Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 18:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
client.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
client.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target client.exe
- Size 2.2MB
- Sample260930-wwl2vstsft
- SHA256 1eb51e82267b2ea1d3216919dbac9d5297ca8565baf8e39ccfc07323136b1849
- MD5 d3cde4bd1869a3edbd6573557d6b1912
- SHA1 7a98e44d10312b5a4d419c21cb246b9f09385e22
- SHA512 ba5d1b6fb5ec03ac30c334f01798ff02b54450fe37eb94f37cf8feaceafb071d1e5e8ab7fa2ba5ae7cd080d5a66b3e0010a7ed7cdea3e0a5895a0116a59a66fc
- SSDEEP 24576:NyiMVtRC0iHgNW5nGTESie8JHvYK4ClI+0SnxuyETawg+tbcQAsqv:Ny1qgticK4ClfITX
- TLSH T13DB59E3662AC11C8F17BD17D8ADB4A47D6B274090331A6DB019446DD2F2BEEA0F7E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation client.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com 63 ip-api.com - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname client.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain client.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 client.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString client.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{6C9F1F7C-CA21-4DC4-9876-08BAEC204E0E} client.exe - Suspicious use of AdjustPrivilegeToken 30 IoCs
description pid Process Token: 33 1648 client.exe Token: SeIncBasePriorityPrivilege 1648 client.exe Token: 33 1648 client.exe Token: SeIncBasePriorityPrivilege 1648 client.exe Token: 33 1648 client.exe Token: SeIncBasePriorityPrivilege 1648 client.exe Token: 33 1648 client.exe Token: SeIncBasePriorityPrivilege 1648 client.exe Token: 33 1648 client.exe Token: SeIncBasePriorityPrivilege 1648 client.exe Token: 33 1648 client.exe Token: SeIncBasePriorityPrivilege 1648 client.exe Token: 33 1648 client.exe Token: SeIncBasePriorityPrivilege 1648 client.exe Token: 33 1648 client.exe Token: SeIncBasePriorityPrivilege 1648 client.exe Token: 33 1648 client.exe Token: SeIncBasePriorityPrivilege 1648 client.exe Token: 33 1648 client.exe Token: SeIncBasePriorityPrivilege 1648 client.exe Token: 33 1648 client.exe Token: SeIncBasePriorityPrivilege 1648 client.exe Token: 33 1648 client.exe Token: SeIncBasePriorityPrivilege 1648 client.exe Token: 33 1648 client.exe Token: SeIncBasePriorityPrivilege 1648 client.exe Token: 33 1648 client.exe Token: SeIncBasePriorityPrivilege 1648 client.exe Token: 33 1648 client.exe Token: SeIncBasePriorityPrivilege 1648 client.exe