Analysis
- max time kernel
299s - max time network
293s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/10/2026, 01:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Z#2743130870.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
300 seconds
Behavioral task
behavioral2
Sample
Z#2743130870.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
300 seconds
Behavioral task
behavioral3
Sample
certpick.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
300 seconds
Behavioral task
behavioral4
Sample
rimE.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral5
Sample
rimE.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
300 seconds
General
- Target Z#2743130870.exe
- Size 1.9MB
- Sample261011-cble2styb1
- SHA256 c74f55247aa2c72001024bd977c869cb5adce6f8604a4d32329f015b73ae2a49
- MD5 711cd47d4524145f9c488afecc85ebc7
- SHA1 2f9e5368c039db49018ec41bbb20a3b085788b24
- SHA512 8bf03abb818d6d11f210e17a7e8c8f3c941774390cf0c5e679cb18331089341d43486cdc7af1203b29eac476f2f802f789f17ec6926d17fdd099d13172a79a15
- SSDEEP 24576:DitHbptR5UngkbfXXqO7jiugTdtHxVAuN9AGFwzojqnIXxXi2+QV8epwMGqtc:WtR5UngkzvyPtHxWzojqnIXtl+NeBGqq
- TLSH T105953A203942C13EEA9113718D78EAFA565DAD102F35D1CF63987A6A3B78DC31933627
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation Z#2743130870.exe - Executes dropped EXE 1 IoCs
pid Process 4664 mksSandbox-debug.exe - Loads dropped DLL 2 IoCs
pid Process 4664 mksSandbox-debug.exe 2504 rundll32.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4180 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname mksSandbox-debug.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain mksSandbox-debug.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Z#2743130870.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mksSandbox-debug.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Z#2743130870.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe 4664 mksSandbox-debug.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4664 mksSandbox-debug.exe Token: SeLoadDriverPrivilege 4664 mksSandbox-debug.exe Token: SeTakeOwnershipPrivilege 4664 mksSandbox-debug.exe Token: SeIncBasePriorityPrivilege 4664 mksSandbox-debug.exe Token: SeTcbPrivilege 4664 mksSandbox-debug.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3348 wrote to memory of 4664 3348 Z#2743130870.exe 91 PID 4664 wrote to memory of 4180 4664 mksSandbox-debug.exe 100 PID 4180 wrote to memory of 2504 4180 cmd.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\Z#2743130870.exe"C:\Users\Admin\AppData\Local\Temp\Z#2743130870.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\ProgramData\N#{%$,`&{{&P\mksSandbox-debug.exe"C:\ProgramData\N#{%$,`&{{&P\mksSandbox-debug.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start "" "C:\Windows\SysWOW64\rundll32.exe" "C:\ProgramData\N#{%$,`&{{&P\RIME.dll",_vmclientcore@16 "C:\ProgramData\N#{%$,`&{{&P\mksSandbox-debug.exe"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\ProgramData\N#{%$,`&{{&P\RIME.dll",_vmclientcore@16 "C:\ProgramData\N#{%$,`&{{&P\mksSandbox-debug.exe"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2504
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\N#{%$,`&{{&P\mksSandbox-debug.exe
- Size 1.9MB
- SHA256 c74f55247aa2c72001024bd977c869cb5adce6f8604a4d32329f015b73ae2a49
- MD5 711cd47d4524145f9c488afecc85ebc7
- SHA1 2f9e5368c039db49018ec41bbb20a3b085788b24
- SHA512 8bf03abb818d6d11f210e17a7e8c8f3c941774390cf0c5e679cb18331089341d43486cdc7af1203b29eac476f2f802f789f17ec6926d17fdd099d13172a79a15
- SSDEEP 24576:DitHbptR5UngkbfXXqO7jiugTdtHxVAuN9AGFwzojqnIXxXi2+QV8epwMGqtc:WtR5UngkzvyPtHxWzojqnIXtl+NeBGqq
- TLSH T105953A203942C13EEA9113718D78EAFA565DAD102F35D1CF63987A6A3B78DC31933627
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\N#{%$,`&{{&P\riME.dll
- Size 3.4MB
- SHA256 4c939547cdfa87e7d732c55ade2cf98e9eedd7559d18a65c150c2f6e3685aa58
- MD5 960846b9ea93b14bde8cdcfcb492140b
- SHA1 941f455e95eca78ec56fc09815dc8db919e18a5f
- SHA512 14a6fd284794961dd93443d473677aad1db4c9a080806c962cda5dec8165fbf74633a8ed736a80e5eaca001215097c3f3b7016a70f12ae7072355ed649a77f56
- SSDEEP 98304:CWCPEp3NBOMoNxY9J4SwEi8qmlNOZxOs3gz5da2aUydgHG:O5QCv8qmlNOPtgzzcG
- TLSH T1A3F5E12379D4807AC26F02704E6F776D72FDA5704D3545AB36C86E2C6DB08A2763C6A3
- MD5 SHA1 SHA512 SSDEEP TLSH