e71ef24a6bd722ac89aa6a058c7ac965fdb67f2516fa600878aeadfea0f84875

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/10/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e71ef24a6bd722ac89aa6a058c7ac965fdb67f2516fa600878aeadfea0f84875.exe
Size 4.1MB
Sample261015-pc1mkstvds
SHA256 e71ef24a6bd722ac89aa6a058c7ac965fdb67f2516fa600878aeadfea0f84875
MD5 71e629bc136da9f7a76574d9457c7eb7
SHA1 ea1c0e8d1590c620abbd8b137cab72643f6b7e4c
SHA512 69eee314a20d1e19f3fa08f65b83f36e7b970061c3895fc0b89ec6c9257fdfe32c0219a5b352ed5897d39fdf975b0ac3cf05d1558734bb45ac6c2c1044a898af
SSDEEP 49152:BK+Ei2CPkoI/uCA7fBOh7Jktv3zsMNnZfu8wLo4Wkc/bf7T49x+G10ALAiwFgskx:BvsD43wl2/7Y+1AUQBddc8Z
TLSH
T19D166B0593A401A5EF6AD674892D8332CAB0BC5D5E34C30F05D9F5361E33A929BEB736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	e71ef24a6bd722ac89aa6a058c7ac965fdb67f2516fa600878aeadfea0f84875.exe

C:\Users\Admin\AppData\Local\Temp\e71ef24a6bd722ac89aa6a058c7ac965fdb67f2516fa600878aeadfea0f84875.exe
"C:\Users\Admin\AppData\Local\Temp\e71ef24a6bd722ac89aa6a058c7ac965fdb67f2516fa600878aeadfea0f84875.exe"
1⤵
- Checks computer location settings
PID:4388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4388-0-0x000001985F3C0000-0x000001985F3D0000-memory.dmp

Download