2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 11:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Size 1.0MB
Sample261017-m6vx3sstdt
SHA256 2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0
MD5 0675a95458435e1b2592f255d5dce2f9
SHA1 681eea199dcaef6bfb7677cde9e201cd8f9157a9
SHA512 1447297044d83bfb9f926b75f5f72674c6f559987c5ff77fba4770e155178f62105c90070fd7b1d494b5f5b18002119c3605a839784103a152cbd7fba2222ac3
SSDEEP 24576:XTRRgkObgBSIiZOWrkjRz0Cvx5CpEUv8YGkK3vPd2Pg6ZPk:XTznniDMroRDK3v1OXt
TLSH
T1F83533721F34A623CDC355BF7FB25EAED0269D43257A472563EE4CC4B827288D6B5082
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3796	sg.tmp
1288	priprinter.pro-patch.exe

Loads dropped DLL 1 IoCs

pid	Process
1288	priprinter.pro-patch.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2440-0-0x0000000000400000-0x000000000056C000-memory.dmp	upx
behavioral1/memory/3880-6-0x0000000000400000-0x000000000056C000-memory.dmp	upx
behavioral1/memory/3880-8-0x0000000000400000-0x000000000056C000-memory.dmp	upx
behavioral1/memory/2440-47-0x0000000000400000-0x000000000056C000-memory.dmp	upx
behavioral1/memory/1884-49-0x0000000000400000-0x000000000056C000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3520	cmd.exe
4484	cmd.exe
868	cmd.exe
2920	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	priprinter.pro-patch.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
4764	taskkill.exe
4940	taskkill.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeBackupPrivilege	2440	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: SeRestorePrivilege	2440	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: 33	2440	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: SeIncBasePriorityPrivilege	2440	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: 33	2440	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: SeIncBasePriorityPrivilege	2440	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: 33	2440	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: SeIncBasePriorityPrivilege	2440	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: SeBackupPrivilege	3880	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: SeRestorePrivilege	3880	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: 33	3880	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: SeIncBasePriorityPrivilege	3880	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: 33	2440	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: SeIncBasePriorityPrivilege	2440	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: SeRestorePrivilege	3796	sg.tmp
Token: 35	3796	sg.tmp
Token: SeSecurityPrivilege	3796	sg.tmp
Token: SeSecurityPrivilege	3796	sg.tmp
Token: 33	2440	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: SeIncBasePriorityPrivilege	2440	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: SeDebugPrivilege	4764	taskkill.exe
Token: SeDebugPrivilege	4940	taskkill.exe
Token: 33	2440	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: SeIncBasePriorityPrivilege	2440	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: SeBackupPrivilege	1884	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: SeRestorePrivilege	1884	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: 33	1884	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
Token: SeIncBasePriorityPrivilege	1884	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 4484	2440	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe	84
PID 2440 wrote to memory of 3880	2440	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe	87
PID 2440 wrote to memory of 3796	2440	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe	90
PID 2440 wrote to memory of 868	2440	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe	92
PID 868 wrote to memory of 4764	868	cmd.exe	94
PID 868 wrote to memory of 4940	868	cmd.exe	96
PID 868 wrote to memory of 2920	868	cmd.exe	97
PID 2920 wrote to memory of 4784	2920	cmd.exe	98
PID 868 wrote to memory of 4212	868	cmd.exe	99
PID 868 wrote to memory of 1752	868	cmd.exe	100
PID 868 wrote to memory of 2884	868	cmd.exe	101
PID 868 wrote to memory of 1288	868	cmd.exe	102
PID 2440 wrote to memory of 1884	2440	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe	103
PID 1884 wrote to memory of 3520	1884	2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe	104

C:\Users\Admin\AppData\Local\Temp\2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
"C:\Users\Admin\AppData\Local\Temp\2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c set
  2⤵
  - Executes a command shell one-liner
  PID:4484
- C:\Users\Admin\AppData\Local\Temp\2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
  PECMD**pecmd-cmd* PUTF -dd -skipb=1020928 -len=60695 "C:\Users\Admin\AppData\Local\Temp\~3589467074925120394.tmp",,C:\Users\Admin\AppData\Local\Temp\2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3880
- C:\Users\Admin\AppData\Local\Temp\~3817232375956583038~\sg.tmp
  7zG_exe x "C:\Users\Admin\AppData\Local\Temp\~3589467074925120394.tmp" -y -aoa -o"C:\Users\Admin\AppData\Local\Temp\~7596115022031219223"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\~7596115022031219223\pripath.cmd""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Windows\system32\taskkill.exe
    TASKKILL /F /IM priPrinter.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4764
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im pritray.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c Reg.exe query "HKCU\Software\Pelikan Software KFT\priPrinter" /ve
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Windows\system32\reg.exe
      Reg.exe query "HKCU\Software\Pelikan Software KFT\priPrinter" /ve
      4⤵
      PID:4784
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\Software\Pelikan Software KFT\priPrinter\reg" /v "key" /t REG_SZ /d "LLU65CFE11W04WJF454QF8QF2DJW5U3NZL0000006Z1J1WL3JNF2GSAQJ3FWGN04EF000000#999" /f
    3⤵
    PID:4212
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\Software\Pelikan Software KFT\priPrinter\reg" /v "user" /t REG_SZ /d "[email protected]" /f
    3⤵
    PID:1752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo."
    3⤵
    PID:2884
- - C:\Users\Admin\AppData\Local\Temp\~7596115022031219223\priprinter.pro-patch.exe
    priprinter.pro-patch.exe /silent /overwrite /startupworkdir:""
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1288
- C:\Users\Admin\AppData\Local\Temp\2132778db8dfc49c0cf1f29862cec785d17be804d0a5da86ac0735b0cceac8c0.exe
  PECMD**pecmd-cmd* EXEC -wd:C: -hide cmd /c "C:\Users\Admin\AppData\Local\Temp\~128039270403247037.cmd"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\~128039270403247037.cmd"
    3⤵
    - Executes a command shell one-liner
    PID:3520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dup2patcher.dll

Path C:\Users\Admin\AppData\Local\Temp\dup2patcher.dll
Size 56KB
SHA256 354acda1219410085896e42039a5611d867a608b3c1b7699afd241449f32f644
MD5 4a5fa04d56773a2945572a71ab0e95a1
SHA1 64002b9d189bd8739b68abcdce9e742418a19866
SHA512 ec86d5b285b8a969e91f0232f109e9968a3b2cb7bd4366b82052fa06787c945a99b48fe3756296ea7739ec04e56644a43527cac1882e5a4723f6a4e5b891e22f
SSDEEP 768:5dqDhNM0fB5eI+X4BoePeye6eyeqeSeaege6Rsllp8ZQhdokI:YNTilc2ldltF9j6RW8ChdRI
TLSH
T16B43E6586D5B86BDC34047352CD99E6086785F31E650E113AF3C2E2C2F25A93EB2BD32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~128039270403247037.cmd

Path C:\Users\Admin\AppData\Local\Temp\~128039270403247037.cmd
Size 373B
SHA256 0471d9fb949068cc93ff7a966356fd3d3b9755aa04a2515565905cec5ddef48b
MD5 2b8252fa134362e64165616fbd15a61a
SHA1 0ad1a05abb8d4bd51abd341958fe5333983cd25a
SHA512 b4a0853b5dfab6e6b30bb381368e1606117a9b3d73493346e9f041bbf9a79e4b12923894b8273f64d8a633457fafdea93fd9efca6eae18c10ed7bd68e30a867a
TLSH
T17DE0684A608A8FBE0C11B4E706EB804CC194C81A2F88BB8841B024083143684D2DBECA
MD5 SHA1 SHA512 TLSH

Submit Download

~3589467074925120394.tmp

Path C:\Users\Admin\AppData\Local\Temp\~3589467074925120394.tmp
Size 59KB
SHA256 5ecb1cf257a8cf0da0c2364acd1a228d960f70cadaab1b3004d7b8bb393e4c96
MD5 17f0656066f12573ae95570d9c626fb8
SHA1 103ceb098af00c227fcff30ab2af06a75814b2b7
SHA512 a39dd25f411198fffb5e65569254bddf3c774bfa2f07f2d2f085bfac72bdf38677ebe76e00915d5506856c14e1b68bf2b1d7455342e3b37cd4c41b54a00e62cf
SSDEEP 768:hjwP0pBVSwx/uvuPBDUyL8Daw3nyGmRCAd0wO2cEqOpz6n0tIq8HiuEeV2CJ7fd:B40pjbx/zDUyL2PPmMq+E5h6n0t5uEwf
TLSH
T19553028620126DF84F2FB4BFC2B9EFCD57012D43416C92965F06FD889B0659C6BAD42B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sg.tmp

Path C:\Users\Admin\AppData\Local\Temp\~3817232375956583038~\sg.tmp
Size 829KB
SHA256 d735780f64cc6d1b98fdf737eb1117d07ddc65777df1843742a8c7e2295f2d8b
MD5 bc57ce177a5f3d52dbccd96498b7e0a6
SHA1 e499f4a51c7c82e1edd8b96ba17df1d779267cf4
SHA512 841f8112eb46883a32264694096bdb06d2877f7337a7e781905797d23d2a5657371454d777829e4a0523d262a48cd9794d13db2b51ec0bb49f2fc8797601d4b5
SSDEEP 24576:a9wBv4Tg0Jf6RazsshjFm/OJv5PkjZLmkMhgT92:a9g4lf6ATJQOb+iB
TLSH
T13005AF227BE5D0BBC24201318B1D7BF581F993680B2148C767908F6D7F359D6DA3AA1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pripath.cmd

Path C:\Users\Admin\AppData\Local\Temp\~7596115022031219223\pripath.cmd
Size 651B
SHA256 500548ccbb4714613b24855f2fc0fac435f29c136227cd839346d0f2b6cd1d0c
MD5 da78eb30c21af12a42e8488a98bbf9b0
SHA1 41b1016e2718986f58e127ed58d63323cbab29f2
SHA512 f0e71bceefe8096586cfdd1f3b3fd879f1c40353f89b3a36f2d9d1fb98f3c32ba405eec6c2db456c12f8c6c1e7d81391a7b5347daef09d8e3dd660692317ea20
TLSH
T1F4F0F941341F2920D48006B6C727210AAEBFFBCA9EF01BC13339B09E202300098383EE
MD5 SHA1 SHA512 TLSH

Submit Download

priprinter.pro-patch.exe

Path C:\Users\Admin\AppData\Local\Temp\~7596115022031219223\priprinter.pro-patch.exe
Size 62KB
SHA256 30aba08cc3234ac4d446320cfa430c09fb37dadf1b0d1b6e132fa0ca50f04c1b
MD5 2fd8e4f6cd945a76d2e8539288aa6e6b
SHA1 10a570cb0cde59a9b93c5c99801e6a08e2c26e9d
SHA512 c29af44b536e2bc660d535c75df5174714edb2173ab05f42db2bf5498927bf261869f2bcb91f15d769b5a921a2fe1de1fb5bc5255130c73fb53afa2120c9e6c0
SSDEEP 1536:n1pG4kHYksunkd3oTE3/cC4hC+YHTu90gf30a20JC:/T8nkBhoC+YHTuDcG
TLSH
T12253F115B28705DFD25CCC7347979DF4BF7A9C5B60712A5AB3C92B680F232AAC15103A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~~6416765624481141583.tmp

Path C:\Users\Admin\AppData\Local\Temp\~~6416765624481141583.tmp
Size 134B
SHA256 fc627800b37568d335b3b9cb61bedd6b5a5830f30b8b83395ff7fd13fb2c1d6d
MD5 b06973d4b2358f6f1f62cd52cd97d019
SHA1 e03ceeef6b050aed5d092d4fbc7ac8ffb06af935
SHA512 747abac5ad0ba54b509d760c60acd6446acf768d7b5719866f8fbc6c84922e82c7e6dc5164306dd86f4f2823122e9188d68c17c2670664ef6b1f2c4783fe33aa
TLSH
T191C02B503C32CA285C832EC280C2F6E41F2BC21680B141578B21986506513EE01B80C4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1288-33-0x00000000740F0000-0x0000000074116000-memory.dmp

Download

memory/1884-49-0x0000000000400000-0x000000000056C000-memory.dmp

Download

memory/2440-0-0x0000000000400000-0x000000000056C000-memory.dmp

Download

memory/2440-47-0x0000000000400000-0x000000000056C000-memory.dmp

Download

memory/3880-8-0x0000000000400000-0x000000000056C000-memory.dmp

Download

memory/3880-6-0x0000000000400000-0x000000000056C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads