557d567474b6a7f1fda0c0d052dbc86ed845c380dc94c2f324350bc9e2408ecd

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
26s
max time network
17s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
viewbot/TKfucker.exe
Size 9.1MB
Sample260831-aen91ascqa
SHA256 557d567474b6a7f1fda0c0d052dbc86ed845c380dc94c2f324350bc9e2408ecd
MD5 66e2ca265f98255448fcdb3c1a16a1a8
SHA1 fb4508b1c02d01711543f0c2f27f5f8b3e8d1b39
SHA512 fde67fe8401d9dfff069a6407bdab6b17b6bf8cc441730045b1909096bc2521b100baf6a0c5ee180ef213d0379e9decf2dc73450276e8f1440f4f0f33a2d5758
SSDEEP 196608:QKXc/NLPizwXnDnngH7ue8bivMzVqncOlMaWc5I8x6ulMS:xXc/Nr4wzngH7ueuVqdlMaWc5ISe
TLSH
T108A633A8F520A56FF347CC32541ABF63E8F835876303599954BFE10A85DF6A298ED403
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2088	0x21_viewbot.exe
1536	discord_token_login.exe
4372	5iveservices.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3620	cmd.exe
2940	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	discord_token_login.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	discord_token_login.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2088	2524	TKfucker.exe	86
PID 2524 wrote to memory of 1536	2524	TKfucker.exe	87
PID 1536 wrote to memory of 4372	1536	discord_token_login.exe	89
PID 2088 wrote to memory of 3620	2088	0x21_viewbot.exe	90
PID 2088 wrote to memory of 2940	2088	0x21_viewbot.exe	93

C:\Users\Admin\AppData\Local\Temp\viewbot\TKfucker.exe
"C:\Users\Admin\AppData\Local\Temp\viewbot\TKfucker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Users\Admin\AppData\Local\Temp\5FBBFD7B\0x21_viewbot.exe
  "C:\Users\Admin\AppData\Local\Temp\5FBBFD7B\0x21_viewbot.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\system32\cmd.exe
    cmd /c cls
    3⤵
    - Executes a command shell one-liner
    PID:3620
- - C:\Windows\system32\cmd.exe
    cmd /c cls
    3⤵
    - Executes a command shell one-liner
    PID:2940
- C:\Users\Admin\AppData\Local\Temp\5FBBFD7B\discord_token_login.exe
  "C:\Users\Admin\AppData\Local\Temp\5FBBFD7B\discord_token_login.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Users\Admin\AppData\Local\Temp\0ECBFD7B\5iveservices.exe
    "C:\Users\Admin\AppData\Local\Temp\0ECBFD7B\5iveservices.exe"
    3⤵
    - Executes dropped EXE
    PID:4372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5iveservices.exe

Path C:\Users\Admin\AppData\Local\Temp\0ECBFD7B\5iveservices.exe
Size 7.6MB
SHA256 f26b9fed7d2f371928cb08011eff664a6bb3c1cccb61a2fec23b3276dd8e1d9c
MD5 83f28c025e1d717a0f221dee29fbe1ba
SHA1 79078cd2dd1fea308ebc9d23f0f0509208e2e8de
SHA512 90e33c4e5173d009356f8658f2f78938011870f3e958d37e9dddbc5ea1b37f62ce7ffbe250c9d597602ef0c99d9e1e8b3abc900970fca5b321478622e1072ea2
SSDEEP 98304:8FFZpFO6ovVggiIF+9rLpz+D7RKx8k/a:+FZpFtSVfXF3ZG
TLSH
T11C86BDD6836D496CF522B13885872247E7F37F0E6321CFFB1AD40CA3691F994B621299
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0x21_viewbot.exe

Path C:\Users\Admin\AppData\Local\Temp\5FBBFD7B\0x21_viewbot.exe
Size 9.5MB
SHA256 056411a3ef1c584491bca1cc670b0218a91b1312676f2931f8d10532141cfdcd
MD5 e9f16db0958b3ebbbfa466a40e0446ee
SHA1 137d68857cc0d4cc6aa16e83660c9f472d70cf55
SHA512 c1d40d988fa54c4748855a79dd8dfd470245e24fe10dd09d165ec3184b6c076fb8851bce8b57c88590197c96ae34fa73f2a9e3acc89cafe622e9741d0e59a4e7
SSDEEP 98304:PIv05w/L4VC1hdb0EXrJ2WGILcdYJCZxFie3q47c3byuZ:PfS1h712tILcd5NieB7Ub
TLSH
T174A67B03EC6514E9C1AEA2748AB39262BB757C480B3227D32B90F6347E77BD06D79354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

discord_token_login.exe

Path C:\Users\Admin\AppData\Local\Temp\5FBBFD7B\discord_token_login.exe
Size 3.8MB
SHA256 fc1f33fa3f5afb070f4fa94b63099fab900f7f8d98c3392e5583f9e71d15b085
MD5 db98ad16aead66a1309858bba465a03d
SHA1 755c805719d7f5105c58238dc2ab8ec77661f79f
SHA512 d5e8815188edfb046bd4c8d12c787da348da78e33d488ef91b678c473a11c68c1469664a88d53ac9cee36e7d81b7b7873c800e8800f96fddf5e4f5890853d63e
SSDEEP 98304:4quiO0vTFIdilkcp6Sf8lfJuyGfIOLQV7h4UNKq:4DiX5IokcESfgDUdLQVuU
TLSH
T1C8063303B9CA59C4EF5255723333FCB62DB9B8F3D95D5212F4619B6328E8F868728460
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1536-7-0x000001D0D3DF0000-0x000001D0D3F0C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads