Analysis
- max time kernel
149s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/04/2026, 08:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6c5df938ff55805c227bd6af35631747a08aad6864dac8d2054336b004e44eb5.exe
Resource
win10v2004-20260130-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
6c5df938ff55805c227bd6af35631747a08aad6864dac8d2054336b004e44eb5.exe
Resource
win11-20260130-en
2 signatures
150 seconds
General
- Target 6c5df938ff55805c227bd6af35631747a08aad6864dac8d2054336b004e44eb5.exe
- Size 6.7MB
- Sample260417-kh522acz2x
- SHA256 6c5df938ff55805c227bd6af35631747a08aad6864dac8d2054336b004e44eb5
- MD5 0cd24f1290f2729b79a1a41401dab29d
- SHA1 8969f765da32f314caa412aeea0edeee10225080
- SHA512 7022fd125e910d73a9dca48eb71f3b7c644036acbff4e69e560154a5974725fafb682cd8c497f37760e14b57f3e599f369337ecbe09cdd0942eb3eb311d81953
- SSDEEP 196608:jxAfq8B5DqR6FA9MQ5x8jXbUuMowiIOs5e9lFcW7WrI2jOSe4cJlAv5avjXdWn01:dAfq8B5Dq0FA9MQ5x8jXbUuMoVIfe9l9
- TLSH T19E660813F710A00EE41381B26C99B67B6D656C36A959A90BB3C0AF4D38716D778F4B0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6c5df938ff55805c227bd6af35631747a08aad6864dac8d2054336b004e44eb5.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4680 6c5df938ff55805c227bd6af35631747a08aad6864dac8d2054336b004e44eb5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c5df938ff55805c227bd6af35631747a08aad6864dac8d2054336b004e44eb5.exe"C:\Users\Admin\AppData\Local\Temp\6c5df938ff55805c227bd6af35631747a08aad6864dac8d2054336b004e44eb5.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4680