7777fb2cb53f90893bebd0ad0b57c93550af3f126f9d5445581b5316d1e21025

Resubmissions

13/11/2026, 22:09

261113-126qnshs9w

13/11/2026, 21:51

261113-1q1ehsg1717

Analysis

max time kernel
149s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 21:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RAZE.exe
Size 195.1MB
Sample261113-1q1ehsg171
SHA256 7777fb2cb53f90893bebd0ad0b57c93550af3f126f9d5445581b5316d1e21025
MD5 29f427e590d4600cf3a608fcf0f6fa27
SHA1 e29911025d613d11066e7c60658f67931e9ba7b1
SHA512 2a22c08df8e6a923aa8f75c045ac575b8ff1a01892e2ec7cbafd7b2d39029219d5a4bfa0b0ea6f658d730c6e0a279294eecba70e2848da0404285ea8ae1e202f
SSDEEP 1572864:/Rrxd220OMtMYV/bvBOP6NW9iH0WcEuZwDRhCjoEVU+eJzBVT7WMuP9NWrniig08:M2qTvKGg9L
TLSH
T11AA88C13F39A50E9E01DD1B58B479633EAB1B8864324A2DF275407522F77EE86B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	RAZE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	RAZE.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RAZE.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RAZE.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RAZE.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RAZE.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4764	RAZE.exe
4764	RAZE.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3296	RAZE.exe
Token: SeCreatePagefilePrivilege	3296	RAZE.exe
Token: SeShutdownPrivilege	3296	RAZE.exe
Token: SeCreatePagefilePrivilege	3296	RAZE.exe
Token: SeShutdownPrivilege	3296	RAZE.exe
Token: SeCreatePagefilePrivilege	3296	RAZE.exe
Token: SeShutdownPrivilege	3296	RAZE.exe
Token: SeCreatePagefilePrivilege	3296	RAZE.exe
Token: SeShutdownPrivilege	3296	RAZE.exe
Token: SeCreatePagefilePrivilege	3296	RAZE.exe
Token: SeShutdownPrivilege	3296	RAZE.exe
Token: SeCreatePagefilePrivilege	3296	RAZE.exe
Token: SeShutdownPrivilege	3296	RAZE.exe
Token: SeCreatePagefilePrivilege	3296	RAZE.exe
Token: SeShutdownPrivilege	3296	RAZE.exe
Token: SeCreatePagefilePrivilege	3296	RAZE.exe
Token: SeShutdownPrivilege	3296	RAZE.exe
Token: SeCreatePagefilePrivilege	3296	RAZE.exe
Token: SeShutdownPrivilege	3296	RAZE.exe
Token: SeCreatePagefilePrivilege	3296	RAZE.exe
Token: SeShutdownPrivilege	3296	RAZE.exe
Token: SeCreatePagefilePrivilege	3296	RAZE.exe
Token: SeShutdownPrivilege	3296	RAZE.exe
Token: SeCreatePagefilePrivilege	3296	RAZE.exe
Token: SeShutdownPrivilege	3296	RAZE.exe
Token: SeCreatePagefilePrivilege	3296	RAZE.exe
Token: SeShutdownPrivilege	3296	RAZE.exe
Token: SeCreatePagefilePrivilege	3296	RAZE.exe
Token: SeShutdownPrivilege	3296	RAZE.exe
Token: SeCreatePagefilePrivilege	3296	RAZE.exe
Token: SeShutdownPrivilege	3296	RAZE.exe
Token: SeCreatePagefilePrivilege	3296	RAZE.exe
Token: SeShutdownPrivilege	3296	RAZE.exe
Token: SeCreatePagefilePrivilege	3296	RAZE.exe
Token: SeShutdownPrivilege	3296	RAZE.exe
Token: SeCreatePagefilePrivilege	3296	RAZE.exe
Token: SeShutdownPrivilege	3296	RAZE.exe
Token: SeCreatePagefilePrivilege	3296	RAZE.exe
Token: SeShutdownPrivilege	3296	RAZE.exe
Token: SeCreatePagefilePrivilege	3296	RAZE.exe
Token: SeShutdownPrivilege	3296	RAZE.exe
Token: SeCreatePagefilePrivilege	3296	RAZE.exe
Token: SeShutdownPrivilege	3296	RAZE.exe
Token: SeCreatePagefilePrivilege	3296	RAZE.exe
Token: SeShutdownPrivilege	3296	RAZE.exe
Token: SeCreatePagefilePrivilege	3296	RAZE.exe
Token: SeShutdownPrivilege	3296	RAZE.exe
Token: SeCreatePagefilePrivilege	3296	RAZE.exe
Token: SeShutdownPrivilege	3296	RAZE.exe
Token: SeCreatePagefilePrivilege	3296	RAZE.exe
Token: SeShutdownPrivilege	3296	RAZE.exe
Token: SeCreatePagefilePrivilege	3296	RAZE.exe
Token: SeShutdownPrivilege	3296	RAZE.exe
Token: SeCreatePagefilePrivilege	3296	RAZE.exe
Token: SeShutdownPrivilege	3296	RAZE.exe
Token: SeCreatePagefilePrivilege	3296	RAZE.exe
Token: SeShutdownPrivilege	3296	RAZE.exe
Token: SeCreatePagefilePrivilege	3296	RAZE.exe
Token: SeShutdownPrivilege	3296	RAZE.exe
Token: SeCreatePagefilePrivilege	3296	RAZE.exe
Token: SeShutdownPrivilege	3296	RAZE.exe
Token: SeCreatePagefilePrivilege	3296	RAZE.exe
Token: SeShutdownPrivilege	3296	RAZE.exe
Token: SeCreatePagefilePrivilege	3296	RAZE.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 4692	3296	RAZE.exe	86
PID 3296 wrote to memory of 4692	3296	RAZE.exe	86
PID 3296 wrote to memory of 4448	3296	RAZE.exe	88
PID 3296 wrote to memory of 2360	3296	RAZE.exe	89
PID 3296 wrote to memory of 2360	3296	RAZE.exe	89
PID 3296 wrote to memory of 4764	3296	RAZE.exe	95

C:\Users\Admin\AppData\Local\Temp\RAZE.exe
"C:\Users\Admin\AppData\Local\Temp\RAZE.exe"
1⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Users\Admin\AppData\Local\Temp\RAZE.exe
  "C:\Users\Admin\AppData\Local\Temp\RAZE.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ya-library-hub" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1748,i,4418126475672404851,17972011943560555612,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1744 /prefetch:2
  2⤵
  PID:4692
- C:\Users\Admin\AppData\Local\Temp\RAZE.exe
  "C:\Users\Admin\AppData\Local\Temp\RAZE.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ya-library-hub" --field-trial-handle=1748,i,4418126475672404851,17972011943560555612,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:4448
- C:\Users\Admin\AppData\Local\Temp\RAZE.exe
  "C:\Users\Admin\AppData\Local\Temp\RAZE.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ya-library-hub" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1794606399099006 --launch-time-ticks=569901232 --field-trial-handle=1748,i,4418126475672404851,17972011943560555612,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:2360
- C:\Users\Admin\AppData\Local\Temp\RAZE.exe
  "C:\Users\Admin\AppData\Local\Temp\RAZE.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\ya-library-hub" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1748,i,4418126475672404851,17972011943560555612,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\ya-library-hub\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 23055dc48c4e007057c8613302ab1ba37f80334966c90ee7bbf5f8b5a320bc32
MD5 95d0064b09ddc561e21f756fea6b80a4
SHA1 f7768b509cd4e0d1bd7acf753c85e3e520c218b1
SHA512 171bb8bdd18d6a8f58f11d0bf1871178e0371bbc238f9cea595cca98b897ff68448e6c29e9212d5a3f2ed9fe058e9f08b9279782cecb0951c1e47709234276ae
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\ya-library-hub\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

memory/2360-33-0x00007FFAB8670000-0x00007FFAB8671000-memory.dmp

Download

memory/2360-32-0x00007FFAB7900000-0x00007FFAB7901000-memory.dmp

Download

memory/3296-73-0x000002BBABD10000-0x000002BBABDA5000-memory.dmp

Download

memory/4764-89-0x0000013F1A5A0000-0x0000013F1A5A1000-memory.dmp

Download

memory/4764-88-0x0000013F1A5A0000-0x0000013F1A5A1000-memory.dmp

Download

memory/4764-87-0x0000013F1A5A0000-0x0000013F1A5A1000-memory.dmp

Download

memory/4764-93-0x0000013F1A5A0000-0x0000013F1A5A1000-memory.dmp

Download

memory/4764-94-0x0000013F1A5A0000-0x0000013F1A5A1000-memory.dmp

Download

memory/4764-99-0x0000013F1A5A0000-0x0000013F1A5A1000-memory.dmp

Download

memory/4764-98-0x0000013F1A5A0000-0x0000013F1A5A1000-memory.dmp

Download

memory/4764-97-0x0000013F1A5A0000-0x0000013F1A5A1000-memory.dmp

Download

memory/4764-96-0x0000013F1A5A0000-0x0000013F1A5A1000-memory.dmp

Download

memory/4764-95-0x0000013F1A5A0000-0x0000013F1A5A1000-memory.dmp

Download