626bb341a8d9ec79994bc12565a9f3c4c6944dc79ba65d66aa35fc9d9ff7e5f4

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/02/2026, 11:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
626bb341a8d9ec79994bc12565a9f3c4c6944dc79ba65d66aa35fc9d9ff7e5f4.exe
Size 1.2MB
Sample260205-nbjf8se15e
SHA256 626bb341a8d9ec79994bc12565a9f3c4c6944dc79ba65d66aa35fc9d9ff7e5f4
MD5 0a75e5088659ea320e512ce63f60d7c4
SHA1 ec0fc5dfb3788c7440705537715f12a6ff9d4386
SHA512 bfaa168b5baa5b01fe9a92a4a02f150afb134060451f6511e2a5fc94f9b4a4092dc2602e442725126730f2f195e4d52cb3dee7ccfcfe10df64152402eabfff38
SSDEEP 24576:Q5EmXFtKaL4/oFe5T9yyXYfP1ijXda7/IhSCnT2jSxDQf:QPVt/LZeJbInQRa7/Ih1nyOxD
TLSH
T10E45BF0273C1C062FF9B92734B5AF6115BBD79260127A62F13981D7ABE701B1463E7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 844 set thread context of 4792	844	626bb341a8d9ec79994bc12565a9f3c4c6944dc79ba65d66aa35fc9d9ff7e5f4.exe	79

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3696	844	WerFault.exe	78
764	4792	WerFault.exe	79

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	626bb341a8d9ec79994bc12565a9f3c4c6944dc79ba65d66aa35fc9d9ff7e5f4.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
844	626bb341a8d9ec79994bc12565a9f3c4c6944dc79ba65d66aa35fc9d9ff7e5f4.exe
844	626bb341a8d9ec79994bc12565a9f3c4c6944dc79ba65d66aa35fc9d9ff7e5f4.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
844	626bb341a8d9ec79994bc12565a9f3c4c6944dc79ba65d66aa35fc9d9ff7e5f4.exe
844	626bb341a8d9ec79994bc12565a9f3c4c6944dc79ba65d66aa35fc9d9ff7e5f4.exe
844	626bb341a8d9ec79994bc12565a9f3c4c6944dc79ba65d66aa35fc9d9ff7e5f4.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
844	626bb341a8d9ec79994bc12565a9f3c4c6944dc79ba65d66aa35fc9d9ff7e5f4.exe
844	626bb341a8d9ec79994bc12565a9f3c4c6944dc79ba65d66aa35fc9d9ff7e5f4.exe
844	626bb341a8d9ec79994bc12565a9f3c4c6944dc79ba65d66aa35fc9d9ff7e5f4.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 4792	844	626bb341a8d9ec79994bc12565a9f3c4c6944dc79ba65d66aa35fc9d9ff7e5f4.exe	79

C:\Users\Admin\AppData\Local\Temp\626bb341a8d9ec79994bc12565a9f3c4c6944dc79ba65d66aa35fc9d9ff7e5f4.exe
"C:\Users\Admin\AppData\Local\Temp\626bb341a8d9ec79994bc12565a9f3c4c6944dc79ba65d66aa35fc9d9ff7e5f4.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:844
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\626bb341a8d9ec79994bc12565a9f3c4c6944dc79ba65d66aa35fc9d9ff7e5f4.exe"
  2⤵
  PID:4792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 208
    3⤵
    - Program crash
    PID:764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 844 -s 756
  2⤵
  - Program crash
  PID:3696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 844 -ip 844
1⤵
PID:2496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4792 -ip 4792
1⤵
PID:2556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

autEB69.tmp

Path C:\Users\Admin\AppData\Local\Temp\autEB69.tmp
Size 278KB
SHA256 dfd49023e6f8144203c40a308a8906a8a4a6ece305a3b5e0b7f28cca5478e944
MD5 e7f547330842b974c3a449d805cd9c1f
SHA1 146409873b6772bc2186280b7b97a7f456a83b64
SHA512 c4d9149bf56d605c8889bada8466bf80da66509ce10c32e9d011bd3f21ceceee7835895395e7085918c912e11ee14005f450a36176ffa32fe55510df5babfde5
SSDEEP 6144:k55Ve3ijnQ9/pfe7KMeirTt1Qmn4LqI1O1TNUhMUJEj4OwCJludx:k/OOcReO00M4O8uUc4Owolq
TLSH
T1CF540140EA3C5068AD13FC6EFD5E863385B59E240291F9C64BE98DA52074B6FC1C5C6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/844-6-0x0000000000F90000-0x0000000000F94000-memory.dmp

Download

memory/4792-7-0x00000000004E0000-0x0000000000526000-memory.dmp