f09de485f13f54b78f309b4855811e8e00a93a3c9e3d6d6d5c571dfdf252620a

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Invoice 2015010811732274 document.exe
Size 623KB
Sample260910-ajx3psvtbt
SHA256 f09de485f13f54b78f309b4855811e8e00a93a3c9e3d6d6d5c571dfdf252620a
MD5 30a57e9712408848ce6380a345de7fc9
SHA1 16877dcc3993717d02a4ac40b29a6626b15099d7
SHA512 18b69750741bdef3ed64e50204c5f894405546123179186c506e070211993159be759577967a38deacbb8c4693a86268ef66606f98ce962fde24bcb1576c42ef
SSDEEP 12288:FkhgmDYAvKZEOwzJH72UzGfbTFgF9O1tdcHiwyKw7XEWr+xe:Gi0ZCZUxaUzGDRc9ww6DEWrw
TLSH
T10DD4DE189631E229DD0105FD0F2722E5B4C4798572B296E1BF67EE0E78E6028CF7D9E4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

Detected Nirsoft tools 2 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/5044-4-0x0000000000400000-0x0000000000488000-memory.dmp	Nirsoft
behavioral2/memory/5348-12-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/5044-4-0x0000000000400000-0x0000000000488000-memory.dmp	MailPassView
behavioral2/memory/5348-12-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/5044-4-0x0000000000400000-0x0000000000488000-memory.dmp	WebBrowserPassView

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	whatismyipaddress.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2820 set thread context of 5044	2820	Invoice 2015010811732274 document.exe	89
PID 5044 set thread context of 5348	5044	RegSvcs.exe	92
PID 5044 set thread context of 6136	5044	RegSvcs.exe	93

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Invoice 2015010811732274 document.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2820	Invoice 2015010811732274 document.exe
Token: SeDebugPrivilege	5044	RegSvcs.exe
Token: SeRestorePrivilege	5620	dw20.exe
Token: SeBackupPrivilege	5620	dw20.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 5044	2820	Invoice 2015010811732274 document.exe	89
PID 2820 wrote to memory of 5044	2820	Invoice 2015010811732274 document.exe	89
PID 2820 wrote to memory of 5044	2820	Invoice 2015010811732274 document.exe	89
PID 2820 wrote to memory of 5044	2820	Invoice 2015010811732274 document.exe	89
PID 2820 wrote to memory of 5044	2820	Invoice 2015010811732274 document.exe	89
PID 5044 wrote to memory of 5348	5044	RegSvcs.exe	92
PID 5044 wrote to memory of 5348	5044	RegSvcs.exe	92
PID 5044 wrote to memory of 5348	5044	RegSvcs.exe	92
PID 5044 wrote to memory of 5348	5044	RegSvcs.exe	92
PID 5044 wrote to memory of 5348	5044	RegSvcs.exe	92
PID 5044 wrote to memory of 5348	5044	RegSvcs.exe	92
PID 5044 wrote to memory of 6136	5044	RegSvcs.exe	93
PID 5044 wrote to memory of 6136	5044	RegSvcs.exe	93
PID 5044 wrote to memory of 5620	5044	RegSvcs.exe	94

C:\Users\Admin\AppData\Local\Temp\Invoice 2015010811732274 document.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice 2015010811732274 document.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
    3⤵
    PID:5348
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
    3⤵
    PID:6136
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 2244
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2820-8-0x0000000074480000-0x0000000074AA1000-memory.dmp

Download

memory/2820-1-0x0000000074482000-0x0000000074484000-memory.dmp

Download

memory/2820-2-0x0000000000CC0000-0x0000000000CD0000-memory.dmp

Download

memory/2820-3-0x0000000074482000-0x0000000074484000-memory.dmp

Download

memory/2820-0-0x0000000000CC0000-0x0000000000CD0000-memory.dmp

Download

memory/2820-5-0x0000000074480000-0x0000000074AA1000-memory.dmp

Download

memory/5044-4-0x0000000000400000-0x0000000000488000-memory.dmp

Download

memory/5044-7-0x0000000074480000-0x0000000074AA1000-memory.dmp

Download

memory/5044-6-0x0000000074480000-0x0000000074AA1000-memory.dmp

Download

memory/5044-9-0x0000000074480000-0x0000000074AA1000-memory.dmp

Download

memory/5044-15-0x0000000074480000-0x0000000074AA1000-memory.dmp

Download

memory/5044-16-0x0000000074480000-0x0000000074AA1000-memory.dmp

Download

memory/5044-17-0x0000000074480000-0x0000000074AA1000-memory.dmp

Download

memory/5044-22-0x0000000074480000-0x0000000074AA1000-memory.dmp

Download

memory/5348-12-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/6136-18-0x0000000000400000-0x0000000000458000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads