6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/09/2026, 23:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe
Size 3.2MB
Sample260926-3ke8hatfma
SHA256 6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b
MD5 9cc7c174f2758a0e5982f859ef85040f
SHA1 d5b6d0bf2292559b6065d3b8cc2befb299526434
SHA512 bbd997054fe37dc23e59664f6c5aaee322703f89563cdc1740ae98f6581ea79112af1f99f2a60e6687c0fdda44c516744ada04a7e02ad10dfb7556d6b0658605
SSDEEP 98304:+nni8DZw7u23xUpX5y/gI64+l13LTvuOL0v:4DZw7udtTp3/K
TLSH
T1C1F533D574A55B16F392703AE202F3B9A4340E01FAE7967114D1ED47FB8F882F6646C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution upx

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
8	sg.tmp
2304	logCode.exe
2844	adb.exe
4652	adb.exe

Loads dropped DLL 4 IoCs

pid	Process
2844	adb.exe
2844	adb.exe
4652	adb.exe
4652	adb.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4312-0-0x0000000000400000-0x000000000055F000-memory.dmp	upx
behavioral2/memory/572-8-0x0000000000400000-0x000000000055F000-memory.dmp	upx
behavioral2/memory/4312-50-0x0000000000400000-0x000000000055F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1880	cmd.exe
4600	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	logCode.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeBackupPrivilege	4312	6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe
Token: SeRestorePrivilege	4312	6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe
Token: 33	4312	6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe
Token: SeIncBasePriorityPrivilege	4312	6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe
Token: 33	4312	6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe
Token: SeIncBasePriorityPrivilege	4312	6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe
Token: 33	4312	6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe
Token: SeIncBasePriorityPrivilege	4312	6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe
Token: SeBackupPrivilege	572	6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe
Token: SeRestorePrivilege	572	6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe
Token: 33	572	6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe
Token: SeIncBasePriorityPrivilege	572	6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe
Token: 33	4312	6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe
Token: SeIncBasePriorityPrivilege	4312	6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe
Token: SeRestorePrivilege	8	sg.tmp
Token: 35	8	sg.tmp
Token: SeSecurityPrivilege	8	sg.tmp
Token: SeSecurityPrivilege	8	sg.tmp
Token: 33	4312	6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe
Token: SeIncBasePriorityPrivilege	4312	6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 1880	4312	6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe	88
PID 4312 wrote to memory of 572	4312	6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe	91
PID 4312 wrote to memory of 8	4312	6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe	92
PID 4312 wrote to memory of 2304	4312	6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe	94
PID 2304 wrote to memory of 4600	2304	logCode.exe	96
PID 4600 wrote to memory of 244	4600	cmd.exe	97
PID 4600 wrote to memory of 2844	4600	cmd.exe	98
PID 2844 wrote to memory of 4652	2844	adb.exe	100

C:\Users\Admin\AppData\Local\Temp\6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe
"C:\Users\Admin\AppData\Local\Temp\6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c set
  2⤵
  - Executes a command shell one-liner
  PID:1880
- C:\Users\Admin\AppData\Local\Temp\6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe
  PECMD**pecmd-cmd* PUTF -dd -skipb=951296 -len=2453211 "C:\Users\Admin\AppData\Local\Temp\~8819379453129901479.tmp",,C:\Users\Admin\AppData\Local\Temp\6f278e1db9fd6fd56136530a0af36deff2295de6e6eb8fc5e9c60105807e161b.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:572
- C:\Users\Admin\AppData\Local\Temp\~7372026539495890844~\sg.tmp
  7zG_exe x "C:\Users\Admin\AppData\Local\Temp\~8819379453129901479.tmp" -y -aoa -o"C:\Users\Admin\AppData\Local\Temp\~2028675222329416462" -p112233
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:8
- C:\Users\Admin\AppData\Local\Temp\~2028675222329416462\logCode.exe
  "C:\Users\Admin\AppData\Local\Temp\~2028675222329416462\logCode.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3A8A.tmp\EnCode.bat" "C:\Users\Admin\AppData\Local\Temp\~2028675222329416462\logCode.exe""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4600
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:244
  - - C:\Users\Admin\AppData\Local\Temp\~2028675222329416462\adb.exe
      adb get-state
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\~2028675222329416462\adb.exe
        
        adb -L tcp:5037 fork-server server --reply-fd 668
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EnCode.bat

Path C:\Users\Admin\AppData\Local\Temp\3A8A.tmp\EnCode.bat
Size 2KB
SHA256 2ca68be06993a0777382ef9ffaffbfac0cab62338fd445e31bb3747198a1b061
MD5 e62d34e9ec9b4919c9cb732cb78ac84f
SHA1 8f708ce36c19fde790f46887cbadfe230c2058cf
SHA512 41d500b879b563b0c1ef2d8f93451ace5e5210dfd43ccdfcad39471f621191319c2151ae2a814b248e1e0a6d4f0f715c34a3c4153fe3a58cfae4675c8edb55c1
TLSH
T114412087F8074738997C08A09CBA5505F744818BA3123DEABA4F41B52F323CB3BE840C
MD5 SHA1 SHA512 TLSH

Submit Download

AdbWinApi.dll

Path C:\Users\Admin\AppData\Local\Temp\~2028675222329416462\AdbWinApi.dll
Size 95KB
SHA256 d60103a5e99bc9888f786ee916f5d6e45493c3247972cb053833803de7e95cf9
MD5 ed5a809dc0024d83cbab4fb9933d598d
SHA1 0bc5a82327f8641d9287101e4cc7041af20bad57
SHA512 1fdb74ee5912fbdd2c0cba501e998349fecfbef5f4f743c7978c38996aa7e1f38e8ac750f2dc8f84b8094de3dd6fa3f983a29f290b3fa2cdbdaed691748baf17
SSDEEP 1536:Jwqdq+3pvspmLh8SCykrpTG7kfGHuNezq02XJqo+iFi1yCP:JwqD3L8Tezq0et+ui1y
TLSH
T17BA3592138A1C172C8D261B90AECF76193AEF4B10B3599C7379803DEDD653D25B7528B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdbWinUsbApi.dll

Path C:\Users\Admin\AppData\Local\Temp\~2028675222329416462\AdbWinUsbApi.dll
Size 61KB
SHA256 25207c506d29c4e8dceb61b4bd50e8669ba26012988a43fbf26a890b1e60fc97
MD5 0e24119daf1909e398fa1850b6112077
SHA1 293eedadb3172e756a421790d551e407457e0a8c
SHA512 9cbb26e555ab40b019a446337db58770b9a0c9c08316ff1e1909c4b6d99c00bd33522d05890870a91b4b581e20c7dce87488ab0d22fc3c4bbdd7e9b38f164b43
SSDEEP 1536:l72doFmOiHizFbPlspcsbj5ZsP+YeTs1p:lSSfN9+YeTs1p
TLSH
T1C8534B227991C072C89661B909FDE651A27FBA601BB184C7779C03EBED303D1AB79347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adb.exe

Path C:\Users\Admin\AppData\Local\Temp\~2028675222329416462\adb.exe
Size 5.7MB
SHA256 bce1f6f6f6532266837b66d719bfbd177d406d6d7d8d5adfd5e7c59fcde651a5
MD5 3b0c0331799d69225e1ba24e6cb0dfab
SHA1 5584f5b9aeff12b32d214d792e373901af71f3a3
SHA512 2b1305374a734cf34661b4720e38fb9dc91a080d1f53be6092276f8f54041c4acd658b10fd65f5db21ccabee594c0a008727e3aad7d289147dff17a346998573
SSDEEP 98304:z235t9jZcDRH2WeOE4MvKey0GlJJNuZIqP:wuWMkSey0GBNuZLP
TLSH
T1D3568D89E693A1B9DE430470206FB23FBF340705C714CEE7C6E4CE757963A91253A66A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logCode.exe

Path C:\Users\Admin\AppData\Local\Temp\~2028675222329416462\logCode.exe
Size 69KB
SHA256 e3bb033072b5ce8b6cc2754863653e692c089deeaf46984c63b975c7fe7d392d
MD5 3a4b6893f4e662cf33abbae59bd0ad7a
SHA1 f202d850aaeebec909384c294615f91eaff48cc0
SHA512 d820ac2c1c9c11862c48103b92b961e0ef889f2d833b26436d8d28c12f4f4b0117eb758bbe841cd33611ceddf772eb6175f85780b27c385240741261c676528e
SSDEEP 1536:zWqCR8ze0SMfFIE43jqTYf/i+7sER0vOG:Kqk0SvWTsqOk
TLSH
T184632803279012A6F34325F8442BF676D6615F125315D6E35BD06C2BBF64AE2EE383E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sg.tmp

Path C:\Users\Admin\AppData\Local\Temp\~7372026539495890844~\sg.tmp
Size 715KB
SHA256 4cc32d00338fc7b206a7c052297acf9ac304ae7de9d61a2475a116959c1524fc
MD5 7c4718943bd3f66ebdb47ccca72c7b1e
SHA1 f9edfaa7adb8fa528b2e61b2b251f18da10a6969
SHA512 e18c40d646fa4948f90f7471da55489df431f255041ebb6dcef86346f91078c9b27894e27216a4b2fe2a1c5e501c7953c77893cf696930123d28a322d49e1516
SSDEEP 12288:fDGME0uBHVw8VOa/iJ9x1mJhXTUOr/swII0urngQfmsa9mn+WEqdxaxH7B:fD2lHV4a/G9x1UhjU+EwhrrngwmsemZe
TLSH
T131F49E223BF6C1BBD24201318A1CABF590F5F7590B3059C363908F6D6B399D5D63AA1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~8819379453129901479.tmp

Path C:\Users\Admin\AppData\Local\Temp\~8819379453129901479.tmp
Size 2.3MB
SHA256 1bba53b7c4155fc8207e5e2fedab40a53d0ba40d9817ac37f495fda8b114df46
MD5 13cb2e526f93855e3f6e00ac01d4d930
SHA1 c6b93d312b6f9b2f4cb0944fcff6d148d271a5b9
SHA512 6332a552aeb0e9b615783709dbd68da6069f72482899ed2cb0b17f183abf1b20377e95fd443bc421f34bcd2c02292a43bbde53f25832302783477cf3d844ede1
SSDEEP 49152:B2/fxUpX5y/gAbl6ChHel13LfL5pt0Il71N/swQ/:B23xUpX5y/gI64+l13LTvuOL0v/
TLSH
T16BB533C5B4A54F05F3E0A629D24573F4ED349722EAFB6A7424C0E180EBCE502D5AE6D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~~8614334572234360001.tmp

Path C:\Users\Admin\AppData\Local\Temp\~~8614334572234360001.tmp
Size 128B
SHA256 098c40464fef692666bb09c13f35eaadc543e7f6ee0f4949875de8b00514f4ab
MD5 3882aece35454a91424e5fdd047a122f
SHA1 af9113a293a744c9d78458cce1edf9c2e792a092
SHA512 15b4e1bfc3dc63bd8bca8b2431466f1868de7c57fa16805d2f4e2a36144055b9c1e401b56c720b4dd739b636ac688b8200d2da5b43a53b86f40ab40676e16779
TLSH
T1A8B02B8522FC97480D0148B78004020C102594212EC073001329519406516534A4131A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/572-8-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2304-33-0x000000000040D000-0x000000000040E000-memory.dmp

Download

memory/2304-52-0x000000000040D000-0x000000000040E000-memory.dmp

Download

memory/4312-0-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/4312-50-0x0000000000400000-0x000000000055F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads