e1c812d902abd553c00f079d96a0dde37ea48f0ef136a827f47250788ec89093

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SmartF.bat
Size 166KB
Sample260910-pr2s7atcjd
SHA256 e1c812d902abd553c00f079d96a0dde37ea48f0ef136a827f47250788ec89093
MD5 cca28e76dbbd476a081eff3aab84ec2c
SHA1 c3be8205f54a07e21377511179b94bdb355d1f97
SHA512 b2b9e6297bc26af25cbdfd68dce83b885aecaf74117c4d6f6b5d44df1b856b2d92b4e8c2e064b6c44752d300e25b7d3085daa551481ed09c0946b05723f44bef
SSDEEP 1536:p+WzUwWEs54r156k1+IX00Ff7AezEoWPEz:2w2axDDFf7SoWPEz
TLSH
T155F39A7B5CC1C2A3032F4521941C77802F3A6F9779A7613FA089B5592CE5630BEE9D2E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	NextaLM.exe

Executes dropped EXE 2 IoCs

pid	Process
2448	NextaLM.exe
4164	SmartF.exe

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
1424	certutil.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4068	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4164	SmartF.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 1424	4068	cmd.exe	88
PID 4068 wrote to memory of 2448	4068	cmd.exe	89
PID 2448 wrote to memory of 4164	2448	NextaLM.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SmartF.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Windows\system32\certutil.exe
  certutil -f -decode "C:\Users\Admin\AppData\Local\Temp\SmartF.bat" NextaLM.exe
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1424
- C:\Users\Admin\AppData\Local\Temp\NextaLM.exe
  NextaLM.exe s://demo.nexta-fa.co.jp
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\demo.nexta\SmartF.exe
    "C:\demo.nexta\SmartF.exe" * "C:\Users\Admin\AppData\Local\Temp\NextaLM.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NextaLM.exe

Path C:\Users\Admin\AppData\Local\Temp\NextaLM.exe
Size 120KB
SHA256 038e77ed1405cc024535bc789abefdbaca0cbeb6b16c55a67f17969709d364e4
MD5 d538bb407dd62624a3a0ef681850d9de
SHA1 30bb9a8765173413459985e6f7a130c87376c985
SHA512 29d0f12012752c4cee7d0387ca419ec2a11adb2ac14fffe690070c05f16e3213a1a4289dc7f2a058d6ab13f16aef6a2cab0344d69dc7b3bcc504561b42de2e09
SSDEEP 768:cDmZSsY7FOxlR77dywNqo7ZXv5a5H8tiy0v8JabLs0ksQBsbseJaQQQswQgej3ht:l42JjFXSVPQX3ht
TLSH
T184C37C91B5E4CA70FC4D89FC58FEC9732523AE520420C185246BFECA36BB27D85C6A75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

presented_by_demo.nexta.url

Path C:\demo.nexta\presented_by_demo.nexta.url
Size 51B
SHA256 334bb5310b30917ea61d9f27cb1bf1b056a49cb01a6ef176dbb3ceeb083abc08
MD5 c606a050ee5769cba3cc5c7b3e982051
SHA1 a3272f5d10256edc093302f0934ffb61287fa817
SHA512 159b2da987dc39bbbecdb3e88e3d920178aee972cd7a3a409249913534f7c10868355b610437512d91307be68474ca748d9b7c85edc4550921d1498c2c758f61
TLSH
T103900267610D5A959202044C5964D956D8473198C55BE559E1509E045D46455E1C424C
MD5 SHA1 SHA512 TLSH