78598bd59a57336234cf2767b858cddc74ecdac16b3c05d93463376368c30a96

Analysis

user interaction
yes
max time kernel
4s
max time network
6s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Register Game.exe
Size 453KB
Sample261012-wbc88adv2v
SHA256 78598bd59a57336234cf2767b858cddc74ecdac16b3c05d93463376368c30a96
MD5 0579b8c677af29a747e7e2ae00eba0f5
SHA1 7ceefaf975688fafb2b41e84cfe3ec3bf4d3716a
SHA512 cc49e20d54c57fb6b4a71f70ec6d02c5d61fc94953a8f1733eab00a57af1dfb769c67a6e9254f66ac830e53839ac22c31ec868fcee46dbcfe23a70e642869922
SSDEEP 6144:h5aWbksiNTBQF6dZw3kE/vYjvAVvrB1oq+Y1jJ3IGErBsSun0RlhzuTw+dRhkwPq:h5atNTOFRUE/GvUhfN4/rBjI0Fe7hrg
TLSH
T178A41250B2E102F3E6F2057304A66569CA39733C8768E9D7D35C29827A52BE4873D3F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5304	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Register Game.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 5304	3864	Register Game.exe	89
PID 5304 wrote to memory of 3344	5304	cmd.exe	90
PID 5304 wrote to memory of 3184	5304	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\Register Game.exe
"C:\Users\Admin\AppData\Local\Temp\Register Game.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\FC48.tmp\FC49.tmp\FC4A.bat "C:\Users\Admin\AppData\Local\Temp\Register Game.exe""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5304
- - C:\Windows\system32\fsutil.exe
    FSUTIL dirty query C:
    3⤵
    PID:3344
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EscapeFromTarkov" /f /v "InstallLocation" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Install_EFT"
    3⤵
    PID:3184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FC4A.bat

Path C:\Users\Admin\AppData\Local\Temp\FC48.tmp\FC49.tmp\FC4A.bat
Size 1KB
SHA256 8d7a7d686e16b4241df7ab8e4e2b883f4ef41954e760b7f51476815cef67bfaa
MD5 439c0f918fa88a3655f937a461f58d51
SHA1 02cb8bfbee375d2ff221fad7548ef161d7aa03e3
SHA512 ea1cf650b12e14d6afc44b7e35e13b12013cff6370046ed134695ea52274c105efd836fe20ee7e3df4fd3a0392cdb576f8f21d52cb61dc4a949b52f608ce0826
TLSH
T1DA217249BC1761333742524F471B6C03A55E800F7911E7C071C79539221A8CDAAFEBD7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3864-0-0x0000000000417000-0x0000000000418000-memory.dmp

Download