2c0eae01cb35b551bee740473fe7ea4b9cdc1c3b4b43cd1b695f7f400d704391

Analysis

user interaction
yes
max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/05/2026, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
uploader.exe
Size 81KB
Sample260502-xpqxxaes21
SHA256 2c0eae01cb35b551bee740473fe7ea4b9cdc1c3b4b43cd1b695f7f400d704391
MD5 f2786efbc8ab20d288e50536b0b492af
SHA1 88f4c0f8b28f0706e137ccc1beb452d21a6e5cc2
SHA512 7ed673570cebaf1308c36ae6da6b8c3b9279e95b8a77b5df7da7a40742b7b0053fb4c50ca766cb688066eeb19402ae42bd83d9cd51de78ae9dd7be4cfd1c0c49
SSDEEP 1536:o2Y0VNblnigen1FQGpaika1PASjg/obRy:o23rbZi/8GprF3jg/oVy
TLSH
T19A836C12F7E0C236D997517212908BBF8A3DF53032061453F758EDFAAE395929A07E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion discovery

Malware Config

Signatures

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1708	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uploader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mode.com

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 5092	1008	uploader.exe	80
PID 5092 wrote to memory of 2404	5092	cmd.exe	81
PID 1008 wrote to memory of 4264	1008	uploader.exe	82
PID 1008 wrote to memory of 5004	1008	uploader.exe	83
PID 1008 wrote to memory of 3944	1008	uploader.exe	84
PID 1008 wrote to memory of 1708	1008	uploader.exe	85
PID 1708 wrote to memory of 2644	1708	cmd.exe	86
PID 1008 wrote to memory of 5060	1008	uploader.exe	87
PID 1008 wrote to memory of 5676	1008	uploader.exe	88
PID 1008 wrote to memory of 4280	1008	uploader.exe	89
PID 1008 wrote to memory of 4364	1008	uploader.exe	90

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2644	attrib.exe

C:\Users\Admin\AppData\Local\Temp\uploader.exe
"C:\Users\Admin\AppData\Local\Temp\uploader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con:cols=0120 lines=0030
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Windows\SysWOW64\mode.com
    mode con:cols=0120 lines=0030
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c title Window Title
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\myfiles" mkdir "C:\Users\Admin\AppData\Local\Temp\myfiles"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\wtmpd" mkdir "C:\Users\Admin\AppData\Local\Temp\wtmpd"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c attrib +h C:\Users\Admin\AppData\Local\Temp\wtmpd
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h C:\Users\Admin\AppData\Local\Temp\wtmpd
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c echo:0>C:\Users\Admin\AppData\Local\Temp\i6.t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\i6.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

i6.bat

Path C:\Users\Admin\AppData\Local\Temp\i6.bat
Size 173B
SHA256 941c169c07670650fc6c6148c1cae068b69bac209e05010594e164aafc7cdf8b
MD5 0f8f70e88009593eefaa155a8e31b1d6
SHA1 eabcc3f2135e0919e9456da0a4b1084f3382d4b6
SHA512 94df468b963f3c9d133a25e1ffa57039fac01fe960f0f738552ca6440e6242ff48d0b410fe70dd05a62e4842c925c9f2b0220ca9eb9cb4ff5490ada443c9a750
TLSH
T1F9C01211A349C50854C4362F157250CDA17E048A65F1EF500B51C45999C2558E7E5212
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads