Analysis
- max time kernel
149s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/10/2026, 07:45
Static task
static1
1 signatures
General
- Target 35fc649622dfea297cb2a37ce2b6a9f89733546a22a5d13410c96ff904126e92.exe
- Size 7.2MB
- Sample261027-jletksbv21
- SHA256 35fc649622dfea297cb2a37ce2b6a9f89733546a22a5d13410c96ff904126e92
- MD5 a6f7e81c2220fc28c311a9ff83e6c6d7
- SHA1 25544e987ba6900d75e464a392349f38a9af9c04
- SHA512 767a591a00c3d609e21fa5c7e492b0142fcdbb4349f945421724a77dfb1b4bda03fab88198b48ce034a3702f8ab26cc8f0f8004f8ed25e37d43a0830415ce366
- SSDEEP 49152:lSpRNckKLiG/vH/DfS6vYVkpA4ciTLXpZAQFVsKm9LikFPlhCmQ35KCK5Kqc6Zk+:lA/NwvHo4TXqKaLHrlXktE
- TLSH T19B764A43ECA919E5C1AED23089A6A513BB717C495B2023D31B90F2347F77BE0ADB9744
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 23 api.ipify.org 24 api.ipify.org - Discovers running processes 1 TTPs 2 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 3796 tasklist.exe 2892 tasklist.exe - Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3648 sc.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3912 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 35fc649622dfea297cb2a37ce2b6a9f89733546a22a5d13410c96ff904126e92.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 35fc649622dfea297cb2a37ce2b6a9f89733546a22a5d13410c96ff904126e92.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3796 tasklist.exe Token: SeIncreaseQuotaPrivilege 948 wmic.exe Token: SeSecurityPrivilege 948 wmic.exe Token: SeTakeOwnershipPrivilege 948 wmic.exe Token: SeLoadDriverPrivilege 948 wmic.exe Token: SeSystemProfilePrivilege 948 wmic.exe Token: SeSystemtimePrivilege 948 wmic.exe Token: SeProfSingleProcessPrivilege 948 wmic.exe Token: SeIncBasePriorityPrivilege 948 wmic.exe Token: SeCreatePagefilePrivilege 948 wmic.exe Token: SeBackupPrivilege 948 wmic.exe Token: SeRestorePrivilege 948 wmic.exe Token: SeShutdownPrivilege 948 wmic.exe Token: SeDebugPrivilege 948 wmic.exe Token: SeSystemEnvironmentPrivilege 948 wmic.exe Token: SeRemoteShutdownPrivilege 948 wmic.exe Token: SeUndockPrivilege 948 wmic.exe Token: SeManageVolumePrivilege 948 wmic.exe Token: 33 948 wmic.exe Token: 34 948 wmic.exe Token: 35 948 wmic.exe Token: 36 948 wmic.exe Token: SeIncreaseQuotaPrivilege 948 wmic.exe Token: SeSecurityPrivilege 948 wmic.exe Token: SeTakeOwnershipPrivilege 948 wmic.exe Token: SeLoadDriverPrivilege 948 wmic.exe Token: SeSystemProfilePrivilege 948 wmic.exe Token: SeSystemtimePrivilege 948 wmic.exe Token: SeProfSingleProcessPrivilege 948 wmic.exe Token: SeIncBasePriorityPrivilege 948 wmic.exe Token: SeCreatePagefilePrivilege 948 wmic.exe Token: SeBackupPrivilege 948 wmic.exe Token: SeRestorePrivilege 948 wmic.exe Token: SeShutdownPrivilege 948 wmic.exe Token: SeDebugPrivilege 948 wmic.exe Token: SeSystemEnvironmentPrivilege 948 wmic.exe Token: SeRemoteShutdownPrivilege 948 wmic.exe Token: SeUndockPrivilege 948 wmic.exe Token: SeManageVolumePrivilege 948 wmic.exe Token: 33 948 wmic.exe Token: 34 948 wmic.exe Token: 35 948 wmic.exe Token: 36 948 wmic.exe Token: SeDebugPrivilege 2892 tasklist.exe Token: SeIncreaseQuotaPrivilege 1468 wmic.exe Token: SeSecurityPrivilege 1468 wmic.exe Token: SeTakeOwnershipPrivilege 1468 wmic.exe Token: SeLoadDriverPrivilege 1468 wmic.exe Token: SeSystemProfilePrivilege 1468 wmic.exe Token: SeSystemtimePrivilege 1468 wmic.exe Token: SeProfSingleProcessPrivilege 1468 wmic.exe Token: SeIncBasePriorityPrivilege 1468 wmic.exe Token: SeCreatePagefilePrivilege 1468 wmic.exe Token: SeBackupPrivilege 1468 wmic.exe Token: SeRestorePrivilege 1468 wmic.exe Token: SeShutdownPrivilege 1468 wmic.exe Token: SeDebugPrivilege 1468 wmic.exe Token: SeSystemEnvironmentPrivilege 1468 wmic.exe Token: SeRemoteShutdownPrivilege 1468 wmic.exe Token: SeUndockPrivilege 1468 wmic.exe Token: SeManageVolumePrivilege 1468 wmic.exe Token: 33 1468 wmic.exe Token: 34 1468 wmic.exe Token: 35 1468 wmic.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4340 wrote to memory of 3796 4340 35fc649622dfea297cb2a37ce2b6a9f89733546a22a5d13410c96ff904126e92.exe 85 PID 4340 wrote to memory of 3912 4340 35fc649622dfea297cb2a37ce2b6a9f89733546a22a5d13410c96ff904126e92.exe 87 PID 4340 wrote to memory of 948 4340 35fc649622dfea297cb2a37ce2b6a9f89733546a22a5d13410c96ff904126e92.exe 88 PID 4340 wrote to memory of 2892 4340 35fc649622dfea297cb2a37ce2b6a9f89733546a22a5d13410c96ff904126e92.exe 89 PID 4340 wrote to memory of 3648 4340 35fc649622dfea297cb2a37ce2b6a9f89733546a22a5d13410c96ff904126e92.exe 90 PID 4340 wrote to memory of 1468 4340 35fc649622dfea297cb2a37ce2b6a9f89733546a22a5d13410c96ff904126e92.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\35fc649622dfea297cb2a37ce2b6a9f89733546a22a5d13410c96ff904126e92.exe"C:\Users\Admin\AppData\Local\Temp\35fc649622dfea297cb2a37ce2b6a9f89733546a22a5d13410c96ff904126e92.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\system32\tasklist.exetasklist /fo csv /nh2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:3796
-
-
C:\Windows\system32\cmd.execmd /c ver2⤵
- Executes a command shell one-liner
PID:3912
-
-
C:\Windows\System32\Wbem\wmic.exewmic OS get TotalVisibleMemorySize /value2⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:948
-
-
C:\Windows\system32\tasklist.exetasklist /FO CSV /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
-
C:\Windows\system32\sc.exesc query "state= all"2⤵
- Launches sc.exe
PID:3648
-
-
C:\Windows\System32\Wbem\wmic.exewmic service where State='Running' get Name2⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1468
-