8c154e9bea754faad5e8557fbe10cfe38750d9f0a19ffd4f28c631defa114452

Analysis

max time kernel
148s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/11/2026, 13:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
English/evil_recruit_1.exe
Size 99.8MB
Sample261107-qva1bact3s
SHA256 8c154e9bea754faad5e8557fbe10cfe38750d9f0a19ffd4f28c631defa114452
MD5 90eb16bd6f887e301a95e27569b8a449
SHA1 23fde8aff275f7e8622c0dd79053c332ed211cdf
SHA512 3bc2152d75b36b25b2237f6a76d0b8795a0b09d57e117e49c2faef50293a0a68041d9aa7b3293fc3f5f6e97e9226870ec84ba86b096f010f310e5f017c83698b
SSDEEP 1572864:V7DcMx/CTjnkIgPvx3b28aaUNyAlMjxcDoNc:V3B1xze
TLSH
T15A387C03E2A610EDC05DC2B49B1B9526EEB1F8450734B6EF26A457222F76FE45B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	evil_recruit_1.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	evil_recruit_1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	evil_recruit_1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	evil_recruit_1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	evil_recruit_1.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1844	evil_recruit_1.exe
1844	evil_recruit_1.exe
4196	evil_recruit_1.exe
4196	evil_recruit_1.exe
3400	evil_recruit_1.exe
3400	evil_recruit_1.exe
176	evil_recruit_1.exe
176	evil_recruit_1.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 4940	4424	evil_recruit_1.exe	88
PID 4424 wrote to memory of 4940	4424	evil_recruit_1.exe	88
PID 4424 wrote to memory of 1844	4424	evil_recruit_1.exe	89
PID 4424 wrote to memory of 4196	4424	evil_recruit_1.exe	90
PID 4424 wrote to memory of 3400	4424	evil_recruit_1.exe	92
PID 4424 wrote to memory of 176	4424	evil_recruit_1.exe	97

C:\Users\Admin\AppData\Local\Temp\English\evil_recruit_1.exe
"C:\Users\Admin\AppData\Local\Temp\English\evil_recruit_1.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Users\Admin\AppData\Local\Temp\English\evil_recruit_1.exe
  "C:\Users\Admin\AppData\Local\Temp\English\evil_recruit_1.exe" --type=gpu-process --field-trial-handle=1668,9710726594088987522,6655229101419767438,131072 --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=12746142155432003007 --mojo-platform-channel-handle=1676 --ignored=" --type=renderer " /prefetch:2
  2⤵
  PID:4940
- C:\Users\Admin\AppData\Local\Temp\English\evil_recruit_1.exe
  "C:\Users\Admin\AppData\Local\Temp\English\evil_recruit_1.exe" --type=utility --field-trial-handle=1668,9710726594088987522,6655229101419767438,131072 --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --service-request-channel-token=12459894638107770474 --mojo-platform-channel-handle=2168 /prefetch:8
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1844
- C:\Users\Admin\AppData\Local\Temp\English\evil_recruit_1.exe
  "C:\Users\Admin\AppData\Local\Temp\English\evil_recruit_1.exe" --type=renderer --field-trial-handle=1668,9710726594088987522,6655229101419767438,131072 --disable-features=SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\English\resources\app.asar" --node-integration --no-sandbox --no-zygote --background-color=#fff --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=1568910287929530744 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2220 /prefetch:1
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  PID:4196
- C:\Users\Admin\AppData\Local\Temp\English\evil_recruit_1.exe
  "C:\Users\Admin\AppData\Local\Temp\English\evil_recruit_1.exe" --type=utility --field-trial-handle=1668,9710726594088987522,6655229101419767438,131072 --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=audio --service-request-channel-token=8635553091183376727 --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3400
- C:\Users\Admin\AppData\Local\Temp\English\evil_recruit_1.exe
  "C:\Users\Admin\AppData\Local\Temp\English\evil_recruit_1.exe" --type=gpu-process --field-trial-handle=1668,9710726594088987522,6655229101419767438,131072 --disable-features=SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADoAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=2750543023517660001 --mojo-platform-channel-handle=2488 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

evil_recruit_1_sf.sav

Path C:\Users\Admin\AppData\Local\Temp\English\evil_recruit_1_sf.sav
Size 243B
SHA256 cb7434599b6621ea379c122384b0dc2f1e521e27c5b1cb79d4f99ec421bfad8d
MD5 9e24771bdc0101b83c363300f8aff2c8
SHA1 22064f6268d79f7c443260f7ed7e2af81bfaa31d
SHA512 45ba85888407db937847d89d256d5e98cd70c69222e2f94ed8c7870cd2b82eed5a63408739f5be2bf0838d8fa8b8400b385cebfdf6475e99c5941125da62b29a
TLSH
T1C7D09E446A361C1F1C82A423E1CE735513287C87E0D07350489D64D5B539DF71136726
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\tyranogame\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

memory/4940-2-0x00007FFD4AF70000-0x00007FFD4AF71000-memory.dmp

Download