f4ec67
SSDEEP 24576:8bRbJaK2B91yhM3tqFdz7FPlUJmHdel/ck7:CwK2Bcz7FPlUJmZk
TLSH
T1E2358C1BABE521F5E477C178CD6A4406E7B378650771C7CF12A546AB0F232E09E3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	6b1d30b4b5859f65dd1e78bb02a1ed91391d77bfa4ace1da2179742306ccffda.exe

Executes dropped EXE 1 IoCs

pid	Process
2688	unst1787768031428-copied.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 2688	4728	6b1d30b4b5859f65dd1e78bb02a1ed91391d77bfa4ace1da2179742306ccffda.exe	84

C:\Users\Admin\AppData\Local\Temp\6b1d30b4b5859f65dd1e78bb02a1ed91391d77bfa4ace1da2179742306ccffda.exe
"C:\Users\Admin\AppData\Local\Temp\6b1d30b4b5859f65dd1e78bb02a1ed91391d77bfa4ace1da2179742306ccffda.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Users\Admin\AppData\Local\Temp\unst1787768031428-copied.exe
  "C:\Users\Admin\AppData\Local\Temp\unst1787768031428-copied.exe" --source_path="C:\Users\Admin\AppData\Local\Temp\6b1d30b4b5859f65dd1e78bb02a1ed91391d77bfa4ace1da2179742306ccffda.exe"
  2⤵
  - Executes dropped EXE
  PID:2688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Dola-uninstaller.log

Path C:\Users\Admin\AppData\Local\Temp\Cici\User Data\sdk_storage\log\Dola-uninstaller.log
Size 1KB
SHA256 578794455839141a3ca3b10d87665f4a9ff81b3c775419b2eaa23c86cc057bc8
MD5 c4bd94928d882fa3d104b49c2839a2f5
SHA1 4214ef2dc4bd09f3a6d3ec58a392b6eee9eb296e
SHA512 963c4f51eae75fe3ec928cd11b1b6aff7e12e561382f4fb5aac12d512b71e823785d88f1b91dc8160c96d355a20e00933fda50733134c0cab7a8a086e640fc5b
TLSH
T18D31B6C31CA410F57C0EC5156A4A2CCFE4E7A2A94DDA2E1D375B01C9ECCB91D659FB0A
MD5 SHA1 SHA512 TLSH

Submit Download

unst1787768031428-copied.exe

Path C:\Users\Admin\AppData\Local\Temp\unst1787768031428-copied.exe
Size 1.1MB
SHA256 6b1d30b4b5859f65dd1e78bb02a1ed91391d77bfa4ace1da2179742306ccffda
MD5 2376434a9ca07f26004d2483a5188a0f
SHA1 92ba454138b824875be9f54c1cd65cab8adf05e0
SHA512 375c9e0539d6e6805ea71f93bca6119efa281e899c256c3d68cf79ce1501489d5861a065a8e8fab81daaa0d067f78511a3580fecfcb9ed6917190534d1f4ec67
SSDEEP 24576:8bRbJaK2B91yhM3tqFdz7FPlUJmHdel/ck7:CwK2Bcz7FPlUJmZk
TLSH
T1E2358C1BABE521F5E477C178CD6A4406E7B378650771C7CF12A546AB0F232E09E3A722
MD5 SHA1 SHA512 SSDEEP TLSH