Analysis
- geolocation tags
asiadelhiinindia - max time kernel
899s - max time network
899s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 11:56
Behavioral task
behavioral1
Sample
V logger 5.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
900 seconds
Behavioral task
behavioral2
Sample
V logger 5.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
900 seconds
General
- Target V logger 5.exe
- Size 93KB
- Sample261002-n4dfpazfjb
- SHA256 5f61afa41410577ca24e63815e24d3391e85f64de79038d263d7831a81b54260
- MD5 924f53a0b5cf5a219b45fd5c7fd0ac3e
- SHA1 a15a2b3d3cff82897502dff98704824413dda7d0
- SHA512 0a65e6905d90066b5c0fc15333f10e064ec77612b871faca526a99ed3a5c5f80ff83d49dc123527285eb8d138240ce9b859b7b4346271040d182eb076d6c7db3
- SSDEEP 768:NY33UfhWXxyFcxovUKUJuROprXtWN8eYhYbmXxrjEtCdnl2pi1Rz4Rk3JAVsGdp6:wU5WhIUKcuOJhPhBjEwzGi1dD61D4gS
- TLSH T1CE93E74977E56524E0BF56F79871F2004F74B44B1612E39D48F219AA0A33AC44F89FEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3332 netsh.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V logger 5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5956 V logger 5.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5956 V logger 5.exe Token: 33 5956 V logger 5.exe Token: SeIncBasePriorityPrivilege 5956 V logger 5.exe Token: 33 5956 V logger 5.exe Token: SeIncBasePriorityPrivilege 5956 V logger 5.exe Token: 33 5956 V logger 5.exe Token: SeIncBasePriorityPrivilege 5956 V logger 5.exe Token: 33 5956 V logger 5.exe Token: SeIncBasePriorityPrivilege 5956 V logger 5.exe Token: 33 5956 V logger 5.exe Token: SeIncBasePriorityPrivilege 5956 V logger 5.exe Token: 33 5956 V logger 5.exe Token: SeIncBasePriorityPrivilege 5956 V logger 5.exe Token: 33 5956 V logger 5.exe Token: SeIncBasePriorityPrivilege 5956 V logger 5.exe Token: 33 5956 V logger 5.exe Token: SeIncBasePriorityPrivilege 5956 V logger 5.exe Token: 33 5956 V logger 5.exe Token: SeIncBasePriorityPrivilege 5956 V logger 5.exe Token: 33 5956 V logger 5.exe Token: SeIncBasePriorityPrivilege 5956 V logger 5.exe Token: 33 5956 V logger 5.exe Token: SeIncBasePriorityPrivilege 5956 V logger 5.exe Token: 33 5956 V logger 5.exe Token: SeIncBasePriorityPrivilege 5956 V logger 5.exe Token: 33 5956 V logger 5.exe Token: SeIncBasePriorityPrivilege 5956 V logger 5.exe Token: 33 5956 V logger 5.exe Token: SeIncBasePriorityPrivilege 5956 V logger 5.exe Token: 33 5956 V logger 5.exe Token: SeIncBasePriorityPrivilege 5956 V logger 5.exe Token: 33 5956 V logger 5.exe Token: SeIncBasePriorityPrivilege 5956 V logger 5.exe Token: 33 5956 V logger 5.exe Token: SeIncBasePriorityPrivilege 5956 V logger 5.exe Token: 33 5956 V logger 5.exe Token: SeIncBasePriorityPrivilege 5956 V logger 5.exe Token: 33 5956 V logger 5.exe Token: SeIncBasePriorityPrivilege 5956 V logger 5.exe Token: 33 5956 V logger 5.exe Token: SeIncBasePriorityPrivilege 5956 V logger 5.exe Token: 33 5956 V logger 5.exe Token: SeIncBasePriorityPrivilege 5956 V logger 5.exe Token: 33 5956 V logger 5.exe Token: SeIncBasePriorityPrivilege 5956 V logger 5.exe Token: 33 5956 V logger 5.exe Token: SeIncBasePriorityPrivilege 5956 V logger 5.exe Token: 33 5956 V logger 5.exe Token: SeIncBasePriorityPrivilege 5956 V logger 5.exe Token: 33 5956 V logger 5.exe Token: SeIncBasePriorityPrivilege 5956 V logger 5.exe Token: 33 5956 V logger 5.exe Token: SeIncBasePriorityPrivilege 5956 V logger 5.exe Token: 33 5956 V logger 5.exe Token: SeIncBasePriorityPrivilege 5956 V logger 5.exe Token: 33 5956 V logger 5.exe Token: SeIncBasePriorityPrivilege 5956 V logger 5.exe Token: 33 5956 V logger 5.exe Token: SeIncBasePriorityPrivilege 5956 V logger 5.exe Token: 33 5956 V logger 5.exe Token: SeIncBasePriorityPrivilege 5956 V logger 5.exe Token: 33 5956 V logger 5.exe Token: SeIncBasePriorityPrivilege 5956 V logger 5.exe Token: 33 5956 V logger 5.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5956 wrote to memory of 3332 5956 V logger 5.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\V logger 5.exe"C:\Users\Admin\AppData\Local\Temp\V logger 5.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\V logger 5.exe" "V logger 5.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3332
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3716
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:4940