Analysis
- max time kernel
149s - max time network
143s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
25/04/2026, 10:15
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
b600a482b24e8237078f83d9e8ca1b074c56d09e61f705f3209b23e88d634baa.exe
Resource
win10v2004-20260130-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
b600a482b24e8237078f83d9e8ca1b074c56d09e61f705f3209b23e88d634baa.exe
Resource
win11-20260130-en
1 signatures
150 seconds
General
- Target b600a482b24e8237078f83d9e8ca1b074c56d09e61f705f3209b23e88d634baa.exe
- Size 4.9MB
- Sample260425-mac3dsbw8m
- SHA256 b600a482b24e8237078f83d9e8ca1b074c56d09e61f705f3209b23e88d634baa
- MD5 849770ac8189d07d1493f3ec6eb671ff
- SHA1 0b08a0dafab92a4eec8bbcf950f17076f9322f94
- SHA512 8647d8b3a9ca33e09745bd621c092b7dbbf3b3e1a5e9032ff023cc39bcee58f0037302b4704f81f50f4a0f06c321e0ba990caa3f69da18b57313aa709b425342
- SSDEEP 98304:IjTQYxsWP6a7fteE0LmiXXX8ld0sldoVMRuT7mGfVmH68l6Oq8:I3dxfia7D+c70slaVLnmKVma8YP8
- TLSH T14E3623427381C02AFE97D3720B59EE114B797A660117B65F23A81CBDBD7076006BE7A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b600a482b24e8237078f83d9e8ca1b074c56d09e61f705f3209b23e88d634baa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language b600a482b24e8237078f83d9e8ca1b074c56d09e61f705f3209b23e88d634baa.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage b600a482b24e8237078f83d9e8ca1b074c56d09e61f705f3209b23e88d634baa.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\ScriptTemp.ini
- Size 154B
- SHA256 019e57ff21a3d6d54f3f71efdcc9b18ad8b71ef5e98fdab7ae97ff57dde5165e
- MD5 aff08d7959acb3ad1a1139a20d62d4b3
- SHA1 2662d8c098dfc439a32d5892812daf076d1e5f53
- SHA512 b89993bb8ec01feb87cb756fdcfad82bc44bbd6c3deda8b8a45ac02ed1fa6043b9238fdcd11d1f82dddf432d710304d308dd0efcd0e9cabc649533568d0843d7
- TLSH T166C08C752BC589AD1B11002E0A30E08C8CB09878365A33298615EE090C74C68C28720A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\files.7z
- Size 1.4MB
- SHA256 c02c302c2f9861b4120664ad32b74280a5f13dae54735ad858691837aa496888
- MD5 c7926c9b1dfe047575916f8016f36555
- SHA1 88f149b25d40e4d124c45bef48a82d69fc5e7e34
- SHA512 68e2efe32be775eff0c6c949ac5f3770be1ac9a5baabd85b73e6e0d987b4b593329d829a6cdd111379637adc81caf1cdc542d43c420c102405c239ee85cf9ec2
- SSDEEP 24576:Kh2bnYlq+YHJEHQBf3q/G9tJfZ98s3arjFyLFVP/qItRph/t0I:xbqqDJEHI/FfwzjkLHCBI
- TLSH T1666533160815F48AFEAFEE153DFC5B8D9C17D81FF50D285A267498308E802319E77AAD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\autBC95.tmp
- Size 2.0MB
- SHA256 85f2ecdcb1c3ea67f17cfc0c466688be32b995b99b64eb351d97b44148bbba81
- MD5 e569818f5b9ffa120cf069347ec51e24
- SHA1 216470a4bdbe47403f6040fe59253b91da3a069d
- SHA512 3922ee9f177a6cedaf1d720c778b33556a0d16beb22c3f37c05e215839cdc3003e1f7391286e9463631d198ac5cfdef8eb3d2acbd94a63fba026dc9fd02ab0f6
- SSDEEP 49152:IRnCm8G2jaxCtxfFbTwYytzJazZeAM6Ip6OU/ogB9F/Y:IAmp2jWyxNbTwYyNJateAMLp/SN9Fw
- TLSH T1BEA53352A18017E1DC7607BE78D7AABFC231C27507AD6887F53F93A1690E7D4A321A42
- MD5 SHA1 SHA512 SSDEEP TLSH