Analysis
- max time kernel
149s - max time network
146s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
24/04/2026, 09:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe
- Size 11.1MB
- Sample260424-ltf3qaet71
- SHA256 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f
- MD5 16f1e07ab22b89ce6e87d5144a884fc6
- SHA1 cc79b98c13b9357ac22afcfe3c71fd64fde2b78f
- SHA512 9123ccbd39ed418ec82ca43447ad30085a8c10b95a22daf41adfc491d5de4eac7557d37303c0373bf7b3186a6c8e3f1b567871b529585c1a5b5c8260b99027a3
- SSDEEP 196608:/2zdyPiuAd2zGk2cKjNck82/7bDn4N/QYblulyqKQ:G4P3FzGBcH+z4NDxGKQ
- TLSH T100C6EF11F2A50421E42111B3C2DEEB372653DE458566AEC6BBA0FDDBF6387421F318E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe 3660 206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe"C:\Users\Admin\AppData\Local\Temp\206bce1cae021885fb271e266f74d3054c585b8d61cd768a915d57a1de73a84f.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3660
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\E2EECore.2.8.11.dll
- Size 10.1MB
- SHA256 177318905f25ef02e1cdaeeedb6928dfbd764c68e9377acf822266673612c35a
- MD5 cf1cf69eb4d66aca7c3f3c914d96b654
- SHA1 5c7eb1ef6b12850700429b023b82d971526ee6ee
- SHA512 afb74a4664f5982ff95392e56d10d554f40ffcc390bf387f3ac11c37ca0fe1bfc074018b0114875c65afa3c37407f5ca09c556191ea367c674f5fc4f5e524263
- SSDEEP 196608:L+MDZ3sE4eMhNbz+ewVC7EOACGKT6ChS4xmrlm2HkVvWFys9VsxiM9K3U:L+M2JNH+ewVIT6Czmrlm2vCiEj
- TLSH T17BB69D00FB428172E9CE01B5517AAB3E85387E24073959D7F3587E2A6F316D23B3664E
- MD5 SHA1 SHA512 SSDEEP TLSH