b50f4f6a6f57d0ea2c1c30e7b36a36dc5d21ca71bb8d44b109ae77ab202ff2d1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/04/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b50f4f6a6f57d0ea2c1c30e7b36a36dc5d21ca71bb8d44b109ae77ab202ff2d1.exe
Size 3.5MB
Sample260420-sr3bhad19j
SHA256 b50f4f6a6f57d0ea2c1c30e7b36a36dc5d21ca71bb8d44b109ae77ab202ff2d1
MD5 b81c8445e03e4d97a968b829822a156f
SHA1 04ade98449d43865fd30f1bfd0a1b8f3b890cdc4
SHA512 dbcb0d416601a1d6ebceba820820ebf0af42fbe0579f666d8269f8d29639ce914f906297339d42c33eb0d28310c8dd16ad07f4c592f7de8a8d15fc5318d0281b
SSDEEP 49152:T6esL7Iy2qtxEOCChhd/2C1vgStpVW7bGZrqsg8bmclqZnS1ps2bu:kLWqzEOx2C14StpI7bGZrqspmihoL
TLSH
T16206F037D043C24CD3A144F3E04A978D265B5DA6BA3C427ECE157AA2A572CB3991FD2C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b50f4f6a6f57d0ea2c1c30e7b36a36dc5d21ca71bb8d44b109ae77ab202ff2d1.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3816	taskkill.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5052	b50f4f6a6f57d0ea2c1c30e7b36a36dc5d21ca71bb8d44b109ae77ab202ff2d1.exe
5052	b50f4f6a6f57d0ea2c1c30e7b36a36dc5d21ca71bb8d44b109ae77ab202ff2d1.exe
5052	b50f4f6a6f57d0ea2c1c30e7b36a36dc5d21ca71bb8d44b109ae77ab202ff2d1.exe
5052	b50f4f6a6f57d0ea2c1c30e7b36a36dc5d21ca71bb8d44b109ae77ab202ff2d1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3816	taskkill.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 1836	5052	b50f4f6a6f57d0ea2c1c30e7b36a36dc5d21ca71bb8d44b109ae77ab202ff2d1.exe	86
PID 5052 wrote to memory of 2740	5052	b50f4f6a6f57d0ea2c1c30e7b36a36dc5d21ca71bb8d44b109ae77ab202ff2d1.exe	87
PID 5052 wrote to memory of 3920	5052	b50f4f6a6f57d0ea2c1c30e7b36a36dc5d21ca71bb8d44b109ae77ab202ff2d1.exe	88
PID 3920 wrote to memory of 3816	3920	cmd.exe	89
PID 5052 wrote to memory of 4348	5052	b50f4f6a6f57d0ea2c1c30e7b36a36dc5d21ca71bb8d44b109ae77ab202ff2d1.exe	91

C:\Users\Admin\AppData\Local\Temp\b50f4f6a6f57d0ea2c1c30e7b36a36dc5d21ca71bb8d44b109ae77ab202ff2d1.exe
"C:\Users\Admin\AppData\Local\Temp\b50f4f6a6f57d0ea2c1c30e7b36a36dc5d21ca71bb8d44b109ae77ab202ff2d1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c color A
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c TITLE WorkNC Dental Dongle Server Install 2022
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /t /im wncserve.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3920
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /t /im wncserve.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3816-13-0x0000000001250000-0x00000000014D1000-memory.dmp

Download

memory/5052-7-0x0000000000C80000-0x0000000000C81000-memory.dmp

Download

memory/5052-11-0x0000000000400000-0x0000000000A89000-memory.dmp

Download

memory/5052-12-0x0000000000400000-0x0000000000A89000-memory.dmp

Download

memory/5052-6-0x0000000000C60000-0x0000000000C61000-memory.dmp

Download

memory/5052-5-0x0000000000C50000-0x0000000000C51000-memory.dmp

Download

memory/5052-4-0x0000000000C10000-0x0000000000C11000-memory.dmp

Download

memory/5052-3-0x0000000000C00000-0x0000000000C01000-memory.dmp

Download

memory/5052-2-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Download

memory/5052-1-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Download

memory/5052-0-0x000000000044E000-0x00000000006FE000-memory.dmp

Download

memory/5052-14-0x0000000000400000-0x0000000000A89000-memory.dmp

Download