d3d88802949704ea0b95fa7bf0e5cfeae8c2f3b873106d5081f2d03b5d3e27f2

Analysis

max time kernel
149s
max time network
158s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 07:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d3d88802949704ea0b95fa7bf0e5cfeae8c2f3b873106d5081f2d03b5d3e27f2.exe
Size 60KB
Sample260423-jb41qaes2t
SHA256 d3d88802949704ea0b95fa7bf0e5cfeae8c2f3b873106d5081f2d03b5d3e27f2
MD5 274df1bf1919656660dbd2f9631647f0
SHA1 0ce224fe2772ee771afc6bed10a2bbfd549bece6
SHA512 5a66a531a986acf6cf5a8129927bd4759062631af0e84b8be77004e62e2b15dbd231753fec71ff1155af02db13956431a3913734542371caff0befe63532ee13
SSDEEP 768:a+Rj+ind7d7rXaKR95ss4scBIzPkzgBYzddB+ksMZEsJ8JtjmPwe/ErjOT8fo6un:vRiAXaKD5gxzmwYEM/D3oNd/
TLSH
T17653CF1BBD6947A1D618D4B149331A71EAE3B92B55344273BBC7FE2DEC34A408B12388
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2816	zgico.exe

Executes dropped EXE 1 IoCs

pid	Process
2816	zgico.exe

Loads dropped DLL 1 IoCs

pid	Process
4864	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4176	4864	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zgico.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d3d88802949704ea0b95fa7bf0e5cfeae8c2f3b873106d5081f2d03b5d3e27f2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1964	cmd.exe
396	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
396	PING.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
900	d3d88802949704ea0b95fa7bf0e5cfeae8c2f3b873106d5081f2d03b5d3e27f2.exe
2816	zgico.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1964	900	d3d88802949704ea0b95fa7bf0e5cfeae8c2f3b873106d5081f2d03b5d3e27f2.exe	81
PID 1964 wrote to memory of 396	1964	cmd.exe	83
PID 1964 wrote to memory of 2816	1964	cmd.exe	84
PID 2816 wrote to memory of 4864	2816	zgico.exe	85

C:\Users\Admin\AppData\Local\Temp\d3d88802949704ea0b95fa7bf0e5cfeae8c2f3b873106d5081f2d03b5d3e27f2.exe
"C:\Users\Admin\AppData\Local\Temp\d3d88802949704ea0b95fa7bf0e5cfeae8c2f3b873106d5081f2d03b5d3e27f2.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 127.0.0.1 -n 2&c:\zgico.exe "C:\Users\Admin\AppData\Local\Temp\d3d88802949704ea0b95fa7bf0e5cfeae8c2f3b873106d5081f2d03b5d3e27f2.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:396
- - \??\c:\zgico.exe
    c:\zgico.exe "C:\Users\Admin\AppData\Local\Temp\d3d88802949704ea0b95fa7bf0e5cfeae8c2f3b873106d5081f2d03b5d3e27f2.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - \??\c:\windows\SysWOW64\rundll32.exe
      c:\windows\system32\rundll32.exe "c:\juiua\mjxhc.dll",GetWindowClass c:\zgico.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:4864
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 416
        5⤵
        Program crash
        
        PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4864 -ip 4864
1⤵
PID:4920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zgico.exe

Path C:\zgico.exe
Size 61KB
SHA256 410aec90668530f35602cfae24afc48ac97fb85d5814f4f8fb8971978ab8886c
MD5 32d884c975eb64a5916c1af699d7cfae
SHA1 fac18492250e6fa945b0cfcbddafcc6faf6ce2e5
SHA512 4277f60a475cd1fdef5524bfd9d815b8741337ec6ff7e53f5f544301fdb6808f126d5724cfb5258c758cc40117a0dd1f80334d82b11c2e8e2c2b84de7ad51823
SSDEEP 768:a+Rj+ind7d7rXaKR95ss4scBIzPkzgBYzddB+ksMZEsJ8JtjmPwe/ErjOT8fo6un:vRiAXaKD5gxzmwYEM/D3oNdv
TLSH
T1FD53C01BBD7947A1D518D4B15A331A71EAE3B92B55344173BBCBFE2DEC34A408B12388
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjxhc.dll

Path \??\c:\juiua\mjxhc.dll
Size 46KB
SHA256 c3de16e30b26fed039015710e4e7f38385460d7b0c2a745917a38d5e463a92a3
MD5 b889ec76fec7a8a4a92a083dad16b26f
SHA1 b89cc49007e0b41d3ceed69dc01ce087e1a17726
SHA512 02b5ce0ea510320e8f0b8f2ea5c0e4a3d149d1458a216396c3910493770fb7912e3fe7372141d0abf50b71bb901e94c35f560c4270c35c1d4c2648ffb707b60f
SSDEEP 768:2sUfnvxs6iLlhpfFPtnQf7kifD/v7yb9Bh7Cb0Pc:2sJT1qf4W/vub9nnE
TLSH
T18523F198BAF0CEE7DEF80B7744F579980DADA9785B738E103C1610CD683011BEA5067A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/900-0-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/900-3-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/900-2-0x0000000000AD0000-0x0000000000B4C000-memory.dmp

Download

memory/2816-6-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/2816-10-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/2816-9-0x00000000005A0000-0x000000000061C000-memory.dmp

Download

memory/4864-13-0x0000000010000000-0x000000001002E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads