Analysis
- user interaction
yes - max time kernel
93s - max time network
82s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 11:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
crime crack by nigga rdk.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target crime crack by nigga rdk.exe
- Size 29.3MB
- Sample261014-ndv8tab18y
- SHA256 965aca0171d69f7b37314e2e6ce4eb7045ead32746217ce9837e1119ef6078bb
- MD5 407325cf5c91b118f2c552a54d65eb36
- SHA1 4e257154faa784fdba26ca5f0cc064e6f9d107db
- SHA512 2a4d3415365aa6e30cc1630144fe24411dd0318a3bd2e69a16da432da8e9a602249b61e86bd078e24cc084cfcf5651a1d26741f58582e8092c3a085f0b3347d4
- SSDEEP 393216:bSvahpZCdeKs1QSPAmkZs00GaJT76mhfPAmkgML1:hQZsfJX6QfQZL
- TLSH T1BC67D042F7848EA3C089977985638797D332FC4ABB1317A732987D257E93BD05E26381
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4600 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname crime crack by nigga rdk.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain crime crack by nigga rdk.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe 4560 crime crack by nigga rdk.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4560 crime crack by nigga rdk.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4560 crime crack by nigga rdk.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4560 wrote to memory of 4600 4560 crime crack by nigga rdk.exe 90 PID 4600 wrote to memory of 2912 4600 cmd.exe 92 PID 4600 wrote to memory of 2740 4600 cmd.exe 93 PID 4600 wrote to memory of 5904 4600 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\crime crack by nigga rdk.exe"C:\Users\Admin\AppData\Local\Temp\crime crack by nigga rdk.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\crime crack by nigga rdk.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\crime crack by nigga rdk.exe" MD53⤵PID:2912
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵PID:2740
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵PID:5904
-
-