b6bfa5a66f1cdaf0f60eea689a73cff6ffab42458fb2ed4dd06cde7f8ab245b7

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/09/2026, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b6bfa5a66f1cdaf0f60eea689a73cff6ffab42458fb2ed4dd06cde7f8ab245b7.exe
Size 927KB
Sample260909-ej488s1wfw
SHA256 b6bfa5a66f1cdaf0f60eea689a73cff6ffab42458fb2ed4dd06cde7f8ab245b7
MD5 e11a58e8fef83f5dfe0dfef19654456b
SHA1 ce8d8b75a41a8ad3b4027bcb279ca8d7f0e9e568
SHA512 f07076d31d64ec445b036ada8e3b06db887a59651a68c61c4d5cd39e5fa5d8a5c8519b9488bc68c36f8eab88ad07b1ca50a284a1426bdf952801f7f2b4a9e338
SSDEEP 24576:TnvS+55BpfRX95rp/whxtpmS44qYsStBIJ0RD:rKA5/fBjlwhxvmS4SDtBS0RD
TLSH
T14115D019D7E405F9E1B3E574CE834902EB73BC495371D69F03ACA9661F236908E39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	b6bfa5a66f1cdaf0f60eea689a73cff6ffab42458fb2ed4dd06cde7f8ab245b7.exe

Executes dropped EXE 1 IoCs

pid	Process
3632	codec_checker.exe

Loads dropped DLL 1 IoCs

pid	Process
3632	codec_checker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 3632	4364	b6bfa5a66f1cdaf0f60eea689a73cff6ffab42458fb2ed4dd06cde7f8ab245b7.exe	85

C:\Users\Admin\AppData\Local\Temp\b6bfa5a66f1cdaf0f60eea689a73cff6ffab42458fb2ed4dd06cde7f8ab245b7.exe
"C:\Users\Admin\AppData\Local\Temp\b6bfa5a66f1cdaf0f60eea689a73cff6ffab42458fb2ed4dd06cde7f8ab245b7.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\codec_checker.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\codec_checker.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

codec_checker.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\codec_checker.exe
Size 294KB
SHA256 a94f403a9dcaa586cea7ffd8dc46166ffed254bca6adc7f8116cb78dfe6813a3
MD5 30fb63db6ee40dcc0bcc0c13b19e6155
SHA1 668f2981036d3d7478602eb003d5e2b19016be41
SHA512 2caebb9f2bacb9acdf9b63c7c9edc92b427a22c9ce9a4e3432daaec7c6d103b4a2b9ded254c65a23d5bd5417ad9573a0650cda50b57888c8e61d5592a0b3653a
SSDEEP 3072:5mNutj+zh/o7jX9IBdwUSueWY8Mj2m0oPudPc6MVJA1idH4wEkoY46A23z+r6MjX:5/U0X94tSueWuzTgioh+KrDMj2
TLSH
T185546C26B3A518F5E967827DCD524502E773B81607B2D6EF03A4836A2F332D05E3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zrtc.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\zrtc.dll
Size 17KB
SHA256 3c7f88078362f77c84ee986f82203720216df92b0ce59cac3de11b21830f806e
MD5 cca04ea77f063985ddcbb4cd66110bad
SHA1 36d0464b9d25c188289c95fd143ac657fbc08d0a
SHA512 503fc67aa96d422bec3a3142244723f5925a9d17260d53a1db49f9ee6f0658165a0d48a2a2dd0a989490c064e30f44171ca8471e2c7370537f0467e16cafa74d
SSDEEP 192:YFndFQgewRfM6mjRoaGOe0cqN75MGn1fZih3V6p2m7lLyD4JZH/zr9n4:YFHXe6ZOe0N75nfZS30p2mZrZrZ
TLSH
T13E721949A7808CD6E815C239C9A39D2ED672B651572297CF53204B3E0E737C1323EBD5
MD5 SHA1 SHA512 SSDEEP TLSH