Analysis
- max time kernel
149s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
02/11/2026, 04:28
General
- Target PO10007592_POU100075927.js
- Size 4.0MB
- Sample261102-e3mtaszyfy
- SHA256 0b408a7581c21aa12b9f259669876759ed13d877b1f7a3358a6bdc0d6e6e8ba5
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- NTFS ADS 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\PO10007592_POU100075927.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c echo. > "C:\Users\Admin\AppData\Local\Temp\PO10007592_POU100075927.js:Zone.Identifier"2⤵
- Executes a command shell one-liner
- NTFS ADS
-
-
C:\Users\Admin\Documents\QRNBQKDYNRFFJKDY.exe"C:\Users\Admin\Documents\QRNBQKDYNRFFJKDY.exe" C:\Users\Admin\Documents\YDKJFFRNYDKQBNRQ2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2JavaScript
1Windows Command Shell
1Replay Monitor
Loading Replay Monitor...
Downloads
QRNBQKDYNRFFJKDY.exe
YDKJFFRNYDKQBNRQ
memory/5020-11-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-12-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-13-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-14-0x0000000002590000-0x0000000002591000-memory.dmp
memory/5020-17-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-16-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-15-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-18-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-19-0x0000000002880000-0x0000000002881000-memory.dmp
memory/5020-20-0x0000000002890000-0x0000000002891000-memory.dmp
memory/5020-21-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-23-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-22-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-36-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-74-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-73-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-72-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-71-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-70-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-69-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-68-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-67-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-66-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-65-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-64-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-63-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-62-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-61-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-60-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-59-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-58-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-57-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-56-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-55-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-54-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-53-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-52-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-51-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-50-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-49-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-48-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-47-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-46-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-45-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-44-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-43-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-42-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-41-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-40-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-39-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-38-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-37-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-35-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-34-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-33-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-32-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-31-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-30-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-29-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-28-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-27-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-26-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-25-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/5020-24-0x000000007FE40000-0x000000007FE50000-memory.dmp