Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/08/2026, 10:50
Static task
static1
2 signatures
General
- Target 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe
- Size 988KB
- Sample260827-mw991sgl21
- SHA256 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9
- MD5 f7a57e981a72d0eb1239a2ebfdea412b
- SHA1 4a071c555d889362219a5896bd6688e23a1d8841
- SHA512 82b5be135d93b3f2fc68da5ddff7d1721870d687bd8218f9ce2eb8d45aeefeabf3797ed40120b3e2eb1c41da1ef2ed4ebb7427c24deaae2a900a77f0f841b39b
- SSDEEP 12288:0CdOy3vVrKxR5CXbNjAOxK/j2n+4YG/6c1mFFja3mXgcjfRlgsUBgarTO6hRNkkf:0Cdxte/80jYLT3U1jfsWavO6tkE8Q
- TLSH T1B225BE2273DDC360CB769173BF29B7016EBF78614630B95B2F880D7DA950161262DBA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: net.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1356 cmd.exe 1824 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Runs net.exe
- Suspicious use of FindShellTrayWindow 32 IoCs
pid Process 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3364 wrote to memory of 1356 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 86 PID 1356 wrote to memory of 3268 1356 cmd.exe 88 PID 3364 wrote to memory of 1824 3364 147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe 89 PID 1824 wrote to memory of 4896 1824 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe"C:\Users\Admin\AppData\Local\Temp\147746deb206fdb57a2a2a7d5eef00d6db032dc9a0e7a170c01e01c486b081a9.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C NET USE * /d /y2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\net.exeNET USE * /d /y3⤵
- System Location Discovery: System Language Discovery
PID:3268
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C net use O: "\\192.168.1.43\Novaxia" /user:NOVAXIA\c.pichegrain AVky_3273 /persistent:yes2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\SysWOW64\net.exenet use O: "\\192.168.1.43\Novaxia" /user:NOVAXIA\c.pichegrain AVky_3273 /persistent:yes3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:4896
-
-