Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/11/2026, 06:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe
- Size 592KB
- Sample261102-hebynstt5m
- SHA256 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5
- MD5 f8dc955eae32bb527fc828e0ba41d583
- SHA1 175b83aa0954661051192f010795cebdfc2c9d48
- SHA512 539102dd2740d86964ecd0d0dd0ffebf3ad900b92ea7d443e1ac6dbc05361c4f30f00c6f3b5cca39e47c7c0a5377f60f83e83868ee5ce10ff50719fc0a0f1e51
- SSDEEP 6144:GwhU/ozDR+0xmnm3Mm6da8hBZ/gXl4Wl2+tAOFsesj0a1zrVs3ZH0Eym:VZz9HO+36daE/ol4uLtM1zrVs3Um
- TLSH T12FD48C05FAF2C1B2C9A701B50C65D71E5536E8651B250FE7FBC80F2E8E213C1AE7A169
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe - Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\tkjsidfsd 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4524 wrote to memory of 2252 4524 0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe"C:\Users\Admin\AppData\Local\Temp\0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\0402dbb56a3fbff3282124f533ddd05de07836ff9bade4ee1beacac961dbd3e5.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2252
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\tkjsidfsd
- Size 70B
- SHA256 36e1ff2dfbe2d16e3b221072e4b43a1ddff68b406d6b326b9e583575d31bc513
- MD5 2afa89ac67bf531fac347116911ec0ff
- SHA1 c129c9a409dd88acab252474dc68a0b38f5a75b6
- SHA512 8635701705a8fa8a19cc6e9f713eb14e3e58a6b4a5924d13dee19829bdd02c53ff3bcff9f4571c9c3bdc8fa9f2d28d59891b0cae939a5359e23983a2900d52f6
- TLSH T15BA001000C36001082A36C40402C0A88600B6AB0E328F5AA7225C6005022C798852944
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\tkjsidfsd
- Size 117B
- SHA256 6eca0b7273c1bd9cf579c8afd215d4be81adf8d7752f1c3c15b4f29eef2a6fea
- MD5 6b4e0cf4f8066cbf9c7ab1ba94294fef
- SHA1 c4fc16e0236444f2398bb05c93f6e67df294e1d9
- SHA512 11f7e2d69413c76c681d1063d9c66ed5fccc7cb081c1be2cb7fdc6b8d86f6642199aa32eb44e1f4ed68f22f266a19b8c2bab087480085fba072d0b626731cb2d
- TLSH T151B008090C36102092A26C4445AC5A88600F6AB0E628F5AA7225D6106423C7988A2D44
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\tkjsidfsd
- Size 140B
- SHA256 2d96068d9a3b1baf0252ed6036cdbed5ee221f28f6c2fe4f75876da2e1c02f9f
- MD5 0c3249a9453ba29f98f100fb88ae98fa
- SHA1 b6cb8ad33f2a145af259c2a33f969dbca76e4a49
- SHA512 18bb89ae41d9ad8beb6d7e24196910d2f73f15aec1a13f5e9712a7e62e05c35cfd4c4f7f976553b66b2544d68e80a2f6574cc66c2143946778987098350d4abd
- TLSH T19EC001190C361020A2A2684845AC5A88600F6AB0EA28F5AA7225D6146423C7988A2E44
- MD5 SHA1 SHA512 TLSH