f9e383650958d13ebfe8442b928ed7ae7e2b7af53cd104f2fce27261cc74785e

Analysis

max time kernel
106s
max time network
102s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
25/04/2025, 05:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a9688d64ccd4671a8ea91dd70bc9b38e.exe
Size 8.5MB
Sample250425-gmlbmszycx
SHA256 f9e383650958d13ebfe8442b928ed7ae7e2b7af53cd104f2fce27261cc74785e
MD5 a9688d64ccd4671a8ea91dd70bc9b38e
SHA1 186a08eb88541edfd587518e8f79b5125d2a4c15
SHA512 fb5950b7cc4f03e33be96066aeb3e4d830a341ecaad2a3a6005e38f62f823ba238a5976de248a44201afe25ac6279637ef30aec7019addb78f76aa132d612323
SSDEEP 196608:ifUhAraVHnd0/OJ/tM6RUIFKIghvvbPOlyEBJ3kW:iHGVHndU26N5Nu7BJ9
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
5548	a9688d64ccd4671a8ea91dd70bc9b38e.exe
5432	SystemZenith.exe
2608	SystemZenith.exe

Loads dropped DLL 6 IoCs

pid	Process
5548	a9688d64ccd4671a8ea91dd70bc9b38e.exe
5432	SystemZenith.exe
5432	SystemZenith.exe
2608	SystemZenith.exe
2608	SystemZenith.exe
5916	uninstalltlsYIV.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2608 set thread context of 5916	2608	SystemZenith.exe	81

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a9688d64ccd4671a8ea91dd70bc9b38e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a9688d64ccd4671a8ea91dd70bc9b38e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
5432	SystemZenith.exe
2608	SystemZenith.exe
2608	SystemZenith.exe
2608	SystemZenith.exe
2608	SystemZenith.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2608	SystemZenith.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 5548	1760	a9688d64ccd4671a8ea91dd70bc9b38e.exe	78
PID 1760 wrote to memory of 5548	1760	a9688d64ccd4671a8ea91dd70bc9b38e.exe	78
PID 1760 wrote to memory of 5548	1760	a9688d64ccd4671a8ea91dd70bc9b38e.exe	78
PID 5548 wrote to memory of 5432	5548	a9688d64ccd4671a8ea91dd70bc9b38e.exe	79
PID 5548 wrote to memory of 5432	5548	a9688d64ccd4671a8ea91dd70bc9b38e.exe	79
PID 5432 wrote to memory of 2608	5432	SystemZenith.exe	80
PID 5432 wrote to memory of 2608	5432	SystemZenith.exe	80
PID 2608 wrote to memory of 5916	2608	SystemZenith.exe	81
PID 2608 wrote to memory of 5916	2608	SystemZenith.exe	81
PID 2608 wrote to memory of 5916	2608	SystemZenith.exe	81
PID 2608 wrote to memory of 5916	2608	SystemZenith.exe	81
PID 2608 wrote to memory of 6084	2608	SystemZenith.exe	82
PID 2608 wrote to memory of 6084	2608	SystemZenith.exe	82
PID 2608 wrote to memory of 6084	2608	SystemZenith.exe	82

C:\Users\Admin\AppData\Local\Temp\a9688d64ccd4671a8ea91dd70bc9b38e.exe
"C:\Users\Admin\AppData\Local\Temp\a9688d64ccd4671a8ea91dd70bc9b38e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\Temp\{E1A66956-3AA9-44A2-A44E-5362BAA18374}\.cr\a9688d64ccd4671a8ea91dd70bc9b38e.exe
  "C:\Windows\Temp\{E1A66956-3AA9-44A2-A44E-5362BAA18374}\.cr\a9688d64ccd4671a8ea91dd70bc9b38e.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\a9688d64ccd4671a8ea91dd70bc9b38e.exe" -burn.filehandle.attached=728 -burn.filehandle.self=556
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5548
- - C:\Windows\Temp\{7BA46C2F-3B31-40D4-967C-D06BDBD15A6B}\.ba\SystemZenith.exe
    C:\Windows\Temp\{7BA46C2F-3B31-40D4-967C-D06BDBD15A6B}\.ba\SystemZenith.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5432
  - - C:\ProgramData\Systemupdatev1\SystemZenith.exe
      C:\ProgramData\Systemupdatev1\SystemZenith.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2608
    - - C:\Users\Admin\AppData\Local\Temp\uninstalltlsYIV.exe
        
        C:\Users\Admin\AppData\Local\Temp\uninstalltlsYIV.exe
        5⤵
        Loads dropped DLL
        
        PID:5916
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

25ABE7F.tmp

Path C:\Users\Admin\AppData\Local\Temp\25ABE7F.tmp
Size 40B
SHA256 f6f1ee896108289d9384b457ccf5a2a4d51f668d7f54458fc96c86fc19e10b47
MD5 ebb95a900e5ca9912289c3d4c7a8c5b1
SHA1 a7b2a3ac9d9bdc849177262f3223ea9b3bb00029
SHA512 82ab2cd6516fc997a20268c5477728001d9b887f074751fab1071a8925ec7e364465c43df57fa34285705511e4a103c59c3cfbd2b7fdd189dcce8ec165448aaa
MD5 SHA1 SHA512

Submit Download

F7AA057.tmp

Path C:\Users\Admin\AppData\Local\Temp\F7AA057.tmp
Size 5.6MB
SHA256 53fa3b3332095f462303d7bb6611f0f54c632a6a5f0d582a325b063c915291ff
MD5 32180e6d35c7f9c72b3f44b27dfcefd1
SHA1 ca26ad80d86d65e013dbae2d891a16b9123fb155
SHA512 48fda466a98b75462bdfe92b9f47604875ec6214690d72b12800ffe94f157c9300cb3378f4086ace1f7a1dddbcce87d8fd6b2da69eb635d9ea3c14674fd6a665
SSDEEP 98304:lXZ1xBq5W8dJqtPj0mdnlYl5UHtfSmT4pzaWT8Ll/V8ELWiStMqopa:lxBq8eWPvOGupPIxVfWidTa
MD5 SHA1 SHA512 SSDEEP

Submit Download

uninstalltlsYIV.exe

Path C:\Users\Admin\AppData\Local\Temp\uninstalltlsYIV.exe
Size 2.3MB
SHA256 b22bf1210b5fd173a210ebfa9092390aa0513c41e1914cbe161eb547f049ef91
MD5 967f4470627f823f4d7981e511c9824f
SHA1 416501b096df80ddc49f4144c3832cf2cadb9cb2
SHA512 8883ead428c9d4b415046de9f8398aa1f65ae81fe7945a840c822620e18f6f9930cce2e10acff3b5da8b9c817ade3dabc1de576cbd255087267f77341900a41c
SSDEEP 49152:lbCT2kOGRpfJMi3kLRQrjYgeeZyTDwMHfDYZNBi:TkOKMiY0BZMHfDYZNBi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Brairtweatklais.pla

Path C:\Windows\Temp\{7BA46C2F-3B31-40D4-967C-D06BDBD15A6B}\.ba\Brairtweatklais.pla
Size 59KB
SHA256 78704838ecd558abb7dc52dedf093d47c60d546bf2ac04d6de6c0359507be2ec
MD5 845f501adba9a5e38efba43f0c163083
SHA1 615dbdf605950a63364d83f730448af0d41ed125
SHA512 00181cdb6a085f6d868a7f9c5f2dd5cf66267c2b204e067d43cc2841f3899bd3162eaebd0af5e2ab0661fb6e4798b0638e4742a20b6308fce7f250a06b82b1cd
SSDEEP 1536:6O+oRJaP8IDlQteQRCGK5nf/tAa9agcM0NDaSzgOx:086ePDef/tAGa1NDaSxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Premillenarian.dll

Path C:\Windows\Temp\{7BA46C2F-3B31-40D4-967C-D06BDBD15A6B}\.ba\Premillenarian.dll
Size 402KB
SHA256 7ebc98a4672ecb46124b6ee9709012eed0b4bb1ec1e523204af6104df370822c
MD5 2b84b5dc9c314f61f97bf33d27144c51
SHA1 4d7af992b6a45e7cfd5dc20b46fbb6ecfd49d8ef
SHA512 4aec4996dc7d71a7783f417595573863403a830509fd6eb574c9bc9e72a620380623d810bec9243dfcdae4cf5c283892c7492d368f8e022ca00fb7e68733d09f
SSDEEP 12288:6vgtFqId2K/NbncR/nJ+ax9jQGfPXsoJBui3G1+:6vgtFFd2K1bncR//goJBuUG1+
MD5 SHA1 SHA512 SSDEEP

Submit Download

SystemZenith.exe

Path C:\Windows\Temp\{7BA46C2F-3B31-40D4-967C-D06BDBD15A6B}\.ba\SystemZenith.exe
Size 99KB
SHA256 24385d352b83222dc5ab92fa57b6649854ecd74de378e279d8ac20a0b3b16009
MD5 9f12ba143f629152084c17c9cb9dc148
SHA1 ff1d704ff11695ab49074c45f05542b32ca00b9e
SHA512 421252c50737b3bc07f43cbcab9f34e6895d28c45027086142cb34101df6772c90aec9cc5b2d2695408c62f409bdc69260c68f7656745bb92659a6f0947c5e4d
SSDEEP 1536:IqRuhIxHHWMpdPa5wiE21M8kJIGFvb1Cwn/z5sz7SyUPx9c:IqYSwMpdCq/IM8uIGfV/z5szqx9c
MD5 SHA1 SHA512 SSDEEP

Submit Download

Voongpeck.sgc

Path C:\Windows\Temp\{7BA46C2F-3B31-40D4-967C-D06BDBD15A6B}\.ba\Voongpeck.sgc
Size 4.5MB
SHA256 6f008256d82c2f58c0ab484832b47e8a04c865a31b7180417d7fbed763ea5d4f
MD5 0845fabd632b23548d2062b76f017906
SHA1 89b35969c3e154373df6f6c806af88d1e157dd4e
SHA512 dbdf1e5bd9097190ca129f3620bd18a1b2063d442ae60aea45a1d92347384105f0374db0ec263d110c88b0fc0ad42f34a2d2c3a1f62d05cae19cc2905081ae4d
SSDEEP 98304:WzgMgrYmQrri0e3o4xerwoRw2dPdcVoPRmVAvcUIq:3IqB35x4NRw2dP2VoXv7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

python311.dll

Path C:\Windows\Temp\{7BA46C2F-3B31-40D4-967C-D06BDBD15A6B}\.ba\python311.dll
Size 5.5MB
SHA256 a2764589f83cc09e445f48f17a6fe6e53927385f9e9d86634b8134108c8045b3
MD5 af8cbf313a5e7ad295893187a35c810e
SHA1 dffa024570c0ee95889d71939249383732b0cedb
SHA512 277454f84d1d512c40656c98d1c8c5f7f5d498609fbbe121228a1728eccde1ecee8f5f98dd4d0f224448e515b73b05592e392ad6833a325f2573b24083cbddb7
SSDEEP 98304:5tcGVQE2EKmBX3N1fn/q+VHzMzDPFE+/yIqPzlJ:5tcGVQE2XmBX3ffGzJEKyIqH
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path C:\Windows\Temp\{7BA46C2F-3B31-40D4-967C-D06BDBD15A6B}\.ba\vcruntime140.dll
Size 106KB
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
MD5 SHA1 SHA512 SSDEEP

Submit Download

a9688d64ccd4671a8ea91dd70bc9b38e.exe

Path C:\Windows\Temp\{E1A66956-3AA9-44A2-A44E-5362BAA18374}\.cr\a9688d64ccd4671a8ea91dd70bc9b38e.exe
Size 7.2MB
SHA256 b8de438c569b31d9799b940b90a03a2cede244e99daa81e8fa2f2456585f176c
MD5 94602adc242cf3acc64cc7cc50c6c393
SHA1 c940d9ba54846bf8cf451841b4e17172279be5ff
SHA512 7c247446b66d51bc94dee16cac5188dc5f7ebead9017b66ee4051efc3c0a7d9755aa1b0585799c8dfb9237caa84efd385a9eb1efa4daaa19767ef76ce139a531
SSDEEP 196608:ifUhAraVHnd0/OJ/tM6RUIFKIghvvbPOlyG:iHGVHndU26N5Nuz
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2608-37-0x00007FF9CF330000-0x00007FF9CF390000-memory.dmp

Download

memory/2608-42-0x00007FF9CF330000-0x00007FF9CF390000-memory.dmp

Download

memory/5432-22-0x00007FF9CF330000-0x00007FF9CF390000-memory.dmp

Download

memory/5916-44-0x00007FF6DFEF0000-0x00007FF6E022E000-memory.dmp

Download

memory/5916-49-0x00007FF6DFEF0000-0x00007FF6E022E000-memory.dmp

Download

memory/5916-50-0x00007FF6DFEF0000-0x00007FF6E022E000-memory.dmp

Download

memory/5916-52-0x00007FF6DFEF0000-0x00007FF6E022E000-memory.dmp

Download

memory/5916-53-0x00007FF6DFEF0000-0x00007FF6E022E000-memory.dmp

Download

memory/5916-54-0x00007FF6DFEF0000-0x00007FF6E022E000-memory.dmp

Download

memory/5916-56-0x00007FF6DFEF0000-0x00007FF6E022E000-memory.dmp

Download

memory/5916-57-0x00007FF6DFEF0000-0x00007FF6E022E000-memory.dmp

Download

memory/5916-59-0x00007FF6DFEF0000-0x00007FF6E022E000-memory.dmp

Download

memory/5916-60-0x00007FF6DFEF0000-0x00007FF6E022E000-memory.dmp

Download