fde04da765f8d8cf03b69f4acc7917471d00b6415e8673847743dce14eb2db6e

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 08:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fde04da765f8d8cf03b69f4acc7917471d00b6415e8673847743dce14eb2db6e.exe
Size 1.0MB
Sample261027-ket6csda83
SHA256 fde04da765f8d8cf03b69f4acc7917471d00b6415e8673847743dce14eb2db6e
MD5 215fe10b3c859dc16f4240e36334eb13
SHA1 2eae6fc5a3ae5e21c02d28ec2bf2777011bf6357
SHA512 5d8072f4825d1876e4cebdd4f04b60961206711f5cd2cd72187c6c94f8fdf8244744ab2a38e081c98e848a204543c8a90f34a0f95633d960496253c450c3797c
SSDEEP 24576:weNgO+uQL4ZsrHFvU9N+9vV5BuhQAUo7IW6hggepjfJcpjvMOREcW:wPO+uQL4mUe/Buh4rjvl/W
TLSH
T132259E11B68281F6F64A19B004F66737EA3A96870B12CFD7E7A4DD385C33591E13B21E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
788	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fde04da765f8d8cf03b69f4acc7917471d00b6415e8673847743dce14eb2db6e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3816	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3816	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5064	fde04da765f8d8cf03b69f4acc7917471d00b6415e8673847743dce14eb2db6e.exe
5064	fde04da765f8d8cf03b69f4acc7917471d00b6415e8673847743dce14eb2db6e.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 788	5064	fde04da765f8d8cf03b69f4acc7917471d00b6415e8673847743dce14eb2db6e.exe	92
PID 788 wrote to memory of 3816	788	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\fde04da765f8d8cf03b69f4acc7917471d00b6415e8673847743dce14eb2db6e.exe
"C:\Users\Admin\AppData\Local\Temp\fde04da765f8d8cf03b69f4acc7917471d00b6415e8673847743dce14eb2db6e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c update.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:788
- - C:\Windows\SysWOW64\taskkill.exe
    Taskkill /f /im fde04da765f8d8cf03b69f4acc7917471d00b6415e8673847743dce14eb2db6e.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update.bat

Path C:\Users\Admin\AppData\Local\Temp\update.bat
Size 391B
SHA256 d50ae004e0b0f4d712eae8a95b734ce49b15d538ae1a298a1505c6c68c983899
MD5 6ccd051196ce919c0f247e3f1721b4af
SHA1 4a2d7baf8f18a132c12146db02469453c33b650b
SHA512 4940e89a93a30f0a62f628de1ea29d02a9be287c4986946dbaca2e034cb67d3eab9adbbafc1553a76cf2910741f77c2450311ec5d6927e9b9fa0db675c6701e0
TLSH
T1B3E0650B880403A2C80B548B03D93C15F0E5B93173CA4494CA5EC6E4B12361DA6066D8
MD5 SHA1 SHA512 TLSH

Submit Download