150c7baa3126ad2c4e7b498a73216d63e0c305345ef5f34d4a2b69f159fd78ad

Analysis

max time kernel
150s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 10:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
150c7baa3126ad2c4e7b498a73216d63e0c305345ef5f34d4a2b69f159fd78ad.exe
Size 241.7MB
Sample261030-l5y3nsbs8v
SHA256 150c7baa3126ad2c4e7b498a73216d63e0c305345ef5f34d4a2b69f159fd78ad
MD5 5e88d27fdde3b1d8063249eb4dffa76d
SHA1 7384a4af66636a493bf6db2d5423fdf29c9308fb
SHA512 607f8ef706ae2dcf8c2d6b497267aec76b91f5ea7db858cdcb26a7250939d489c5b4766a81effad31a2e918427b705fc7d0846acde470b2be33113cc574a6b8e
SSDEEP 1572864:5tNrZ70To/7NdTcSIsa+9taciFTHCgKrKLtHxL5aX2fDLCTT47RBmIQ1v4YKhXSL:GTjFeCtHx9O2fDaT4VBmRPK+bj
TLSH
T1D5C8BE4BF2E21058E1BAC035863766625636B8862F18D5EF31944F3D2E62EC05F7973B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	150c7baa3126ad2c4e7b498a73216d63e0c305345ef5f34d4a2b69f159fd78ad.exe

Loads dropped DLL 3 IoCs

pid	Process
732	150c7baa3126ad2c4e7b498a73216d63e0c305345ef5f34d4a2b69f159fd78ad.exe
4608	150c7baa3126ad2c4e7b498a73216d63e0c305345ef5f34d4a2b69f159fd78ad.exe
4608	150c7baa3126ad2c4e7b498a73216d63e0c305345ef5f34d4a2b69f159fd78ad.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	150c7baa3126ad2c4e7b498a73216d63e0c305345ef5f34d4a2b69f159fd78ad.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	150c7baa3126ad2c4e7b498a73216d63e0c305345ef5f34d4a2b69f159fd78ad.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	150c7baa3126ad2c4e7b498a73216d63e0c305345ef5f34d4a2b69f159fd78ad.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	150c7baa3126ad2c4e7b498a73216d63e0c305345ef5f34d4a2b69f159fd78ad.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 732 wrote to memory of 4608	732	150c7baa3126ad2c4e7b498a73216d63e0c305345ef5f34d4a2b69f159fd78ad.exe	85

C:\Users\Admin\AppData\Local\Temp\150c7baa3126ad2c4e7b498a73216d63e0c305345ef5f34d4a2b69f159fd78ad.exe
"C:\Users\Admin\AppData\Local\Temp\150c7baa3126ad2c4e7b498a73216d63e0c305345ef5f34d4a2b69f159fd78ad.exe"
1⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:732
- C:\Users\Admin\AppData\Local\Temp\150c7baa3126ad2c4e7b498a73216d63e0c305345ef5f34d4a2b69f159fd78ad.exe
  C:\Users\Admin\AppData\Local\Temp\150c7baa3126ad2c4e7b498a73216d63e0c305345ef5f34d4a2b69f159fd78ad.exe serve --service
  2⤵
  - Checks computer location settings
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  PID:4608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

highlights.json

Path C:\Users\Admin\.local\state\neyino\latest\tui\highlights.json
Size 16B
SHA256 7881dbcb518091f4d7e2873a0aca1db59ba266b61b088a93b711bbe45fdeebf4
MD5 7ccb9a557cfcdca101aa9fa0185f3b3f
SHA1 78a1c9fe4d1f9b330868fa42ac4f581d0f6a5199
SHA512 9a5fb8d1e6b5e492fcaabf6e638a33a4fbadcd9f1bcdd4ac1fa8793c36af0a8567078bf49929b12d2ceb1144b2d92dcbba45d10d1aa76432d8544f07d85b81dc
MD5 SHA1 SHA512

Submit Download

service.json

Path C:\Users\Admin\.local\state\neyino\service.json
Size 162B
SHA256 32142e93aefcb326f866a8560b7fcaeb04d8fbbfc6edb080f51efbe31f45f0ee
MD5 46b3e9a5311ec6a493539c505d02b372
SHA1 504c4294fd5913faaf2fc8c6942fd819d41808f4
SHA512 51dcca16d3ecee2e6e5746ad0fe4a8e4afd23809a03269f429e5bc1346fb43cdfb2c7c6f4d314751b711fde4a7ee6265387703523ea3e033ae9b7da6671a0ebe
TLSH
T1EDC0801F11905355A515895570558415EA4690494211144DA341FE098530D55D614A85
MD5 SHA1 SHA512 TLSH

Submit Download

.bun-1534026329-3cba9b8dc4fa4e45.node

Path C:\Users\Admin\AppData\Local\Temp\.bun-1534026329-3cba9b8dc4fa4e45.node
Size 506KB
SHA256 a8199cf7b6c5102267a5889f80321a4cc92e631d7504c474d32a35b4d440f315
MD5 34581748f55c388cd744f152e065bd0c
SHA1 95c5394ad0a174184b808c17d1eb5fc71593d7de
SHA512 b5b8ab91947a2b06bd7ef097855b0cf19dfbf3b9e93b33d02b57cbdac4ed0b7d82004665123a1ee6c5a880b80d7cd9df9ad202fa179731b2045b0ae11e1c69f3
SSDEEP 6144:jk4bH+DHWwaMfPvMpRIO8kM4dac5mlMH1BVLI6vuLlKIdM1sj3vy8BK:N+rWgcc6hdac5mSrVLIUuLlzqsDpU
TLSH
T19BB47D6AA2A803B8D4ABD17CCA574903F77578460761DBDF03E086761F27BE15A7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.bun-1534026329-b27e8b46b9d63386.dll

Path C:\Users\Admin\AppData\Local\Temp\.bun-1534026329-b27e8b46b9d63386.dll
Size 4.9MB
SHA256 f3f6636ecb4967cf361bf837360dc4f6ea7871d4e233e1886dedb98b0ac10d9c
MD5 fcb33be7686ce4b138ad5e0912b55cd9
SHA1 619345bf9d7d01dde9314c10cc2142a956722e07
SHA512 2790510d12fe58e38664ef17f71dd09df86caabf4c14760ee2c2658f8988a85ad23949454d8d1c5ee9d7906c98a6a9705ad488b9f9d9ad600b0e8d86c711c9a7
SSDEEP 98304:gCCLDsWb/+fe/5Be+/f8com5oaiCJ/8E8fVhc:GLre+/X8c
TLSH
T1BA367D4BB1A3657DC02AC034835B9763E67938490710ACFF11D4A9343E96AF25F397EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads