e9f1e21630530f8373c0a275d16abc1421034b610c41f81fda718ff22ac8802f

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 06:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TENDER FOR BAS-EPC FOR SE AiP5 PROJECT.exe
Size 1.1MB
Sample260415-hhetqsbt9s
SHA256 e9f1e21630530f8373c0a275d16abc1421034b610c41f81fda718ff22ac8802f
MD5 3bc3bc9db85d0f5d30e33be267f2823a
SHA1 0f9ef6e31e71abfe8ac8b326df65479f9c3aedef
SHA512 a60c6699fb80028f6cc6e443e49701bbccb0a55e203864c6d604e785c18d937c64e315abe19cde49510b6aa7054f1515cac804103988097f39d8fb7ce482ebfd
SSDEEP 24576:mtb20pkaCqT5TBWgNQ7amQqfjvpXJRXgqmuKw6A:TVg5tQ7am/fDhzgqRr5
TLSH
T1F045CF2373DE8365C7B25273BA25B701AEBB7C2506B1F86B2FD4093CA920131565E673
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3848 set thread context of 3664	3848	TENDER FOR BAS-EPC FOR SE AiP5 PROJECT.exe	84

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2040	3664	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TENDER FOR BAS-EPC FOR SE AiP5 PROJECT.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3848	TENDER FOR BAS-EPC FOR SE AiP5 PROJECT.exe
3848	TENDER FOR BAS-EPC FOR SE AiP5 PROJECT.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3848	TENDER FOR BAS-EPC FOR SE AiP5 PROJECT.exe
3848	TENDER FOR BAS-EPC FOR SE AiP5 PROJECT.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3848	TENDER FOR BAS-EPC FOR SE AiP5 PROJECT.exe
3848	TENDER FOR BAS-EPC FOR SE AiP5 PROJECT.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 3664	3848	TENDER FOR BAS-EPC FOR SE AiP5 PROJECT.exe	84

C:\Users\Admin\AppData\Local\Temp\TENDER FOR BAS-EPC FOR SE AiP5 PROJECT.exe
"C:\Users\Admin\AppData\Local\Temp\TENDER FOR BAS-EPC FOR SE AiP5 PROJECT.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\TENDER FOR BAS-EPC FOR SE AiP5 PROJECT.exe"
  2⤵
  PID:3664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 192
    3⤵
    - Program crash
    PID:2040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3664 -ip 3664
1⤵
PID:1996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aut41C8.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut41C8.tmp
Size 295KB
SHA256 19dd3ce0d751528a0b92a1914502f81ad48c9f178dce33f862a22816421d97e5
MD5 a93ddc095bb58d6fb91735ed8bf3696e
SHA1 d3af9d3ab09582f4f8ac4941a6f93f96f7280204
SHA512 a7a8c5356f5ae9eae75aa52922b83327419c1772fa65d1ccc3238a6a2aa50437ecc7a8f42c76ba8a984af5beeeb782417beae071204a3405a4af5a6b0bd253b1
SSDEEP 6144:yenQGQYuCAnQV67aJmyI9L6DQRmqSKLD5UtPlmkG+1Eoy56:uwIQE7aJdIpghTKO9mkGTX6
TLSH
T1F95412BC623750CC9E4A1D8D824B5BA920B1BAB0F9ED8537335670773D5B8D42C6A90F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3664-12-0x0000000000570000-0x00000000005BA000-memory.dmp

Download

memory/3848-11-0x00000000013E0000-0x00000000013E4000-memory.dmp