3888e2efc22669bfcccbb34cbfdebedb33914fbdf3765f737625755f2b4e3938

Resubmissions

02/11/2026, 04:57

261102-fld1haez7z7

02/11/2026, 04:31

261102-e5f4jasw3r10

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3888e2efc22669bfcccbb34cbfdebedb33914fbdf3765f737625755f2b4e3938.exe
Size 366KB
Sample261102-e5f4jasw3r
SHA256 3888e2efc22669bfcccbb34cbfdebedb33914fbdf3765f737625755f2b4e3938
MD5 fa9a74cfeb4fcf1e831634bc51dd1eb0
SHA1 2dbe9e46547cf9f2e1d0841798c4fd8ea93f1ae6
SHA512 9346c5d031dfc403ccaec5a3c1f0f02843a1eecc686efe2dfcf22eb779b659856b3649d837eceae2fe69f92d95411ab1f666c901838710a0f62e204e0f3c8e80
SSDEEP 6144:0tH/xNLaAOvIBd7lAAxWS1elIoSNzT+tMXcuq/QIx4UNeMn:0tH5NLaAdDhAAEIFNT+t5PYe4dg
TLSH
T14C84D102B9C189B2D52218335A259F20B67C7C301F668DDBA3D46D5DEE361C09736BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	3888e2efc22669bfcccbb34cbfdebedb33914fbdf3765f737625755f2b4e3938.exe

Executes dropped EXE 1 IoCs

pid	Process
4136	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3888e2efc22669bfcccbb34cbfdebedb33914fbdf3765f737625755f2b4e3938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings	3888e2efc22669bfcccbb34cbfdebedb33914fbdf3765f737625755f2b4e3938.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 4136	4464	3888e2efc22669bfcccbb34cbfdebedb33914fbdf3765f737625755f2b4e3938.exe	83
PID 4464 wrote to memory of 4996	4464	3888e2efc22669bfcccbb34cbfdebedb33914fbdf3765f737625755f2b4e3938.exe	85

C:\Users\Admin\AppData\Local\Temp\3888e2efc22669bfcccbb34cbfdebedb33914fbdf3765f737625755f2b4e3938.exe
"C:\Users\Admin\AppData\Local\Temp\3888e2efc22669bfcccbb34cbfdebedb33914fbdf3765f737625755f2b4e3938.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Users\Admin\AppData\Local\Temp\ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
  "C:\Users\Admin\AppData\Local\Temp\ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe"
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe

Path C:\Users\Admin\AppData\Local\Temp\ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
Size 108KB
SHA256 2f5a73ddcace0dc55bd5240551003255bf8873e52878d2476d39deafc9b9c2ee
MD5 b5722c02acf5ba01efeceec314136378
SHA1 028ed50b8b3846f6531dd1a0c96bcfe7a602e65a
SHA512 2f672a62f71616e8af5e87aadceda55da7ed6f561e65c19354bb4dc180742ad602fc0b32fd220f18351db307cce6e1d7d7f5fe9d6ccbc360665994bd8f251027
SSDEEP 3072:tjNuE0jFJK6jYokyCSQnL3EUYlAGt+Cf:/JoHBzCSuE
TLSH
T1E2B35B57A7A530F8F5B7467888510A49D772783217B1AFEF03A4468A1F236D18E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.txt

Path C:\Users\Admin\AppData\Local\Temp\ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.txt
Size 12B
SHA256 0e3c27ec36d0b1e464b40c47b1bac3d289283209ce8c64c783c3f932d1a94aa9
MD5 77c95249036662f0bbf64165c2daa9f4
SHA1 252cb45545fd1751668dea20c4695b592389e83a
SHA512 01b7098360b09e7b875221b98948ecdee0ce4445428abc2664aca043c29c93577190b54ebcc69ae0a0c06ea61485641f7fa6a86b44ce37ec1bf386200aae5a3a
MD5 SHA1 SHA512