Analysis
- user interaction
yes - max time kernel
34s - max time network
42s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
24/10/2026, 04:36
General
- Target opencode.exe
- Size 201.9MB
- Sample261024-e8gjgafx7z
- SHA256 41c848c0986720c02d39b015bd2672e454a221052f6947854bc508d8765d9711
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\opencode.exe"C:\Users\Admin\AppData\Local\Temp\opencode.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /d /s /c "npm ^"list^" ^"-g^" ^"--depth=0^""2⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.execmd.exe /d /s /c "yarn ^"global^" ^"list^""2⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.execmd.exe /d /s /c "pnpm ^"list^" ^"-g^" ^"--depth=0^""2⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.execmd.exe /d /s /c "bun ^"pm^" ^"ls^" ^"-g^""2⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.execmd.exe /d /s /c "brew ^"list^" ^"--formula^" ^"opencode^""2⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.execmd.exe /d /s /c "scoop ^"list^" ^"opencode^""2⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.execmd.exe /d /s /c "choco ^"list^" ^"--limit-output^" ^"opencode^""2⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -Command "$global:ProgressPreference = 'SilentlyContinue'; Expand-Archive -LiteralPath 'C:\Users\Admin\.cache\opencode\bin\ripgrep-15.1.0-x86_64-pc-windows-msvc.zip' -DestinationPath 'C:\Users\Admin\.cache\opencode\bin\ripgrep-mTm5CX' -Force"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\.cache\opencode\bin\rg.exeC:\Users\Admin\.cache\opencode\bin\rg.exe --no-config --files --glob=!**/.git/** .2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Users\Admin\.cache\opencode\bin\rg.exeC:\Users\Admin\.cache\opencode\bin\rg.exe --no-config --files --glob=!**/.git/** .2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ripgrep-15.1.0-x86_64-pc-windows-msvc.zip
COPYING
LICENSE-MIT
README.md
UNLICENSE
_rg
_rg.ps1
rg.bash
rg.fish
CHANGELOG.md
FAQ.md
GUIDE.md
rg.1
rg.exe
models.json
opencode.jsonc
.bun-1534026329-3cba9b8dc4fa4e45.node
.bun-1534026329-efb4802116a9c3ef.dll
__PSScriptPolicyTest_uw5255ms.qak.ps1
b7105abb635035a839d9b40f12f16e43b33b7e6440baf14535ca897617d3
c40acea2-890f-4b46-800b-678a8f82861d
e99c6efb-a81a-46e7-b0ea-8a56eff0f69b
fcaa4fd8-d80a-4b04-86e8-ae8d42ecf0e6
memory/796-25-0x000001AC46EC0000-0x000001AC46EE2000-memory.dmp
memory/796-33-0x000001AC47270000-0x000001AC47282000-memory.dmp
memory/796-34-0x000001AC47260000-0x000001AC4726A000-memory.dmp